Received: by 2002:a25:8b91:0:0:0:0:0 with SMTP id j17csp7420341ybl; Tue, 24 Dec 2019 02:11:06 -0800 (PST) X-Google-Smtp-Source: APXvYqzWgGGVZRaYZ8n6aOxk2Hlz1cZzdkDWNECFwR1uE+Laj94Sg/6OJzkrSp8AvxuAF+DlHFiU X-Received: by 2002:a9d:6396:: with SMTP id w22mr37984437otk.364.1577182266548; Tue, 24 Dec 2019 02:11:06 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1577182266; cv=none; d=google.com; s=arc-20160816; b=vyCcqebL+TVYdCzahpdXCL/is5Pdbw5OMjUGQ7lhQiciJ+bpdcTNkp743udxWnJB9U /NT197N/4NLMX3dbK26vQiJxQ+zsYsU/Xc6kBzWC4VDSxB9Z76x/FnlQGsdqPo0gyDiH qVb7Y9L2HH5po5UG5jponDjHltsf1ErEuW6zzYVGhhn8UIQnciLAlsX3EFHRDGKKu7ss G80N+lSzhe/bX3epgBoFjpH5nk9kG8wIJhya6SsYzml46i6nyK4LdfpUf7FWYp/iGrVm Uxu34ILeUzuy/RGDQNSh/gtLC7BAwXU8qJQIByTkcRx3Jfz/be2kNlAdoJuKwNnCmXwE lxmQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from :dkim-signature; bh=91QvYcVpkiUbpfbSpn49WL+NbZCt6t/PY3ZxohPSf04=; b=jKh6hNstwL2s7urUvq0jlfIAmJpuNAkIe4F6nINbFafLg/jnrjLADJuUXmRE3Q1jry emd+7SgpfFjVWh1vGg/3JPrYHRvXMYQZxzOrev30SDSWHfDQySCZ+UbhzoafFhW8DoZ4 /oOH0f1hUgxAZZmgpmAymJ2C7U/WdQNueepdf1R6c69v+MsV8iBZLTKAm/KL8H6h4vYn nUMWNh3o8JlqDqE6+LMlnaafFVa6pPmFxPkMNZ/dVz5sbMFewvh7IuCzEhl/0lWiuI8W Z/yJ3hvlrB4vYE5Eoxby1tiDd5LQtK0n9dqkp/muByWEy83EWw1d9QJQqJLNkKwpsv/O vyug== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@perfinion-com.20150623.gappssmtp.com header.s=20150623 header.b=PFPYH09J; spf=pass (google.com: best guess record for domain of selinux-refpolicy-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=selinux-refpolicy-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id u188si8773942oia.80.2019.12.24.02.11.04; Tue, 24 Dec 2019 02:11:06 -0800 (PST) Received-SPF: pass (google.com: best guess record for domain of selinux-refpolicy-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@perfinion-com.20150623.gappssmtp.com header.s=20150623 header.b=PFPYH09J; spf=pass (google.com: best guess record for domain of selinux-refpolicy-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=selinux-refpolicy-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726154AbfLXKLD (ORCPT + 11 others); Tue, 24 Dec 2019 05:11:03 -0500 Received: from mail-pg1-f181.google.com ([209.85.215.181]:37028 "EHLO mail-pg1-f181.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726084AbfLXKLD (ORCPT ); Tue, 24 Dec 2019 05:11:03 -0500 Received: by mail-pg1-f181.google.com with SMTP id q127so10198827pga.4 for ; Tue, 24 Dec 2019 02:11:03 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=perfinion-com.20150623.gappssmtp.com; s=20150623; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=91QvYcVpkiUbpfbSpn49WL+NbZCt6t/PY3ZxohPSf04=; b=PFPYH09JzD9TQPKYc7ciyvEMHB4q5qbMPWsPUC+LjtKOC9JfeNE/JIak1HtQqVyyzm +ibdvLcl6ejpS+Q2VxuYzlnKgk72F8pyTBZTYslJo3+sKA8XEG3IpdvJ/6sMqA6/iMTR Js0biirRYQjkXhT+xaXc6asmzxZTNilVc10K91n5CkgyUdF+0JFWm1z1xkV8Qj0f8M7W QHzetZT2J4EcHMfSzY1B+ZZWOa+3L8YNfiM8FMrxOLsthfznC/K4oo2IpWUggLEWKM2B oKOyDDkKKIfviM3sF/fmmeNflzLGPtnRp+XGYecy1of8Hl39WLR+0jOsZhjfAqcUcBei tzew== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=91QvYcVpkiUbpfbSpn49WL+NbZCt6t/PY3ZxohPSf04=; b=N4uL8hsu4e5MZjAaZi+5iNXDeu6U4LquA8DEH90/0olr9FA7plOQB9A4gtw1dvDhZv Wj7ANL3nnKca8Vb/5Z53ayFq3HLii3qxZOEH5Cy/10j58zFRDpcrvftqZMa12Qd3fRkT K1mD0M91DQuee1Aur0LbbTt2IPvmyeevZoD2hyQx0GoRyHhPoZIT3SQRT5dJrMWT9PKj 722QYiGoy9STA64GYLajt9n3D45g8FJoPXVhmwzlXY2icNzx8ZFd7Cju6u1r6BdZE2jW NDQMxemK3u8b7BZChWqKvBFCKiDb59fSfumkXECJFOSKJoYfBy52uduhwOr38j701pE/ qbGw== X-Gm-Message-State: APjAAAXO3PF8TGe7n+4QyBY8GoB6fgi1a3Z0dehzmiEAILiemDevD+fC 7ApJ8ytXFebwW1hYl6ubHUwThoJ6tIl6Bg== X-Received: by 2002:aa7:9afb:: with SMTP id y27mr36774489pfp.91.1577182262514; Tue, 24 Dec 2019 02:11:02 -0800 (PST) Received: from localhost ([101.127.140.252]) by smtp.gmail.com with ESMTPSA id 136sm25009372pgg.74.2019.12.24.02.11.01 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 24 Dec 2019 02:11:01 -0800 (PST) From: Jason Zaman To: selinux-refpolicy@vger.kernel.org Cc: Jason Zaman , Jason Zaman Subject: [PATCH 3/9] xserver: ICEauthority can be in /run/user Date: Tue, 24 Dec 2019 18:10:37 +0800 Message-Id: <20191224101043.58122-3-jason@perfinion.com> X-Mailer: git-send-email 2.24.1 In-Reply-To: <20191224101043.58122-1-jason@perfinion.com> References: <20191224101043.58122-1-jason@perfinion.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Sender: selinux-refpolicy-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: selinux-refpolicy@vger.kernel.org From: Jason Zaman Signed-off-by: Jason Zaman --- policy/modules/services/xserver.fc | 2 ++ policy/modules/services/xserver.te | 2 ++ 2 files changed, 4 insertions(+) diff --git a/policy/modules/services/xserver.fc b/policy/modules/services/xserver.fc index fa8db862..df06151e 100644 --- a/policy/modules/services/xserver.fc +++ b/policy/modules/services/xserver.fc @@ -143,6 +143,8 @@ ifndef(`distro_debian',` /run/xauth(/.*)? gen_context(system_u:object_r:xdm_var_run_t,s0) /run/xdmctl(/.*)? gen_context(system_u:object_r:xdm_var_run_t,s0) +/run/user/%{USERID}/ICEauthority.* -- gen_context(system_u:object_r:iceauth_home_t,s0) + ifdef(`distro_suse',` /var/lib/pam_devperm/:0 -- gen_context(system_u:object_r:xdm_var_lib_t,s0) ') diff --git a/policy/modules/services/xserver.te b/policy/modules/services/xserver.te index f016d429..499f03a6 100644 --- a/policy/modules/services/xserver.te +++ b/policy/modules/services/xserver.te @@ -117,6 +117,7 @@ userdom_user_application_domain(iceauth_t, iceauth_exec_t) type iceauth_home_t; userdom_user_home_content(iceauth_home_t) +userdom_user_runtime_content(iceauth_home_t) type xauth_t; type xauth_exec_t; @@ -211,6 +212,7 @@ optional_policy(` allow iceauth_t iceauth_home_t:file manage_file_perms; userdom_user_home_dir_filetrans(iceauth_t, iceauth_home_t, file) +userdom_user_runtime_filetrans(iceauth_t, iceauth_home_t, file) allow xdm_t iceauth_home_t:file read_file_perms; -- 2.24.1