2011-02-28 19:38:01

by Guido Trentalancia

Subject: [refpolicy] [PATCH]: xauth label and module request

When starting the X server from the console (using the startx script
that is being shipped with package xinit from X.Org), a few more
permissions are needed from the reference policy.

The label is for a file created by the startx script (from X.Org) and
the module being requested is ipv6 (which can be disabled by other
means).

--- refpolicy-git-15022011-under-test-and-use/policy/modules/services/xserver.te 2011-02-20 06:35:17.092746837 +0100
+++ refpolicy-git-15022011-xauth-insmod/policy/modules/services/xserver.te 2011-02-28 20:34:42.602106786 +0100
@@ -269,6 +269,8 @@ domain_use_interactive_fds(xauth_t)
files_read_etc_files(xauth_t)
files_search_pids(xauth_t)

+kernel_request_load_module(xauth_t)
+
fs_getattr_xattr_fs(xauth_t)
fs_search_auto_mountpoints(xauth_t)

--- refpolicy-git-15022011-under-test-and-use/policy/modules/services/xserver.fc 2011-01-08 19:07:21.343757306 +0100
+++ refpolicy-git-15022011-xauth-insmod/policy/modules/services/xserver.fc 2011-02-27 21:11:12.475768819 +0100
@@ -8,6 +8,7 @@ HOME_DIR/\.fonts\.cache-.* -- gen_contex
HOME_DIR/\.ICEauthority.* -- gen_context(system_u:object_r:iceauth_home_t,s0)
HOME_DIR/\.xauth.* -- gen_context(system_u:object_r:xauth_home_t,s0)
HOME_DIR/\.Xauthority.* -- gen_context(system_u:object_r:xauth_home_t,s0)
+HOME_DIR/\.serverauth.* -- gen_context(system_u:object_r:xauth_home_t,s0)

#
# /dev

2011-03-16 12:48:52

by cpebenito

Subject: [refpolicy] [PATCH]: xauth label and module request

On 02/28/11 14:38, Guido Trentalancia wrote:
> When starting the X server from the console (using the startx script
> that is being shipped with package xinit from X.Org), a few more
> permissions are needed from the reference policy.
>
> The label is for a file created by the startx script (from X.Org) and
> the module being requested is ipv6 (which can be disabled by other
> means).

Merged.

> --- refpolicy-git-15022011-under-test-and-use/policy/modules/services/xserver.te 2011-02-20 06:35:17.092746837 +0100
> +++ refpolicy-git-15022011-xauth-insmod/policy/modules/services/xserver.te 2011-02-28 20:34:42.602106786 +0100
> @@ -269,6 +269,8 @@ domain_use_interactive_fds(xauth_t)
> files_read_etc_files(xauth_t)
> files_search_pids(xauth_t)
>
> +kernel_request_load_module(xauth_t)
> +
> fs_getattr_xattr_fs(xauth_t)
> fs_search_auto_mountpoints(xauth_t)
>
> --- refpolicy-git-15022011-under-test-and-use/policy/modules/services/xserver.fc 2011-01-08 19:07:21.343757306 +0100
> +++ refpolicy-git-15022011-xauth-insmod/policy/modules/services/xserver.fc 2011-02-27 21:11:12.475768819 +0100
> @@ -8,6 +8,7 @@ HOME_DIR/\.fonts\.cache-.* -- gen_contex
> HOME_DIR/\.ICEauthority.* -- gen_context(system_u:object_r:iceauth_home_t,s0)
> HOME_DIR/\.xauth.* -- gen_context(system_u:object_r:xauth_home_t,s0)
> HOME_DIR/\.Xauthority.* -- gen_context(system_u:object_r:xauth_home_t,s0)
> +HOME_DIR/\.serverauth.* -- gen_context(system_u:object_r:xauth_home_t,s0)
>
> #
> # /dev
>
>


--
Chris PeBenito
Tresys Technology, LLC
http://www.tresys.com | oss.tresys.com