2014-05-22 16:44:12

by sven.vermeulen

Subject: [refpolicy] [PATCH 1/1] xserver_t needs to enter dirs labeled xdm_var_run_t

The LightDM application stores its xauth file in a subdirectory
(/var/run/lightdm/root) which is labeled as xdm_var_run_t. As a result,
X11 (xserver_t) needs search rights to this location.

With this setup, X is run as follows:
/usr/bin/X :0 -auth /var/run/lightdm/root/:0

Signed-off-by: Jason Zaman <[email protected]>
Signed-off-by: Sven Vermeulen <[email protected]>
---
policy/modules/services/xserver.te | 1 +
1 file changed, 1 insertion(+)

diff --git a/policy/modules/services/xserver.te b/policy/modules/services/xserver.te
index f81fcac..c4239f0 100644
--- a/policy/modules/services/xserver.te
+++ b/policy/modules/services/xserver.te
@@ -821,6 +821,7 @@ allow xserver_t xdm_var_lib_t:file { getattr read };
dontaudit xserver_t xdm_var_lib_t:dir search;

allow xserver_t xdm_var_run_t:file read_file_perms;
+allow xserver_t xdm_var_run_t:dir search_dir_perms;

# Label pid and temporary files with derived types.
manage_files_pattern(xserver_t, xdm_tmp_t, xdm_tmp_t)
--
1.8.5.5

2014-05-27 12:50:52

by cpebenito

Subject: [refpolicy] [PATCH 1/1] xserver_t needs to enter dirs labeled xdm_var_run_t

On 05/22/2014 12:44 PM, Sven Vermeulen wrote:
> The LightDM application stores its xauth file in a subdirectory
> (/var/run/lightdm/root) which is labeled as xdm_var_run_t. As a result,
> X11 (xserver_t) needs search rights to this location.
>
> With this setup, X is run as follows:
> /usr/bin/X :0 -auth /var/run/lightdm/root/:0
>
> Signed-off-by: Jason Zaman <[email protected]>
> Signed-off-by: Sven Vermeulen <[email protected]>
> ---
> policy/modules/services/xserver.te | 1 +
> 1 file changed, 1 insertion(+)
>
> diff --git a/policy/modules/services/xserver.te b/policy/modules/services/xserver.te
> index f81fcac..c4239f0 100644
> --- a/policy/modules/services/xserver.te
> +++ b/policy/modules/services/xserver.te
> @@ -821,6 +821,7 @@ allow xserver_t xdm_var_lib_t:file { getattr read };
> dontaudit xserver_t xdm_var_lib_t:dir search;
>
> allow xserver_t xdm_var_run_t:file read_file_perms;
> +allow xserver_t xdm_var_run_t:dir search_dir_perms;
>
> # Label pid and temporary files with derived types.
> manage_files_pattern(xserver_t, xdm_tmp_t, xdm_tmp_t)

I'd prefer to change that added line and the line above it to read_files_pattern.

--
Chris PeBenito
Tresys Technology, LLC
http://www.tresys.com | oss.tresys.com