I need quite a few rules to make ConsoleKit work.
Best wishes,
Martin
Index: policy/modules/services/consolekit.te
===================================================================
--- policy/modules/services/consolekit.te.orig
+++ policy/modules/services/consolekit.te
@@ -10,6 +10,9 @@
type consolekit_exec_t;
init_daemon_domain(consolekit_t, consolekit_exec_t)
+type consolekit_var_log_t;
+logging_log_file(consolekit_var_log_t)
+
type consolekit_var_run_t;
files_pid_file(consolekit_var_run_t)
@@ -24,12 +27,17 @@
allow consolekit_t self:unix_stream_socket create_stream_socket_perms;
allow consolekit_t self:unix_dgram_socket create_socket_perms;
+manage_files_pattern(consolekit_t, consolekit_var_log_t, consolekit_var_log_t)
+logging_log_filetrans(consolekit_t, consolekit_var_log_t, file)
+
+manage_dirs_pattern(consolekit_t, consolekit_var_run_t, consolekit_var_run_t)
manage_files_pattern(consolekit_t, consolekit_var_run_t, consolekit_var_run_t)
-files_pid_filetrans(consolekit_t, consolekit_var_run_t, file)
+files_pid_filetrans(consolekit_t, consolekit_var_run_t, { file dir })
kernel_read_system_state(consolekit_t)
corecmd_exec_bin(consolekit_t)
+corecmd_exec_shell(consolekit_t)
dev_read_urand(consolekit_t)
dev_read_sysfs(consolekit_t)
@@ -43,8 +51,11 @@
fs_list_inotifyfs(consolekit_t)
+logging_send_syslog_msg(consolekit_t)
+
term_use_all_terms(consolekit_t)
+auth_manage_pam_console_data(consolekit_t)
auth_use_nsswitch(consolekit_t)
miscfiles_read_localization(consolekit_t)
@@ -62,5 +73,6 @@
optional_policy(`
xserver_read_user_xauth(consolekit_t)
+ xserver_rw_xdm_tmp_files(consolekit_t)
xserver_stream_connect(consolekit_t)
')
Index: policy/modules/services/consolekit.fc
===================================================================
--- policy/modules/services/consolekit.fc.orig
+++ policy/modules/services/consolekit.fc
@@ -1,3 +1,6 @@
/usr/sbin/console-kit-daemon -- gen_context(system_u:object_r:consolekit_exec_t,s0)
+/var/log/ConsoleKit(/.*)? gen_context(system_u:object_r:consolekit_var_log_t,s0)
+
+/var/run/ConsoleKit(/.*)? gen_context(system_u:object_r:consolekit_var_run_t,s0)
/var/run/consolekit\.pid -- gen_context(system_u:object_r:consolekit_var_run_t,s0)
Index: policy/modules/kernel/corecommands.fc
===================================================================
--- policy/modules/kernel/corecommands.fc.orig
+++ policy/modules/kernel/corecommands.fc
@@ -148,8 +148,7 @@
/usr/lib/qt.*/bin(/.*)? gen_context(system_u:object_r:bin_t,s0)
/usr/lib(64)?/[^/]*firefox[^/]*/firefox -- gen_context(system_u:object_r:bin_t,s0)
/usr/lib(64)?/apt/methods.+ -- gen_context(system_u:object_r:bin_t,s0)
-/usr/lib(64)?/ConsoleKit/scripts(/.*)? gen_context(system_u:object_r:bin_t,s0)
-/usr/lib(64)?/ConsoleKit/run-session.d(/.*)? gen_context(system_u:object_r:bin_t,s0)
+/usr/lib(64)?/ConsoleKit(/.*)? gen_context(system_u:object_r:bin_t,s0)
/usr/lib(64)?/courier(/.*)? gen_context(system_u:object_r:bin_t,s0)
/usr/lib(64)?/cups(/.*)? gen_context(system_u:object_r:bin_t,s0)
--
Martin Orr