Let mozilla play audio:
- add new interfaces to the pulseaudio module;
- let mozilla read alsa configuration files;
- add further permissions to mozilla needed to use
pulseaudio to play audio.
Signed-off-by: Guido Trentalancia <[email protected]>
---
policy/modules/contrib/mozilla.te | 9 ++++
policy/modules/contrib/pulseaudio.if | 77 +++++++++++++++++++++++++++++++++++
2 files changed, 86 insertions(+)
--- refpolicy-git-06082016-orig/policy/modules/contrib/mozilla.te 2016-09-10 18:09:13.357710355 +0200
+++ refpolicy-git-06082016/policy/modules/contrib/mozilla.te 2016-09-10 18:07:16.322739208 +0200
@@ -234,6 +239,11 @@ tunable_policy(`use_samba_home_dirs',`
')
optional_policy(`
+ alsa_read_config(mozilla_t)
+ alsa_read_home_files(mozilla_t)
+')
+
+optional_policy(`
apache_read_user_scripts(mozilla_t)
apache_read_user_content(mozilla_t)
')
@@ -292,6 +305,8 @@ optional_policy(`
optional_policy(`
pulseaudio_run(mozilla_t, mozilla_roles)
+ pulseaudio_rw_tmpfs_files(mozilla_t)
+ pulseaudio_use_fds(mozilla_t)
')
optional_policy(`
@@ -561,6 +580,8 @@ optional_policy(`
optional_policy(`
pulseaudio_run(mozilla_plugin_t, mozilla_plugin_roles)
+ pulseaudio_rw_tmpfs_files(mozilla_plugin_t)
+ pulseaudio_use_fds(mozilla_plugin_t)
')
optional_policy(`
--- refpolicy-git-06082016-orig/policy/modules/contrib/pulseaudio.if 2016-08-20 03:45:31.740027060 +0200
+++ refpolicy-git-06082016/policy/modules/contrib/pulseaudio.if 2016-08-20 00:25:39.112517500 +0200
@@ -346,3 +347,80 @@ interface(`pulseaudio_tmpfs_content',`
typeattribute $1 pulseaudio_tmpfsfile;
')
+
+#######################################
+## <summary>
+## Read pulseaudio tmpfs files.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`pulseaudio_read_tmpfs_files',`
+ gen_require(`
+ type pulseaudio_tmpfs_t;
+ ')
+
+ fs_search_tmpfs($1)
+ read_files_pattern($1, pulseaudio_tmpfs_t, pulseaudio_tmpfs_t)
+')
+
+#######################################
+## <summary>
+## Read and write pulseaudio tmpfs
+## files.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`pulseaudio_rw_tmpfs_files',`
+ gen_require(`
+ type pulseaudio_tmpfs_t;
+ ')
+
+ fs_search_tmpfs($1)
+ rw_files_pattern($1, pulseaudio_tmpfs_t, pulseaudio_tmpfs_t)
+')
+
+########################################
+## <summary>
+## Use file descriptors for
+## pulseaudio.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`pulseaudio_use_fds',`
+ gen_require(`
+ type pulseaudio_t;
+ ')
+
+ allow $1 pulseaudio_t:fd use;
+')
+
+########################################
+## <summary>
+## Do not audit attempts to use the
+## file descriptors for pulseaudio.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`pulseaudio_dontaudit_use_fds',`
+ gen_require(`
+ type pulseaudio_t;
+ ')
+
+ dontaudit $1 pulseaudio_t:fd use;
+')
On 09/10/16 12:26, Guido Trentalancia via refpolicy wrote:
> Let mozilla play audio:
>
> - add new interfaces to the pulseaudio module;
> - let mozilla read alsa configuration files;
> - add further permissions to mozilla needed to use
> pulseaudio to play audio.
Merged.
> Signed-off-by: Guido Trentalancia <[email protected]>
> ---
> policy/modules/contrib/mozilla.te | 9 ++++
> policy/modules/contrib/pulseaudio.if | 77 +++++++++++++++++++++++++++++++++++
> 2 files changed, 86 insertions(+)
>
> --- refpolicy-git-06082016-orig/policy/modules/contrib/mozilla.te 2016-09-10 18:09:13.357710355 +0200
> +++ refpolicy-git-06082016/policy/modules/contrib/mozilla.te 2016-09-10 18:07:16.322739208 +0200
> @@ -234,6 +239,11 @@ tunable_policy(`use_samba_home_dirs',`
> ')
>
> optional_policy(`
> + alsa_read_config(mozilla_t)
> + alsa_read_home_files(mozilla_t)
> +')
> +
> +optional_policy(`
> apache_read_user_scripts(mozilla_t)
> apache_read_user_content(mozilla_t)
> ')
> @@ -292,6 +305,8 @@ optional_policy(`
>
> optional_policy(`
> pulseaudio_run(mozilla_t, mozilla_roles)
> + pulseaudio_rw_tmpfs_files(mozilla_t)
> + pulseaudio_use_fds(mozilla_t)
> ')
>
> optional_policy(`
> @@ -561,6 +580,8 @@ optional_policy(`
>
> optional_policy(`
> pulseaudio_run(mozilla_plugin_t, mozilla_plugin_roles)
> + pulseaudio_rw_tmpfs_files(mozilla_plugin_t)
> + pulseaudio_use_fds(mozilla_plugin_t)
> ')
>
> optional_policy(`
> --- refpolicy-git-06082016-orig/policy/modules/contrib/pulseaudio.if 2016-08-20 03:45:31.740027060 +0200
> +++ refpolicy-git-06082016/policy/modules/contrib/pulseaudio.if 2016-08-20 00:25:39.112517500 +0200
> @@ -346,3 +347,80 @@ interface(`pulseaudio_tmpfs_content',`
>
> typeattribute $1 pulseaudio_tmpfsfile;
> ')
> +
> +#######################################
> +## <summary>
> +## Read pulseaudio tmpfs files.
> +## </summary>
> +## <param name="domain">
> +## <summary>
> +## Domain allowed access.
> +## </summary>
> +## </param>
> +#
> +interface(`pulseaudio_read_tmpfs_files',`
> + gen_require(`
> + type pulseaudio_tmpfs_t;
> + ')
> +
> + fs_search_tmpfs($1)
> + read_files_pattern($1, pulseaudio_tmpfs_t, pulseaudio_tmpfs_t)
> +')
> +
> +#######################################
> +## <summary>
> +## Read and write pulseaudio tmpfs
> +## files.
> +## </summary>
> +## <param name="domain">
> +## <summary>
> +## Domain allowed access.
> +## </summary>
> +## </param>
> +#
> +interface(`pulseaudio_rw_tmpfs_files',`
> + gen_require(`
> + type pulseaudio_tmpfs_t;
> + ')
> +
> + fs_search_tmpfs($1)
> + rw_files_pattern($1, pulseaudio_tmpfs_t, pulseaudio_tmpfs_t)
> +')
> +
> +########################################
> +## <summary>
> +## Use file descriptors for
> +## pulseaudio.
> +## </summary>
> +## <param name="domain">
> +## <summary>
> +## Domain allowed access.
> +## </summary>
> +## </param>
> +#
> +interface(`pulseaudio_use_fds',`
> + gen_require(`
> + type pulseaudio_t;
> + ')
> +
> + allow $1 pulseaudio_t:fd use;
> +')
> +
> +########################################
> +## <summary>
> +## Do not audit attempts to use the
> +## file descriptors for pulseaudio.
> +## </summary>
> +## <param name="domain">
> +## <summary>
> +## Domain allowed access.
> +## </summary>
> +## </param>
> +#
> +interface(`pulseaudio_dontaudit_use_fds',`
> + gen_require(`
> + type pulseaudio_t;
> + ')
> +
> + dontaudit $1 pulseaudio_t:fd use;
> +')
> _______________________________________________
> refpolicy mailing list
> refpolicy at oss.tresys.com
> http://oss.tresys.com/mailman/listinfo/refpolicy
>
--
Chris PeBenito
On 09/10/2016 06:26 PM, Guido Trentalancia via refpolicy wrote:
> Let mozilla play audio:
>
> - add new interfaces to the pulseaudio module;
> - let mozilla read alsa configuration files;
> - add further permissions to mozilla needed to use
> pulseaudio to play audio.
>
> Signed-off-by: Guido Trentalancia <[email protected]>
> ---
> policy/modules/contrib/mozilla.te | 9 ++++
> policy/modules/contrib/pulseaudio.if | 77 +++++++++++++++++++++++++++++++++++
> 2 files changed, 86 insertions(+)
>
> --- refpolicy-git-06082016-orig/policy/modules/contrib/mozilla.te 2016-09-10 18:09:13.357710355 +0200
> +++ refpolicy-git-06082016/policy/modules/contrib/mozilla.te 2016-09-10 18:07:16.322739208 +0200
> @@ -234,6 +239,11 @@ tunable_policy(`use_samba_home_dirs',`
> ')
>
> optional_policy(`
> + alsa_read_config(mozilla_t)
> + alsa_read_home_files(mozilla_t)
> +')
> +
Applies to all pulseaudio clients, so this should have been added to
pulseaudio.te instead:
optional_policy(`
alsa_read_config(pulseaudio_client)
alsa_read_home_files(pulseaudio_client)
')
> +optional_policy(`
> apache_read_user_scripts(mozilla_t)
> apache_read_user_content(mozilla_t)
> ')
> @@ -292,6 +305,8 @@ optional_policy(`
>
> optional_policy(`
> pulseaudio_run(mozilla_t, mozilla_roles)
> + pulseaudio_rw_tmpfs_files(mozilla_t)
I wonder what exactly prompted you to add this. pulseaudio clients
should only be able to read and delete pulseaudio tmpfs files.
This is already in pulseaudio.te (so mozilla_t is already allowed to
read pulseaudio_tmpfs_t files (but not delete them, so that may be a bug
in pulseaudio.te:
read_files_pattern(pulseaudio_client, { pulseaudio_tmpfsfile
pulseaudio_tmpfs_t }, { pulseaudio_tmpfsfile pulseaudio_tmpfs_t })
> + pulseaudio_use_fds(mozilla_t)
This applies to all pulseaudio_client and thus should be added to
pulseaudio.te as follows instead:
pulseaudio_use_fds(pulseaudio_client)
> ')
>
> optional_policy(`
> @@ -561,6 +580,8 @@ optional_policy(`
>
> optional_policy(`
> pulseaudio_run(mozilla_plugin_t, mozilla_plugin_roles)
> + pulseaudio_rw_tmpfs_files(mozilla_plugin_t)
> + pulseaudio_use_fds(mozilla_plugin_t)
same as above
> ')
>
> optional_policy(`
> --- refpolicy-git-06082016-orig/policy/modules/contrib/pulseaudio.if 2016-08-20 03:45:31.740027060 +0200
> +++ refpolicy-git-06082016/policy/modules/contrib/pulseaudio.if 2016-08-20 00:25:39.112517500 +0200
> @@ -346,3 +347,80 @@ interface(`pulseaudio_tmpfs_content',`
>
> typeattribute $1 pulseaudio_tmpfsfile;
> ')
> +
> +#######################################
> +## <summary>
> +## Read pulseaudio tmpfs files.
> +## </summary>
> +## <param name="domain">
> +## <summary>
> +## Domain allowed access.
> +## </summary>
> +## </param>
> +#
> +interface(`pulseaudio_read_tmpfs_files',`
> + gen_require(`
> + type pulseaudio_tmpfs_t;
> + ')
> +
> + fs_search_tmpfs($1)
> + read_files_pattern($1, pulseaudio_tmpfs_t, pulseaudio_tmpfs_t)
> +')
> +
> +#######################################
> +## <summary>
> +## Read and write pulseaudio tmpfs
> +## files.
> +## </summary>
> +## <param name="domain">
> +## <summary>
> +## Domain allowed access.
> +## </summary>
> +## </param>
> +#
> +interface(`pulseaudio_rw_tmpfs_files',`
> + gen_require(`
> + type pulseaudio_tmpfs_t;
> + ')
> +
> + fs_search_tmpfs($1)
> + rw_files_pattern($1, pulseaudio_tmpfs_t, pulseaudio_tmpfs_t)
> +')
> +
> +########################################
> +## <summary>
> +## Use file descriptors for
> +## pulseaudio.
> +## </summary>
> +## <param name="domain">
> +## <summary>
> +## Domain allowed access.
> +## </summary>
> +## </param>
> +#
> +interface(`pulseaudio_use_fds',`
> + gen_require(`
> + type pulseaudio_t;
> + ')
> +
> + allow $1 pulseaudio_t:fd use;
> +')
> +
> +########################################
> +## <summary>
> +## Do not audit attempts to use the
> +## file descriptors for pulseaudio.
> +## </summary>
> +## <param name="domain">
> +## <summary>
> +## Domain allowed access.
> +## </summary>
> +## </param>
> +#
> +interface(`pulseaudio_dontaudit_use_fds',`
> + gen_require(`
> + type pulseaudio_t;
> + ')
> +
> + dontaudit $1 pulseaudio_t:fd use;
> +')
> _______________________________________________
> refpolicy mailing list
> refpolicy at oss.tresys.com
> http://oss.tresys.com/mailman/listinfo/refpolicy
>
--
Key fingerprint = 5F4D 3CDB D3F8 3652 FBD8 02D5 3B6C 5F1D 2C7B 6B02
https://sks-keyservers.net/pks/lookup?op=get&search=0x3B6C5F1D2C7B6B02
Dominick Grift
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 648 bytes
Desc: OpenPGP digital signature
Url : http://oss.tresys.com/pipermail/refpolicy/attachments/20160911/a6bdbbc8/attachment.bin
On Sun, 11/09/2016 at 09.03 -0400, Chris PeBenito wrote:
> On 09/10/16 12:26, Guido Trentalancia via refpolicy wrote:
> >
> > Let mozilla play audio:
> >
> > - add new interfaces to the pulseaudio module;
> > - let mozilla read alsa configuration files;
> > - add further permissions to mozilla needed to use
> > ? pulseaudio to play audio.
>
> Merged.
Excellent, thanks !
> > Signed-off-by: Guido Trentalancia <[email protected]>
> > ---
> > ?policy/modules/contrib/mozilla.te????|????9 ++++
> > ?policy/modules/contrib/pulseaudio.if |???77
> > +++++++++++++++++++++++++++++++++++
> > ?2 files changed, 86 insertions(+)
Best regards,
Guido
Hello Dominick (and cc Chris) !
On Sun, 11/09/2016 at 15.21 +0200, Dominick Grift via refpolicy wrote:
> On 09/10/2016 06:26 PM, Guido Trentalancia via refpolicy wrote:
> >
> > Let mozilla play audio:
> >
> > - add new interfaces to the pulseaudio module;
> > - let mozilla read alsa configuration files;
> > - add further permissions to mozilla needed to use
> > ? pulseaudio to play audio.
> >
> > Signed-off-by: Guido Trentalancia <[email protected]>
> > ---
> > ?policy/modules/contrib/mozilla.te????|????9 ++++
> > ?policy/modules/contrib/pulseaudio.if |???77
> > +++++++++++++++++++++++++++++++++++
> > ?2 files changed, 86 insertions(+)
[...]
> Applies to all pulseaudio clients, so this should have been added to
> pulseaudio.te instead:
I am fine with improving this.
> optional_policy(`
> alsa_read_config(pulseaudio_client)
> alsa_read_home_files(pulseaudio_client)
> ')
and this:
> >
> > + pulseaudio_use_fds(mozilla_t)
>
> This applies to all pulseaudio_client and thus should be added to
> pulseaudio.te as follows instead:
>
> pulseaudio_use_fds(pulseaudio_client)
as long as it is also fine to Christopher.
The other change (delete instead of read/write) doesn't make a big
difference in my opinion.
Here is the small diff:
Improvements to the mozilla and pulseaudio modules
as suggested by Dominick Grift.
policy/modules/contrib/mozilla.te | 14 --------------
policy/modules/contrib/pulseaudio.te | 8 ++++++++
2 files changed, 8 insertions(+), 14 deletions(-)
--- refpolicy-git-06082016-orig/policy/modules/contrib/mozilla.te 2016-09-11 17:05:47.916850416 +0200
+++ refpolicy-git-06082016/policy/modules/contrib/mozilla.te 2016-09-11 17:05:27.911531798 +0200
@@ -234,11 +267,6 @@ tunable_policy(`use_samba_home_dirs',`
')
optional_policy(`
- alsa_read_config(mozilla_t)
- alsa_read_home_files(mozilla_t)
-')
-
-optional_policy(`
apache_read_user_scripts(mozilla_t)
apache_read_user_content(mozilla_t)
')
@@ -297,8 +329,6 @@ optional_policy(`
optional_policy(`
pulseaudio_run(mozilla_t, mozilla_roles)
- pulseaudio_rw_tmpfs_files(mozilla_t)
- pulseaudio_use_fds(mozilla_t)
')
optional_policy(`
@@ -525,11 +569,6 @@ tunable_policy(`use_samba_home_dirs',`
')
optional_policy(`
- alsa_read_config(mozilla_plugin_t)
- alsa_read_home_files(mozilla_plugin_t)
-')
-
-optional_policy(`
automount_dontaudit_getattr_tmp_dirs(mozilla_plugin_t)
')
@@ -568,8 +607,6 @@ optional_policy(`
optional_policy(`
pulseaudio_run(mozilla_plugin_t, mozilla_plugin_roles)
- pulseaudio_rw_tmpfs_files(mozilla_plugin_t)
- pulseaudio_use_fds(mozilla_plugin_t)
')
optional_policy(`
--- refpolicy-git-06082016-orig/policy/modules/contrib/pulseaudio.te 2016-08-20 03:45:31.741027074 +0200
+++ refpolicy-git-06082016/policy/modules/contrib/pulseaudio.te 2016-09-11 17:15:40.155169246 +0200
@@ -231,6 +258,9 @@ pulseaudio_home_filetrans_pulseaudio_hom
pulseaudio_home_filetrans_pulseaudio_home(pulseaudio_client, file, ".pulse-cookie")
pulseaudio_signull(pulseaudio_client)
+pulseaudio_rw_tmpfs_files(pulseaudio_client)
+pulseaudio_use_fds(pulseaudio_client)
+
userdom_read_user_tmpfs_files(pulseaudio_client)
userdom_user_runtime_filetrans(pulseaudio_client, pulseaudio_tmp_t, dir, "pulse")
# userdom_delete_user_tmpfs_files(pulseaudio_client)
@@ -250,6 +280,11 @@ tunable_policy(`use_samba_home_dirs',`
')
optional_policy(`
+ alsa_read_config(pulseaudio_client)
+ alsa_read_home_files(pulseaudio_client)
+')
+
+optional_policy(`
pulseaudio_dbus_chat(pulseaudio_client)
')
On 09/11/16 11:22, Guido Trentalancia via refpolicy wrote:
> Hello Dominick (and cc Chris) !
>
> On Sun, 11/09/2016 at 15.21 +0200, Dominick Grift via refpolicy wrote:
>> On 09/10/2016 06:26 PM, Guido Trentalancia via refpolicy wrote:
>>>
>>> Let mozilla play audio:
>>>
>>> - add new interfaces to the pulseaudio module;
>>> - let mozilla read alsa configuration files;
>>> - add further permissions to mozilla needed to use
>>> pulseaudio to play audio.
>>>
>>> Signed-off-by: Guido Trentalancia <[email protected]>
>>> ---
>>> policy/modules/contrib/mozilla.te | 9 ++++
>>> policy/modules/contrib/pulseaudio.if | 77
>>> +++++++++++++++++++++++++++++++++++
>>> 2 files changed, 86 insertions(+)
>
> [...]
>
>> Applies to all pulseaudio clients, so this should have been added to
>> pulseaudio.te instead:
>
> I am fine with improving this.
>
>> optional_policy(`
>> alsa_read_config(pulseaudio_client)
>> alsa_read_home_files(pulseaudio_client)
>> ')
>
> and this:
>
>>>
>>> + pulseaudio_use_fds(mozilla_t)
>>
>> This applies to all pulseaudio_client and thus should be added to
>> pulseaudio.te as follows instead:
>>
>> pulseaudio_use_fds(pulseaudio_client)
>
> as long as it is also fine to Christopher.
If the rules apply to all pulseaudio domains, then it should be done as
Dominick suggests.
> The other change (delete instead of read/write) doesn't make a big
> difference in my opinion.
>
> Here is the small diff:
>
> Improvements to the mozilla and pulseaudio modules
> as suggested by Dominick Grift.
>
> policy/modules/contrib/mozilla.te | 14 --------------
> policy/modules/contrib/pulseaudio.te | 8 ++++++++
> 2 files changed, 8 insertions(+), 14 deletions(-)
>
> --- refpolicy-git-06082016-orig/policy/modules/contrib/mozilla.te 2016-09-11 17:05:47.916850416 +0200
> +++ refpolicy-git-06082016/policy/modules/contrib/mozilla.te 2016-09-11 17:05:27.911531798 +0200
> @@ -234,11 +267,6 @@ tunable_policy(`use_samba_home_dirs',`
> ')
>
> optional_policy(`
> - alsa_read_config(mozilla_t)
> - alsa_read_home_files(mozilla_t)
> -')
> -
> -optional_policy(`
> apache_read_user_scripts(mozilla_t)
> apache_read_user_content(mozilla_t)
> ')
> @@ -297,8 +329,6 @@ optional_policy(`
>
> optional_policy(`
> pulseaudio_run(mozilla_t, mozilla_roles)
> - pulseaudio_rw_tmpfs_files(mozilla_t)
> - pulseaudio_use_fds(mozilla_t)
> ')
>
> optional_policy(`
> @@ -525,11 +569,6 @@ tunable_policy(`use_samba_home_dirs',`
> ')
>
> optional_policy(`
> - alsa_read_config(mozilla_plugin_t)
> - alsa_read_home_files(mozilla_plugin_t)
> -')
> -
> -optional_policy(`
> automount_dontaudit_getattr_tmp_dirs(mozilla_plugin_t)
> ')
>
> @@ -568,8 +607,6 @@ optional_policy(`
>
> optional_policy(`
> pulseaudio_run(mozilla_plugin_t, mozilla_plugin_roles)
> - pulseaudio_rw_tmpfs_files(mozilla_plugin_t)
> - pulseaudio_use_fds(mozilla_plugin_t)
> ')
>
> optional_policy(`
> --- refpolicy-git-06082016-orig/policy/modules/contrib/pulseaudio.te 2016-08-20 03:45:31.741027074 +0200
> +++ refpolicy-git-06082016/policy/modules/contrib/pulseaudio.te 2016-09-11 17:15:40.155169246 +0200
> @@ -231,6 +258,9 @@ pulseaudio_home_filetrans_pulseaudio_hom
> pulseaudio_home_filetrans_pulseaudio_home(pulseaudio_client, file, ".pulse-cookie")
> pulseaudio_signull(pulseaudio_client)
>
> +pulseaudio_rw_tmpfs_files(pulseaudio_client)
> +pulseaudio_use_fds(pulseaudio_client)
> +
> userdom_read_user_tmpfs_files(pulseaudio_client)
> userdom_user_runtime_filetrans(pulseaudio_client, pulseaudio_tmp_t, dir, "pulse")
> # userdom_delete_user_tmpfs_files(pulseaudio_client)
> @@ -250,6 +280,11 @@ tunable_policy(`use_samba_home_dirs',`
> ')
>
> optional_policy(`
> + alsa_read_config(pulseaudio_client)
> + alsa_read_home_files(pulseaudio_client)
> +')
> +
> +optional_policy(`
> pulseaudio_dbus_chat(pulseaudio_client)
> ')
>
> _______________________________________________
> refpolicy mailing list
> refpolicy at oss.tresys.com
> http://oss.tresys.com/mailman/listinfo/refpolicy
>
--
Chris PeBenito
However consider that I have no indication that other pulseaudio clients also need those permissions...
There are no test results that indicate this.
So, although it's not very risky, change it at your own risk.
Regards,
Guido
Il 13 settembre 2016 00:51:44 CEST, Chris PeBenito <[email protected]> ha scritto:
>On 09/11/16 11:22, Guido Trentalancia via refpolicy wrote:
>> Hello Dominick (and cc Chris) !
>>
>> On Sun, 11/09/2016 at 15.21 +0200, Dominick Grift via refpolicy
>wrote:
>>> On 09/10/2016 06:26 PM, Guido Trentalancia via refpolicy wrote:
>>>>
>>>> Let mozilla play audio:
>>>>
>>>> - add new interfaces to the pulseaudio module;
>>>> - let mozilla read alsa configuration files;
>>>> - add further permissions to mozilla needed to use
>>>> pulseaudio to play audio.
>>>>
>>>> Signed-off-by: Guido Trentalancia <[email protected]>
>>>> ---
>>>> policy/modules/contrib/mozilla.te | 9 ++++
>>>> policy/modules/contrib/pulseaudio.if | 77
>>>> +++++++++++++++++++++++++++++++++++
>>>> 2 files changed, 86 insertions(+)
>>
>> [...]
>>
>>> Applies to all pulseaudio clients, so this should have been added to
>>> pulseaudio.te instead:
>>
>> I am fine with improving this.
>>
>>> optional_policy(`
>>> alsa_read_config(pulseaudio_client)
>>> alsa_read_home_files(pulseaudio_client)
>>> ')
>>
>> and this:
>>
>>>>
>>>> + pulseaudio_use_fds(mozilla_t)
>>>
>>> This applies to all pulseaudio_client and thus should be added to
>>> pulseaudio.te as follows instead:
>>>
>>> pulseaudio_use_fds(pulseaudio_client)
>>
>> as long as it is also fine to Christopher.
>
>If the rules apply to all pulseaudio domains, then it should be done as
>
>Dominick suggests.
>
>
>
>> The other change (delete instead of read/write) doesn't make a big
>> difference in my opinion.
>>
>> Here is the small diff:
>>
>> Improvements to the mozilla and pulseaudio modules
>> as suggested by Dominick Grift.
>>
>> policy/modules/contrib/mozilla.te | 14 --------------
>> policy/modules/contrib/pulseaudio.te | 8 ++++++++
>> 2 files changed, 8 insertions(+), 14 deletions(-)
>>
>> ---
>refpolicy-git-06082016-orig/policy/modules/contrib/mozilla.te 2016-09-11
>17:05:47.916850416 +0200
>> +++
>refpolicy-git-06082016/policy/modules/contrib/mozilla.te 2016-09-11
>17:05:27.911531798 +0200
>> @@ -234,11 +267,6 @@ tunable_policy(`use_samba_home_dirs',`
>> ')
>>
>> optional_policy(`
>> - alsa_read_config(mozilla_t)
>> - alsa_read_home_files(mozilla_t)
>> -')
>> -
>> -optional_policy(`
>> apache_read_user_scripts(mozilla_t)
>> apache_read_user_content(mozilla_t)
>> ')
>> @@ -297,8 +329,6 @@ optional_policy(`
>>
>> optional_policy(`
>> pulseaudio_run(mozilla_t, mozilla_roles)
>> - pulseaudio_rw_tmpfs_files(mozilla_t)
>> - pulseaudio_use_fds(mozilla_t)
>> ')
>>
>> optional_policy(`
>> @@ -525,11 +569,6 @@ tunable_policy(`use_samba_home_dirs',`
>> ')
>>
>> optional_policy(`
>> - alsa_read_config(mozilla_plugin_t)
>> - alsa_read_home_files(mozilla_plugin_t)
>> -')
>> -
>> -optional_policy(`
>> automount_dontaudit_getattr_tmp_dirs(mozilla_plugin_t)
>> ')
>>
>> @@ -568,8 +607,6 @@ optional_policy(`
>>
>> optional_policy(`
>> pulseaudio_run(mozilla_plugin_t, mozilla_plugin_roles)
>> - pulseaudio_rw_tmpfs_files(mozilla_plugin_t)
>> - pulseaudio_use_fds(mozilla_plugin_t)
>> ')
>>
>> optional_policy(`
>> ---
>refpolicy-git-06082016-orig/policy/modules/contrib/pulseaudio.te 2016-08-20
>03:45:31.741027074 +0200
>> +++
>refpolicy-git-06082016/policy/modules/contrib/pulseaudio.te 2016-09-11
>17:15:40.155169246 +0200
>> @@ -231,6 +258,9 @@ pulseaudio_home_filetrans_pulseaudio_hom
>> pulseaudio_home_filetrans_pulseaudio_home(pulseaudio_client, file,
>".pulse-cookie")
>> pulseaudio_signull(pulseaudio_client)
>>
>> +pulseaudio_rw_tmpfs_files(pulseaudio_client)
>> +pulseaudio_use_fds(pulseaudio_client)
>> +
>> userdom_read_user_tmpfs_files(pulseaudio_client)
>> userdom_user_runtime_filetrans(pulseaudio_client, pulseaudio_tmp_t,
>dir, "pulse")
>> # userdom_delete_user_tmpfs_files(pulseaudio_client)
>> @@ -250,6 +280,11 @@ tunable_policy(`use_samba_home_dirs',`
>> ')
>>
>> optional_policy(`
>> + alsa_read_config(pulseaudio_client)
>> + alsa_read_home_files(pulseaudio_client)
>> +')
>> +
>> +optional_policy(`
>> pulseaudio_dbus_chat(pulseaudio_client)
>> ')
>>
>> _______________________________________________
>> refpolicy mailing list
>> refpolicy at oss.tresys.com
>> http://oss.tresys.com/mailman/listinfo/refpolicy
>>
Hi!
There was a small diff attached to the previous message to move the permissions to the pulseaudio module in the pulseaudio_client section.
Please refer to that.
Guido
On the 13th of September 2016 00:51:44 CEST, Chris PeBenito <[email protected]> wrote:
>On 09/11/16 11:22, Guido Trentalancia via refpolicy wrote:
>> Hello Dominick (and cc Chris) !
>>
>> On Sun, 11/09/2016 at 15.21 +0200, Dominick Grift via refpolicy
>wrote:
>>> On 09/10/2016 06:26 PM, Guido Trentalancia via refpolicy wrote:
>>>>
>>>> Let mozilla play audio:
>>>>
>>>> - add new interfaces to the pulseaudio module;
>>>> - let mozilla read alsa configuration files;
>>>> - add further permissions to mozilla needed to use
>>>> pulseaudio to play audio.
>>>>
>>>> Signed-off-by: Guido Trentalancia <[email protected]>
>>>> ---
>>>> policy/modules/contrib/mozilla.te | 9 ++++
>>>> policy/modules/contrib/pulseaudio.if | 77
>>>> +++++++++++++++++++++++++++++++++++
>>>> 2 files changed, 86 insertions(+)
>>
>> [...]
>>
>>> Applies to all pulseaudio clients, so this should have been added to
>>> pulseaudio.te instead:
>>
>> I am fine with improving this.
>>
>>> optional_policy(`
>>> alsa_read_config(pulseaudio_client)
>>> alsa_read_home_files(pulseaudio_client)
>>> ')
>>
>> and this:
>>
>>>>
>>>> + pulseaudio_use_fds(mozilla_t)
>>>
>>> This applies to all pulseaudio_client and thus should be added to
>>> pulseaudio.te as follows instead:
>>>
>>> pulseaudio_use_fds(pulseaudio_client)
>>
>> as long as it is also fine to Christopher.
>
>If the rules apply to all pulseaudio domains, then it should be done as
>
>Dominick suggests.
>
>
>
>> The other change (delete instead of read/write) doesn't make a big
>> difference in my opinion.
>>
>> Here is the small diff:
>>
>> Improvements to the mozilla and pulseaudio modules
>> as suggested by Dominick Grift.
>>
>> policy/modules/contrib/mozilla.te | 14 --------------
>> policy/modules/contrib/pulseaudio.te | 8 ++++++++
>> 2 files changed, 8 insertions(+), 14 deletions(-)
>>
>> ---
>refpolicy-git-06082016-orig/policy/modules/contrib/mozilla.te 2016-09-11
>17:05:47.916850416 +0200
>> +++
>refpolicy-git-06082016/policy/modules/contrib/mozilla.te 2016-09-11
>17:05:27.911531798 +0200
>> @@ -234,11 +267,6 @@ tunable_policy(`use_samba_home_dirs',`
>> ')
>>
>> optional_policy(`
>> - alsa_read_config(mozilla_t)
>> - alsa_read_home_files(mozilla_t)
>> -')
>> -
>> -optional_policy(`
>> apache_read_user_scripts(mozilla_t)
>> apache_read_user_content(mozilla_t)
>> ')
>> @@ -297,8 +329,6 @@ optional_policy(`
>>
>> optional_policy(`
>> pulseaudio_run(mozilla_t, mozilla_roles)
>> - pulseaudio_rw_tmpfs_files(mozilla_t)
>> - pulseaudio_use_fds(mozilla_t)
>> ')
>>
>> optional_policy(`
>> @@ -525,11 +569,6 @@ tunable_policy(`use_samba_home_dirs',`
>> ')
>>
>> optional_policy(`
>> - alsa_read_config(mozilla_plugin_t)
>> - alsa_read_home_files(mozilla_plugin_t)
>> -')
>> -
>> -optional_policy(`
>> automount_dontaudit_getattr_tmp_dirs(mozilla_plugin_t)
>> ')
>>
>> @@ -568,8 +607,6 @@ optional_policy(`
>>
>> optional_policy(`
>> pulseaudio_run(mozilla_plugin_t, mozilla_plugin_roles)
>> - pulseaudio_rw_tmpfs_files(mozilla_plugin_t)
>> - pulseaudio_use_fds(mozilla_plugin_t)
>> ')
>>
>> optional_policy(`
>> ---
>refpolicy-git-06082016-orig/policy/modules/contrib/pulseaudio.te 2016-08-20
>03:45:31.741027074 +0200
>> +++
>refpolicy-git-06082016/policy/modules/contrib/pulseaudio.te 2016-09-11
>17:15:40.155169246 +0200
>> @@ -231,6 +258,9 @@ pulseaudio_home_filetrans_pulseaudio_hom
>> pulseaudio_home_filetrans_pulseaudio_home(pulseaudio_client, file,
>".pulse-cookie")
>> pulseaudio_signull(pulseaudio_client)
>>
>> +pulseaudio_rw_tmpfs_files(pulseaudio_client)
>> +pulseaudio_use_fds(pulseaudio_client)
>> +
>> userdom_read_user_tmpfs_files(pulseaudio_client)
>> userdom_user_runtime_filetrans(pulseaudio_client, pulseaudio_tmp_t,
>dir, "pulse")
>> # userdom_delete_user_tmpfs_files(pulseaudio_client)
>> @@ -250,6 +280,11 @@ tunable_policy(`use_samba_home_dirs',`
>> ')
>>
>> optional_policy(`
>> + alsa_read_config(pulseaudio_client)
>> + alsa_read_home_files(pulseaudio_client)
>> +')
>> +
>> +optional_policy(`
>> pulseaudio_dbus_chat(pulseaudio_client)
>> ')
>>
>> _______________________________________________
>> refpolicy mailing list
>> refpolicy at oss.tresys.com
>> http://oss.tresys.com/mailman/listinfo/refpolicy
>>
For your information.
Pulseaudio clients such as mplayer and pavucontrol do play audio and change the audio settings respectively without requiring those extra permissions in the pulseaudio module at the pulseaudio_client section.
Regards,
Guido
On the 13th of September 2016 00:51:44 CEST, Chris PeBenito <[email protected]> wrote:
>On 09/11/16 11:22, Guido Trentalancia via refpolicy wrote:
>> Hello Dominick (and cc Chris) !
>>
>> On Sun, 11/09/2016 at 15.21 +0200, Dominick Grift via refpolicy
>wrote:
>>> On 09/10/2016 06:26 PM, Guido Trentalancia via refpolicy wrote:
>>>>
>>>> Let mozilla play audio:
>>>>
>>>> - add new interfaces to the pulseaudio module;
>>>> - let mozilla read alsa configuration files;
>>>> - add further permissions to mozilla needed to use
>>>> pulseaudio to play audio.
>>>>
>>>> Signed-off-by: Guido Trentalancia <[email protected]>
>>>> ---
>>>> policy/modules/contrib/mozilla.te | 9 ++++
>>>> policy/modules/contrib/pulseaudio.if | 77
>>>> +++++++++++++++++++++++++++++++++++
>>>> 2 files changed, 86 insertions(+)
>>
>> [...]
>>
>>> Applies to all pulseaudio clients, so this should have been added to
>>> pulseaudio.te instead:
>>
>> I am fine with improving this.
>>
>>> optional_policy(`
>>> alsa_read_config(pulseaudio_client)
>>> alsa_read_home_files(pulseaudio_client)
>>> ')
>>
>> and this:
>>
>>>>
>>>> + pulseaudio_use_fds(mozilla_t)
>>>
>>> This applies to all pulseaudio_client and thus should be added to
>>> pulseaudio.te as follows instead:
>>>
>>> pulseaudio_use_fds(pulseaudio_client)
>>
>> as long as it is also fine to Christopher.
>
>If the rules apply to all pulseaudio domains, then it should be done as
>
>Dominick suggests.
>
>
>
>> The other change (delete instead of read/write) doesn't make a big
>> difference in my opinion.
>>
>> Here is the small diff:
>>
>> Improvements to the mozilla and pulseaudio modules
>> as suggested by Dominick Grift.
>>
>> policy/modules/contrib/mozilla.te | 14 --------------
>> policy/modules/contrib/pulseaudio.te | 8 ++++++++
>> 2 files changed, 8 insertions(+), 14 deletions(-)
>>
>> ---
>refpolicy-git-06082016-orig/policy/modules/contrib/mozilla.te 2016-09-11
>17:05:47.916850416 +0200
>> +++
>refpolicy-git-06082016/policy/modules/contrib/mozilla.te 2016-09-11
>17:05:27.911531798 +0200
>> @@ -234,11 +267,6 @@ tunable_policy(`use_samba_home_dirs',`
>> ')
>>
>> optional_policy(`
>> - alsa_read_config(mozilla_t)
>> - alsa_read_home_files(mozilla_t)
>> -')
>> -
>> -optional_policy(`
>> apache_read_user_scripts(mozilla_t)
>> apache_read_user_content(mozilla_t)
>> ')
>> @@ -297,8 +329,6 @@ optional_policy(`
>>
>> optional_policy(`
>> pulseaudio_run(mozilla_t, mozilla_roles)
>> - pulseaudio_rw_tmpfs_files(mozilla_t)
>> - pulseaudio_use_fds(mozilla_t)
>> ')
>>
>> optional_policy(`
>> @@ -525,11 +569,6 @@ tunable_policy(`use_samba_home_dirs',`
>> ')
>>
>> optional_policy(`
>> - alsa_read_config(mozilla_plugin_t)
>> - alsa_read_home_files(mozilla_plugin_t)
>> -')
>> -
>> -optional_policy(`
>> automount_dontaudit_getattr_tmp_dirs(mozilla_plugin_t)
>> ')
>>
>> @@ -568,8 +607,6 @@ optional_policy(`
>>
>> optional_policy(`
>> pulseaudio_run(mozilla_plugin_t, mozilla_plugin_roles)
>> - pulseaudio_rw_tmpfs_files(mozilla_plugin_t)
>> - pulseaudio_use_fds(mozilla_plugin_t)
>> ')
>>
>> optional_policy(`
>> ---
>refpolicy-git-06082016-orig/policy/modules/contrib/pulseaudio.te 2016-08-20
>03:45:31.741027074 +0200
>> +++
>refpolicy-git-06082016/policy/modules/contrib/pulseaudio.te 2016-09-11
>17:15:40.155169246 +0200
>> @@ -231,6 +258,9 @@ pulseaudio_home_filetrans_pulseaudio_hom
>> pulseaudio_home_filetrans_pulseaudio_home(pulseaudio_client, file,
>".pulse-cookie")
>> pulseaudio_signull(pulseaudio_client)
>>
>> +pulseaudio_rw_tmpfs_files(pulseaudio_client)
>> +pulseaudio_use_fds(pulseaudio_client)
>> +
>> userdom_read_user_tmpfs_files(pulseaudio_client)
>> userdom_user_runtime_filetrans(pulseaudio_client, pulseaudio_tmp_t,
>dir, "pulse")
>> # userdom_delete_user_tmpfs_files(pulseaudio_client)
>> @@ -250,6 +280,11 @@ tunable_policy(`use_samba_home_dirs',`
>> ')
>>
>> optional_policy(`
>> + alsa_read_config(pulseaudio_client)
>> + alsa_read_home_files(pulseaudio_client)
>> +')
>> +
>> +optional_policy(`
>> pulseaudio_dbus_chat(pulseaudio_client)
>> ')
>>
>> _______________________________________________
>> refpolicy mailing list
>> refpolicy at oss.tresys.com
>> http://oss.tresys.com/mailman/listinfo/refpolicy
>>
On 09/13/2016 01:57 PM, Guido Trentalancia via refpolicy wrote:
> For your information.
>
> Pulseaudio clients such as mplayer and pavucontrol do play audio and change the audio settings respectively without requiring those extra permissions in the pulseaudio module at the pulseaudio_client section.
>
I have to admit that mplayer seems to not need to read /etc/alsa in my
quick test either.
So yes I may just be wrong about this, or maybe i am just not able to
trigger it in short notice.
> Regards,
>
> Guido
>
> On the 13th of September 2016 00:51:44 CEST, Chris PeBenito <[email protected]> wrote:
>> On 09/11/16 11:22, Guido Trentalancia via refpolicy wrote:
>>> Hello Dominick (and cc Chris) !
>>>
>>> On Sun, 11/09/2016 at 15.21 +0200, Dominick Grift via refpolicy
>> wrote:
>>>> On 09/10/2016 06:26 PM, Guido Trentalancia via refpolicy wrote:
>>>>>
>>>>> Let mozilla play audio:
>>>>>
>>>>> - add new interfaces to the pulseaudio module;
>>>>> - let mozilla read alsa configuration files;
>>>>> - add further permissions to mozilla needed to use
>>>>> pulseaudio to play audio.
>>>>>
>>>>> Signed-off-by: Guido Trentalancia <[email protected]>
>>>>> ---
>>>>> policy/modules/contrib/mozilla.te | 9 ++++
>>>>> policy/modules/contrib/pulseaudio.if | 77
>>>>> +++++++++++++++++++++++++++++++++++
>>>>> 2 files changed, 86 insertions(+)
>>>
>>> [...]
>>>
>>>> Applies to all pulseaudio clients, so this should have been added to
>>>> pulseaudio.te instead:
>>>
>>> I am fine with improving this.
>>>
>>>> optional_policy(`
>>>> alsa_read_config(pulseaudio_client)
>>>> alsa_read_home_files(pulseaudio_client)
>>>> ')
>>>
>>> and this:
>>>
>>>>>
>>>>> + pulseaudio_use_fds(mozilla_t)
>>>>
>>>> This applies to all pulseaudio_client and thus should be added to
>>>> pulseaudio.te as follows instead:
>>>>
>>>> pulseaudio_use_fds(pulseaudio_client)
>>>
>>> as long as it is also fine to Christopher.
>>
>> If the rules apply to all pulseaudio domains, then it should be done as
>>
>> Dominick suggests.
>>
>>
>>
>>> The other change (delete instead of read/write) doesn't make a big
>>> difference in my opinion.
>>>
>>> Here is the small diff:
>>>
>>> Improvements to the mozilla and pulseaudio modules
>>> as suggested by Dominick Grift.
>>>
>>> policy/modules/contrib/mozilla.te | 14 --------------
>>> policy/modules/contrib/pulseaudio.te | 8 ++++++++
>>> 2 files changed, 8 insertions(+), 14 deletions(-)
>>>
>>> ---
>> refpolicy-git-06082016-orig/policy/modules/contrib/mozilla.te 2016-09-11
>> 17:05:47.916850416 +0200
>>> +++
>> refpolicy-git-06082016/policy/modules/contrib/mozilla.te 2016-09-11
>> 17:05:27.911531798 +0200
>>> @@ -234,11 +267,6 @@ tunable_policy(`use_samba_home_dirs',`
>>> ')
>>>
>>> optional_policy(`
>>> - alsa_read_config(mozilla_t)
>>> - alsa_read_home_files(mozilla_t)
>>> -')
>>> -
>>> -optional_policy(`
>>> apache_read_user_scripts(mozilla_t)
>>> apache_read_user_content(mozilla_t)
>>> ')
>>> @@ -297,8 +329,6 @@ optional_policy(`
>>>
>>> optional_policy(`
>>> pulseaudio_run(mozilla_t, mozilla_roles)
>>> - pulseaudio_rw_tmpfs_files(mozilla_t)
>>> - pulseaudio_use_fds(mozilla_t)
>>> ')
>>>
>>> optional_policy(`
>>> @@ -525,11 +569,6 @@ tunable_policy(`use_samba_home_dirs',`
>>> ')
>>>
>>> optional_policy(`
>>> - alsa_read_config(mozilla_plugin_t)
>>> - alsa_read_home_files(mozilla_plugin_t)
>>> -')
>>> -
>>> -optional_policy(`
>>> automount_dontaudit_getattr_tmp_dirs(mozilla_plugin_t)
>>> ')
>>>
>>> @@ -568,8 +607,6 @@ optional_policy(`
>>>
>>> optional_policy(`
>>> pulseaudio_run(mozilla_plugin_t, mozilla_plugin_roles)
>>> - pulseaudio_rw_tmpfs_files(mozilla_plugin_t)
>>> - pulseaudio_use_fds(mozilla_plugin_t)
>>> ')
>>>
>>> optional_policy(`
>>> ---
>> refpolicy-git-06082016-orig/policy/modules/contrib/pulseaudio.te 2016-08-20
>> 03:45:31.741027074 +0200
>>> +++
>> refpolicy-git-06082016/policy/modules/contrib/pulseaudio.te 2016-09-11
>> 17:15:40.155169246 +0200
>>> @@ -231,6 +258,9 @@ pulseaudio_home_filetrans_pulseaudio_hom
>>> pulseaudio_home_filetrans_pulseaudio_home(pulseaudio_client, file,
>> ".pulse-cookie")
>>> pulseaudio_signull(pulseaudio_client)
>>>
>>> +pulseaudio_rw_tmpfs_files(pulseaudio_client)
>>> +pulseaudio_use_fds(pulseaudio_client)
>>> +
>>> userdom_read_user_tmpfs_files(pulseaudio_client)
>>> userdom_user_runtime_filetrans(pulseaudio_client, pulseaudio_tmp_t,
>> dir, "pulse")
>>> # userdom_delete_user_tmpfs_files(pulseaudio_client)
>>> @@ -250,6 +280,11 @@ tunable_policy(`use_samba_home_dirs',`
>>> ')
>>>
>>> optional_policy(`
>>> + alsa_read_config(pulseaudio_client)
>>> + alsa_read_home_files(pulseaudio_client)
>>> +')
>>> +
>>> +optional_policy(`
>>> pulseaudio_dbus_chat(pulseaudio_client)
>>> ')
>>>
>>> _______________________________________________
>>> refpolicy mailing list
>>> refpolicy at oss.tresys.com
>>> http://oss.tresys.com/mailman/listinfo/refpolicy
>>>
>
> _______________________________________________
> refpolicy mailing list
> refpolicy at oss.tresys.com
> http://oss.tresys.com/mailman/listinfo/refpolicy
>
--
Key fingerprint = 5F4D 3CDB D3F8 3652 FBD8 02D5 3B6C 5F1D 2C7B 6B02
https://sks-keyservers.net/pks/lookup?op=get&search=0x3B6C5F1D2C7B6B02
Dominick Grift
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 648 bytes
Desc: OpenPGP digital signature
Url : http://oss.tresys.com/pipermail/refpolicy/attachments/20160913/bb0ca895/attachment.bin
Just pump up the volume and enjoy!!
Guido
On the 13th of September 2016 16:40:13 CEST, Dominick Grift via refpolicy <[email protected]> wrote:
>On 09/13/2016 01:57 PM, Guido Trentalancia via refpolicy wrote:
>> For your information.
>>
>> Pulseaudio clients such as mplayer and pavucontrol do play audio and
>change the audio settings respectively without requiring those extra
>permissions in the pulseaudio module at the pulseaudio_client section.
>>
>
>I have to admit that mplayer seems to not need to read /etc/alsa in my
>quick test either.
>
>So yes I may just be wrong about this, or maybe i am just not able to
>trigger it in short notice.
>
>> Regards,
>>
>> Guido
>>
>> On the 13th of September 2016 00:51:44 CEST, Chris PeBenito
><[email protected]> wrote:
>>> On 09/11/16 11:22, Guido Trentalancia via refpolicy wrote:
>>>> Hello Dominick (and cc Chris) !
>>>>
>>>> On Sun, 11/09/2016 at 15.21 +0200, Dominick Grift via refpolicy
>>> wrote:
>>>>> On 09/10/2016 06:26 PM, Guido Trentalancia via refpolicy wrote:
>>>>>>
>>>>>> Let mozilla play audio:
>>>>>>
>>>>>> - add new interfaces to the pulseaudio module;
>>>>>> - let mozilla read alsa configuration files;
>>>>>> - add further permissions to mozilla needed to use
>>>>>> pulseaudio to play audio.
>>>>>>
>>>>>> Signed-off-by: Guido Trentalancia <[email protected]>
>>>>>> ---
>>>>>> policy/modules/contrib/mozilla.te | 9 ++++
>>>>>> policy/modules/contrib/pulseaudio.if | 77
>>>>>> +++++++++++++++++++++++++++++++++++
>>>>>> 2 files changed, 86 insertions(+)
>>>>
>>>> [...]
>>>>
>>>>> Applies to all pulseaudio clients, so this should have been added
>to
>>>>> pulseaudio.te instead:
>>>>
>>>> I am fine with improving this.
>>>>
>>>>> optional_policy(`
>>>>> alsa_read_config(pulseaudio_client)
>>>>> alsa_read_home_files(pulseaudio_client)
>>>>> ')
>>>>
>>>> and this:
>>>>
>>>>>>
>>>>>> + pulseaudio_use_fds(mozilla_t)
>>>>>
>>>>> This applies to all pulseaudio_client and thus should be added to
>>>>> pulseaudio.te as follows instead:
>>>>>
>>>>> pulseaudio_use_fds(pulseaudio_client)
>>>>
>>>> as long as it is also fine to Christopher.
>>>
>>> If the rules apply to all pulseaudio domains, then it should be done
>as
>>>
>>> Dominick suggests.
>>>
>>>
>>>
>>>> The other change (delete instead of read/write) doesn't make a big
>>>> difference in my opinion.
>>>>
>>>> Here is the small diff:
>>>>
>>>> Improvements to the mozilla and pulseaudio modules
>>>> as suggested by Dominick Grift.
>>>>
>>>> policy/modules/contrib/mozilla.te | 14 --------------
>>>> policy/modules/contrib/pulseaudio.te | 8 ++++++++
>>>> 2 files changed, 8 insertions(+), 14 deletions(-)
>>>>
>>>> ---
>>>
>refpolicy-git-06082016-orig/policy/modules/contrib/mozilla.te 2016-09-11
>>> 17:05:47.916850416 +0200
>>>> +++
>>> refpolicy-git-06082016/policy/modules/contrib/mozilla.te 2016-09-11
>>> 17:05:27.911531798 +0200
>>>> @@ -234,11 +267,6 @@ tunable_policy(`use_samba_home_dirs',`
>>>> ')
>>>>
>>>> optional_policy(`
>>>> - alsa_read_config(mozilla_t)
>>>> - alsa_read_home_files(mozilla_t)
>>>> -')
>>>> -
>>>> -optional_policy(`
>>>> apache_read_user_scripts(mozilla_t)
>>>> apache_read_user_content(mozilla_t)
>>>> ')
>>>> @@ -297,8 +329,6 @@ optional_policy(`
>>>>
>>>> optional_policy(`
>>>> pulseaudio_run(mozilla_t, mozilla_roles)
>>>> - pulseaudio_rw_tmpfs_files(mozilla_t)
>>>> - pulseaudio_use_fds(mozilla_t)
>>>> ')
>>>>
>>>> optional_policy(`
>>>> @@ -525,11 +569,6 @@ tunable_policy(`use_samba_home_dirs',`
>>>> ')
>>>>
>>>> optional_policy(`
>>>> - alsa_read_config(mozilla_plugin_t)
>>>> - alsa_read_home_files(mozilla_plugin_t)
>>>> -')
>>>> -
>>>> -optional_policy(`
>>>> automount_dontaudit_getattr_tmp_dirs(mozilla_plugin_t)
>>>> ')
>>>>
>>>> @@ -568,8 +607,6 @@ optional_policy(`
>>>>
>>>> optional_policy(`
>>>> pulseaudio_run(mozilla_plugin_t, mozilla_plugin_roles)
>>>> - pulseaudio_rw_tmpfs_files(mozilla_plugin_t)
>>>> - pulseaudio_use_fds(mozilla_plugin_t)
>>>> ')
>>>>
>>>> optional_policy(`
>>>> ---
>>>
>refpolicy-git-06082016-orig/policy/modules/contrib/pulseaudio.te 2016-08-20
>>> 03:45:31.741027074 +0200
>>>> +++
>>>
>refpolicy-git-06082016/policy/modules/contrib/pulseaudio.te 2016-09-11
>>> 17:15:40.155169246 +0200
>>>> @@ -231,6 +258,9 @@ pulseaudio_home_filetrans_pulseaudio_hom
>>>> pulseaudio_home_filetrans_pulseaudio_home(pulseaudio_client, file,
>>> ".pulse-cookie")
>>>> pulseaudio_signull(pulseaudio_client)
>>>>
>>>> +pulseaudio_rw_tmpfs_files(pulseaudio_client)
>>>> +pulseaudio_use_fds(pulseaudio_client)
>>>> +
>>>> userdom_read_user_tmpfs_files(pulseaudio_client)
>>>> userdom_user_runtime_filetrans(pulseaudio_client,
>pulseaudio_tmp_t,
>>> dir, "pulse")
>>>> # userdom_delete_user_tmpfs_files(pulseaudio_client)
>>>> @@ -250,6 +280,11 @@ tunable_policy(`use_samba_home_dirs',`
>>>> ')
>>>>
>>>> optional_policy(`
>>>> + alsa_read_config(pulseaudio_client)
>>>> + alsa_read_home_files(pulseaudio_client)
>>>> +')
>>>> +
>>>> +optional_policy(`
>>>> pulseaudio_dbus_chat(pulseaudio_client)
>>>> ')
>>>>
>>>> _______________________________________________
>>>> refpolicy mailing list
>>>> refpolicy at oss.tresys.com
>>>> http://oss.tresys.com/mailman/listinfo/refpolicy
>>>>
>>
>> _______________________________________________
>> refpolicy mailing list
>> refpolicy at oss.tresys.com
>> http://oss.tresys.com/mailman/listinfo/refpolicy
>>