From: cpebenito@tresys.com (Christopher J. PeBenito) Date: Thu, 22 Oct 2009 10:05:13 -0400 Subject: [refpolicy] [ screen patch 1/1] Add screen-locking functionality. Signed-off-by: Dominick Grift In-Reply-To: <20091022135635.GA3562@notebook3.grift.internal> References: <20091022091425.GA2632@notebook3.grift.internal> <1256219581.28212.5.camel@gorn.columbia.tresys.com> <20091022135635.GA3562@notebook3.grift.internal> Message-ID: <1256220316.28212.6.camel@gorn.columbia.tresys.com> To: refpolicy@oss.tresys.com List-Id: refpolicy.oss.tresys.com On Thu, 2009-10-22 at 15:56 +0200, Dominick Grift wrote: > On Thu, Oct 22, 2009 at 09:53:01AM -0400, Christopher J. PeBenito wrote: > > On Thu, 2009-10-22 at 11:14 +0200, Dominick Grift wrote: > > > @@ -146,4 +148,8 @@ template(`screen_role_template',` > > > fs_list_nfs($1_screen_t) > > > fs_read_nfs_symlinks($1_screen_t) > > > ') > > > + > > > + optional_policy(` > > > + dbus_system_bus_client($1_screen_t) > > > + ') > > > > Is this an unrelated change? > > No it is related: > > allow dgrift_screen_t chkpwd_exec_t:file { read execute open execute_no_trans }; > allow dgrift_screen_t self:capability { audit_write dac_override }; > allow dgrift_screen_t self:fifo_file { write read ioctl }; > allow dgrift_screen_t self:netlink_audit_socket { nlmsg_relay write create read }; > allow dgrift_screen_t system_dbusd_t:unix_stream_socket connectto; > allow dgrift_screen_t system_dbusd_var_run_t:sock_file write; > > This is all related to screen-locking If dbus is required for screen locking, then the other rules should go in the dbus optional, along with a comment about screen locking. -- Chris PeBenito Tresys Technology, LLC (410) 290-1411 x150