From: sven.vermeulen@siphos.be (Sven Vermeulen) Date: Thu, 22 May 2014 18:44:12 +0200 Subject: [refpolicy] [PATCH 1/1] xserver_t needs to enter dirs labeled xdm_var_run_t Message-ID: <1400777052-11493-1-git-send-email-sven.vermeulen@siphos.be> To: refpolicy@oss.tresys.com List-Id: refpolicy.oss.tresys.com The LightDM application stores its xauth file in a subdirectory (/var/run/lightdm/root) which is labeled as xdm_var_run_t. As a result, X11 (xserver_t) needs search rights to this location. With this setup, X is run as follows: /usr/bin/X :0 -auth /var/run/lightdm/root/:0 Signed-off-by: Jason Zaman Signed-off-by: Sven Vermeulen --- policy/modules/services/xserver.te | 1 + 1 file changed, 1 insertion(+) diff --git a/policy/modules/services/xserver.te b/policy/modules/services/xserver.te index f81fcac..c4239f0 100644 --- a/policy/modules/services/xserver.te +++ b/policy/modules/services/xserver.te @@ -821,6 +821,7 @@ allow xserver_t xdm_var_lib_t:file { getattr read }; dontaudit xserver_t xdm_var_lib_t:dir search; allow xserver_t xdm_var_run_t:file read_file_perms; +allow xserver_t xdm_var_run_t:dir search_dir_perms; # Label pid and temporary files with derived types. manage_files_pattern(xserver_t, xdm_tmp_t, xdm_tmp_t) -- 1.8.5.5