From: cpebenito@tresys.com (Christopher J. PeBenito) Date: Tue, 27 May 2014 08:50:52 -0400 Subject: [refpolicy] [PATCH 1/1] xserver_t needs to enter dirs labeled xdm_var_run_t In-Reply-To: <1400777052-11493-1-git-send-email-sven.vermeulen@siphos.be> References: <1400777052-11493-1-git-send-email-sven.vermeulen@siphos.be> Message-ID: <53848A2C.1020903@tresys.com> To: refpolicy@oss.tresys.com List-Id: refpolicy.oss.tresys.com On 05/22/2014 12:44 PM, Sven Vermeulen wrote: > The LightDM application stores its xauth file in a subdirectory > (/var/run/lightdm/root) which is labeled as xdm_var_run_t. As a result, > X11 (xserver_t) needs search rights to this location. > > With this setup, X is run as follows: > /usr/bin/X :0 -auth /var/run/lightdm/root/:0 > > Signed-off-by: Jason Zaman > Signed-off-by: Sven Vermeulen > --- > policy/modules/services/xserver.te | 1 + > 1 file changed, 1 insertion(+) > > diff --git a/policy/modules/services/xserver.te b/policy/modules/services/xserver.te > index f81fcac..c4239f0 100644 > --- a/policy/modules/services/xserver.te > +++ b/policy/modules/services/xserver.te > @@ -821,6 +821,7 @@ allow xserver_t xdm_var_lib_t:file { getattr read }; > dontaudit xserver_t xdm_var_lib_t:dir search; > > allow xserver_t xdm_var_run_t:file read_file_perms; > +allow xserver_t xdm_var_run_t:dir search_dir_perms; > > # Label pid and temporary files with derived types. > manage_files_pattern(xserver_t, xdm_tmp_t, xdm_tmp_t) I'd prefer to change that added line and the line above it to read_files_pattern. -- Chris PeBenito Tresys Technology, LLC www.tresys.com | oss.tresys.com