From: guido@trentalancia.net (Guido Trentalancia) Date: Fri, 02 Dec 2016 12:24:31 +0100 Subject: [refpolicy] [PATCH v5 1/2] Apache OpenOffice module (base policy part) In-Reply-To: <129294c5-fc05-bd28-74b0-87e9bc3c2ef8@ieee.org> References: <1480113700.5692.4.camel@trentalancia.net> <848bd66a-ead2-97e3-b952-265ab5d8c903@ieee.org> <1480506047.4743.15.camel@trentalancia.net> <129294c5-fc05-bd28-74b0-87e9bc3c2ef8@ieee.org> Message-ID: <1480677871.3915.6.camel@trentalancia.net> To: refpolicy@oss.tresys.com List-Id: refpolicy.oss.tresys.com This is a minimal patch that I am testing to support Apache OpenOffice with its own module (base policy part, 1/2). The file contexts (and initial tests) are based on the default installation path for version 4 of the office suite. Since the second version it includes revisions from Dominick Grift. Since the third version it should correctly manage files in home directories and allow some other major functionality. The fourth version of the patch introduces a boolean to enable or disable software updates from the network (application and/or extensions). This fifth version of the patch adds the ability to connect to the X display manager (XDM) using Unix domain sockets (interface xserver_stream_connect_xdm()). Also the fifth version splits the whole patch into separate base policy / contrib policy patches as required. Signed-off-by: Guido Trentalancia --- policy/modules/roles/staff.te | 4 ++++ policy/modules/roles/sysadm.te | 4 ++++ policy/modules/roles/unprivuser.te | 4 ++++ policy/modules/services/xserver.if | 19 +++++++++++++++++++ policy/modules/system/libraries.fc | 2 ++ 5 files changed, 33 insertions(+) diff -pruN refpolicy-git-25112016-orig/policy/modules/roles/staff.te refpolicy-git-25112016/policy/modules/roles/staff.te --- refpolicy-git-25112016-orig/policy/modules/roles/staff.te 2016-10-29 16:29:13.453156183 +0200 +++ refpolicy-git-25112016/policy/modules/roles/staff.te 2016-11-26 15:03:47.656293970 +0100 @@ -141,6 +141,10 @@ ifndef(`distro_redhat',` ') optional_policy(` + ooffice_role(staff_r, staff_t) + ') + + optional_policy(` pyzor_role(staff_r, staff_t) ') diff -pruN refpolicy-git-25112016-orig/policy/modules/roles/sysadm.te refpolicy-git-25112016/policy/modules/roles/sysadm.te --- refpolicy-git-25112016-orig/policy/modules/roles/sysadm.te 2016-10-29 16:29:13.454156211 +0200 +++ refpolicy-git-25112016/policy/modules/roles/sysadm.te 2016-11-26 15:03:47.657293980 +0100 @@ -721,6 +721,10 @@ optional_policy(` ') optional_policy(` + ooffice_role(sysadm_r, sysadm_t) +') + +optional_policy(` openct_admin(sysadm_t, sysadm_r) ') diff -pruN refpolicy-git-25112016-orig/policy/modules/roles/unprivuser.te refpolicy-git-25112016/policy/modules/roles/unprivuser.te --- refpolicy-git-25112016-orig/policy/modules/roles/unprivuser.te 2016-10-29 16:29:13.454156211 +0200 +++ refpolicy-git-25112016/policy/modules/roles/unprivuser.te 2016-11-26 15:03:47.658293990 +0100 @@ -114,6 +114,10 @@ ifndef(`distro_redhat',` ') optional_policy(` + ooffice_role(user_r, user_t) + ') + + optional_policy(` postgresql_role(user_r, user_t) ') diff -pruN refpolicy-git-25112016-orig/policy/modules/services/xserver.if refpolicy-git-25112016/policy/modules/services/xserver.if --- refpolicy-git-25112016-orig/policy/modules/services/xserver.if 2016-08-14 22:10:42.752848860 +0200 +++ refpolicy-git-25112016/policy/modules/services/xserver.if 2016-11-26 15:03:47.658293990 +0100 @@ -602,6 +602,25 @@ interface(`xserver_read_user_xauth',` ######################################## ## +## Read all users .ICEauthority. +## +## +## +## Domain allowed access. +## +## +# +interface(`xserver_read_user_iceauth',` + gen_require(` + type iceauth_home_t; + ') + + allow $1 iceauth_home_t:file read_file_perms; + userdom_search_user_home_dirs($1) +') + +######################################## +## ## Set the attributes of the X windows console named pipes. ## ## diff -pruN refpolicy-git-25112016-orig/policy/modules/system/libraries.fc refpolicy-git-25112016/policy/modules/system/libraries.fc --- refpolicy-git-25112016-orig/policy/modules/system/libraries.fc 2016-08-14 21:24:48.961382244 +0200 +++ refpolicy-git-25112016/policy/modules/system/libraries.fc 2016-11-26 15:03:47.659294001 +0100 @@ -52,6 +52,8 @@ ifdef(`distro_redhat',` /opt/(.*/)?jre.*/.+\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0) /opt/(.*/)?jre/.+\.jar -- gen_context(system_u:object_r:lib_t,s0) +/opt/openoffice4/program/.+\.so(\.[^/]*)* -- gen_context(system_u:object_r:lib_t,s0) + /opt/(.*/)?/RealPlayer/.+\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0) # despite the extensions, they are actually libs /opt/Acrobat[5-9]/Reader/intellinux/plugins/.*\.api -- gen_context(system_u:object_r:lib_t,s0)