2017-12-11 19:11:47

by Sugar, David

[permalink] [raw]
Subject: [refpolicy] [PATCH 0/3-v3] Re-work of patch related to files created in /run/user/%{USERID}/

This is a re-work of the patches previously submitted based on feedback from Dominick and Chris. Changes in userdomain to create an attribute (user_runtime_content_type) for files in /run/user/%{USERID}/. Then changes in systemd_logind to use interfaces to delete various types with this attribute.

I think this is basically what Dominick was suggesting, but please comment if I have gotten something wrong or misinterpreted the suggestion. Also updated based on Chris's feedback to correctly name interfaces using the new attribute.

Dave Sugar (3):
Make an attribute for objects in /run/user/%{USERID}/*
Make xdm files created in /run/user/%{USERID} xdm_run_t (user_runtime_content_type)
Allow systemd_logind to delete user_runtime_content_type files

policy/modules/services/xserver.te | 9 +++
policy/modules/system/systemd.te | 6 +-
policy/modules/system/userdomain.if | 156 +++++++++++++++++++++++++++++++++++-
policy/modules/system/userdomain.te | 4 +
4 files changed, 173 insertions(+), 2 deletions(-)

--
2.13.6