Changeset 2651

Timestamp:

03/26/08 14:44:25 (8 months ago)

Author:

pebenito

Message:

xselinux: merge x_rootcolormap_t and x_rootwindow_t into a per-role type, and merge x_rootscreen_t into the per-role xserver type.

Files:

• branches/xselinux/policy/modules/services/xserver.if (modified) (11 diffs)
• branches/xselinux/policy/modules/services/xserver.te (modified) (3 diffs)

branches/xselinux/policy/modules/services/xserver.if

@@ -18 +18 @@
-
-                attribute x_server_domain;
-                type x_rootwindow_t, x_rootcolormap_t, x_rootscreen_t;
-                class x_drawable all_x_drawable_perms;
-                class x_colormap all_x_colormap_perms;
@@ -31 +30 @@
-        attribute $1_x_domain;
-        attribute $1_input_xevent_type;
+
+        type $1_rootwindow_t, rootwindow_type;
-
-        type $1_xserver_t, x_server_domain;
@@ -93 +94 @@
-        logging_log_filetrans($1_xserver_t,xserver_log_t,file)
-
-
-
-
-
+
+
-
-        kernel_read_system_state($1_xserver_t)
@@ -197 +196 @@
-                        attribute xproperty_type, xselection_type;
-                        attribute xextension_type, xevent_type;
-
-
-x_rootwindow_t, 
+
+
+
-                ')
-                allow $1_xserver_t x_server_domain:x_server *;
-x_rootwindow_t
-rootscreen_t
+rootwindow_type
+server_domain
-                allow $1_xserver_t x_domain:x_gc *;
-x_rootcolormap_t
+rootwindow_type
-                allow $1_xserver_t xproperty_type:x_property *;
-                allow $1_xserver_t xselection_type:x_selection *;
@@ -472 +471 @@
-
-        allow $1_xserver_t { input_xevent_t $1_input_xevent_type }:x_event send;
-x
+$1
-
-        # manage: xhost X11:ChangeHosts
@@ -485 +484 @@
-        allow $2 $1_xserver_t:x_resource write;
-
-x_rootcolormap
+$1_rootwindow
-
-        # read: gnome-settings-daemon RANDR:GetScreenSizeRange
@@ -491 +490 @@
-        # setattr: gnome-settings-daemon X11:GrabKey
-        # manage: metacity X11:ChangeWindowAttributes
-x
+$1
-
-        # setattr: metacity X11:InstallColormap
-x_rootscreen
+$1_xserver
-
-        # xrdb X11:ChangeProperty prop=RESOURCE_MANAGER
@@ -677 +676 @@
-template(`xserver_common_x_domain_template',`
-        gen_require(`
-x_rootwindow_t, x_rootcolormap
+$1_rootwindow
-                type xproperty_t, info_xproperty_t, clipboard_xproperty_t;
-                type input_xevent_t, focus_xevent_t, property_xevent_t, manage_xevent_t;
@@ -766 +765 @@
-        allow $3 info_xproperty_t:x_property read;
-        # can change properties of root window
-x
+$1
-        # can change properties of own windows
-        allow $3 self:x_drawable { list_property get_property set_property };
@@ -772 +771 @@
-        # X Windows
-        # operations allowed on root windows
-x
+$1
-        # operations allowed on my windows
-        allow $3 self:x_drawable { create destroy getattr setattr read write show hide list_child add_child remove_child manage send receive };
-x
+$1
-
-        # X Colormaps
-        # can use the default colormap
-x_rootcolormap
+$1_rootwindow
-
-        # X Input
@@ -829 +828 @@
-                        attribute xproperty_type, xselection_type;
-                        attribute xextension_type, xevent_type;
-
-
-x_rootwindow_t, 
+
+
+
-                ')
-                allow $3 x_server_domain:x_server *;
-x_rootwindow_t
-rootscreen_t
+rootwindow_type
+server_domain
-                allow $3 x_domain:x_gc *;
-x_rootcolormap_t
+rootwindow_type
-                allow $3 xproperty_type:x_property *;
-                allow $3 xselection_type:x_selection *;

branches/xselinux/policy/modules/services/xserver.te

@@ -39 +39 @@
-
-# Per-object attributes
+attribute rootwindow_type;
-attribute x_domain;
-attribute xproperty_type;
@@ -68 +69 @@
-type video_xext_t, xextension_type;
-type unknown_xevent_t, xevent_type;
-type x_rootcolormap_t;
-type x_rootscreen_t;
-type x_rootwindow_t;
-type xevent_t alias default_xevent_t, xevent_type;
-type xext_t alias unknown_xext_t, xextension_type;
@@ -496 +494 @@
-
-allow xserver_unconfined_type x_server_domain:x_server *;
-x_rootwindow_t
-rootscreen_t
+rootwindow_type
+server_domain
-allow xserver_unconfined_type x_domain:x_gc *;
-x_rootcolormap_t
+rootwindow_type
-allow xserver_unconfined_type xproperty_type:x_property *;
-allow xserver_unconfined_type xselection_type:x_selection *;