Changeset 2706

Timestamp:

05/30/08 10:05:17 (6 months ago)

Author:

pebenito

Message:

rbacsep: first steps in collapsing xserver.

Files:

• branches/rbacsep/policy/modules/services/xserver.te (modified) (6 diffs)

branches/rbacsep/policy/modules/services/xserver.te

@@ -54 +54 @@
-type focus_xevent_t, xevent_type;
-
+type iceauth_t;
-type iceauth_exec_t;
-
+
+
+
+
+
-
-type info_xproperty_t, xproperty_type;
@@ -69 +74 @@
-type video_xext_t, xextension_type;
-type unknown_xevent_t, xevent_type;
+
+type user_fonts_t;
+userdom_user_home_content($1,user_fonts_t)
+
+type user_fonts_cache_t, fonts_cache_type;
+userdom_user_home_content($1,user_fonts_cache_t)
+
+type user_fonts_config_t, fonts_config_type;
+userdom_user_home_content($1,user_fonts_cache_t)
+
-type xevent_t alias default_xevent_t, xevent_type;
-type xext_t alias unknown_xext_t, xextension_type;
@@ -74 +89 @@
-type xselection_t alias default_xselection_t, xselection_type;
-
+type xauth_t;
-type xauth_exec_t;
-
+
+
+
+
+
+
+
+
-
-# this is not actually a device, its a pipe
@@ -113 +136 @@
-
-# Type for the executable used to start the X server, e.g. Xwrapper.
+type xserver_t, x_server_domain;
-type xserver_exec_t;
-
+
+
+
+
+
+
+
+
-
-type xsession_exec_t;
@@ -134 +165 @@
-optional_policy(`
-        prelink_object_file(xkb_var_lib_t)
+')
+
+########################################
+#
+# Iceauth local policy
+#
+
+domtrans_pattern($2, iceauth_exec_t, iceauth_t)
+
+allow iceauth_t iceauth_home_t:file manage_file_perms;
+userdom_user_home_dir_filetrans($1,iceauth_t,iceauth_home_t,file)
+
+# allow ps to show iceauth
+ps_process_pattern($2, iceauth_t)
+
+allow $2 iceauth_home_t:file manage_file_perms;
+allow $2 iceauth_home_t:file { relabelfrom relabelto };
+
+allow xdm_t iceauth_home_t:file read_file_perms;
+
+fs_search_auto_mountpoints(iceauth_t)
+
+libs_use_ld_so(iceauth_t)
+libs_use_shared_libs(iceauth_t)
+
+userdom_use_user_terminals($1, iceauth_t)
+
+tunable_policy(`use_nfs_home_dirs',`
+        fs_manage_nfs_files(iceauth_t)
+')
+
+tunable_policy(`use_samba_home_dirs',`
+        fs_manage_cifs_files(iceauth_t)
+')
+
+########################################
+#
+# Xauth local policy
+#
+
+allow xauth_t self:process signal;
+allow xauth_t self:unix_stream_socket create_stream_socket_perms;
+
+allow xauth_t xauth_home_t:file manage_file_perms;
+userdom_user_home_dir_filetrans($1,xauth_t,xauth_home_t,file)
+
+manage_dirs_pattern(xauth_t, xauth_tmp_t, xauth_tmp_t)
+manage_files_pattern(xauth_t, xauth_tmp_t, xauth_tmp_t)
+files_tmp_filetrans(xauth_t, xauth_tmp_t, { file dir })
+
+domtrans_pattern($2, xauth_exec_t, xauth_t)
+
+allow $2 xauth_t:process signal;
+
+# allow ps to show xauth
+ps_process_pattern($2,xauth_t)
+
+allow $2 xauth_home_t:file manage_file_perms;
+allow $2 xauth_home_t:file { relabelfrom relabelto };
+
+allow xdm_t xauth_home_t:file manage_file_perms;
+userdom_user_home_dir_filetrans($1,xdm_t,xauth_home_t,file)
+
+domain_use_interactive_fds(xauth_t)
+
+files_read_etc_files(xauth_t)
+files_search_pids(xauth_t)
+
+fs_getattr_xattr_fs(xauth_t)
+fs_search_auto_mountpoints(xauth_t)
+
+# cjp: why?
+term_use_ptmx(xauth_t)
+
+auth_use_nsswitch(xauth_t)
+
+libs_use_ld_so(xauth_t)
+libs_use_shared_libs(xauth_t)
+
+userdom_use_user_terminals($1,xauth_t)
+userdom_read_user_tmp_files($1,xauth_t)
+
+xserver_rw_xdm_tmp_files(xauth_t)
+
+tunable_policy(`use_nfs_home_dirs',`
+        fs_manage_nfs_files(xauth_t)
+')
+
+tunable_policy(`use_samba_home_dirs',`
+        fs_manage_cifs_files(xauth_t)
+')
+
+optional_policy(`
+        ssh_sigchld(xauth_t)
+        ssh_read_pipes(xauth_t)
+        ssh_dontaudit_rw_tcp_sockets(xauth_t)
-')
-
@@ -489 +616 @@
-')
-
+        attribute $1_x_domain;
+        attribute $1_input_xevent_type;
+
+        type $1_rootwindow_t, rootwindow_type;
+
+########################################
+#
+# X server local policy
+#
+
+# setuid/setgid for the wrapper program to change UID
+# sys_rawio is for iopl access - should not be needed for frame-buffer
+# sys_admin, locking shared mem?  chowning IPC message queues or semaphores?
+# admin of APM bios?
+# sys_nice is so that the X server can set a negative nice value
+# execheap needed until the X module loader is fixed.
+# NVIDIA Needs execstack
+
+allow xserver_t self:capability { dac_override fowner fsetid setgid setuid ipc_owner sys_rawio sys_admin sys_nice sys_tty_config mknod net_bind_service };
+dontaudit xserver_t self:capability chown;
+allow xserver_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap };
+allow xserver_t self:memprotect mmap_zero;
+allow xserver_t self:fd use;
+allow xserver_t self:fifo_file rw_fifo_file_perms;
+allow xserver_t self:sock_file read_sock_file_perms;
+allow xserver_t self:shm create_shm_perms;
+allow xserver_t self:sem create_sem_perms;
+allow xserver_t self:msgq create_msgq_perms;
+allow xserver_t self:msg { send receive };
+allow xserver_t self:unix_dgram_socket { create_socket_perms sendto };
+allow xserver_t self:unix_stream_socket { create_stream_socket_perms connectto };
+allow xserver_t self:tcp_socket create_stream_socket_perms;
+allow xserver_t self:udp_socket create_socket_perms;
+
+manage_dirs_pattern(xserver_t, xserver_tmp_t, xserver_tmp_t)
+manage_files_pattern(xserver_t, xserver_tmp_t, xserver_tmp_t)
+manage_sock_files_pattern(xserver_t, xserver_tmp_t, xserver_tmp_t)
+files_tmp_filetrans(xserver_t, xserver_tmp_t, { file dir sock_file })
+
+filetrans_pattern(xserver_t, xdm_xserver_tmp_t, xserver_tmp_t,sock_file)
+
+manage_dirs_pattern(xserver_t, xserver_tmpfs_t, xserver_tmpfs_t)
+manage_files_pattern(xserver_t, xserver_tmpfs_t, xserver_tmpfs_t)
+manage_lnk_files_pattern(xserver_t, xserver_tmpfs_t, xserver_tmpfs_t)
+manage_fifo_files_pattern(xserver_t, xserver_tmpfs_t, xserver_tmpfs_t)
+manage_sock_files_pattern(xserver_t, xserver_tmpfs_t, xserver_tmpfs_t)
+fs_tmpfs_filetrans(xserver_t, xserver_tmpfs_t, { dir file lnk_file sock_file fifo_file })
+
+manage_files_pattern(xserver_t, xkb_var_lib_t, xkb_var_lib_t)
+manage_lnk_files_pattern(xserver_t, xkb_var_lib_t, xkb_var_lib_t)
+files_search_var_lib(xserver_t)
+
+# Create files in /var/log with the xserver_log_t type.
+manage_files_pattern(xserver_t, xserver_log_t, xserver_log_t)
+logging_log_filetrans(xserver_t, xserver_log_t,file)
+
+        # Labeling rules for default windows and colormaps
+        type_transition xserver_t xserver_t:{ x_drawable x_colormap } $1_rootwindow_t;
+
+kernel_read_system_state(xserver_t)
+kernel_read_device_sysctls(xserver_t)
+kernel_read_modprobe_sysctls(xserver_t)
+# Xorg wants to check if kernel is tainted
+kernel_read_kernel_sysctls(xserver_t)
+kernel_write_proc_files(xserver_t)
+
+# Run helper programs in xserver_t.
+corecmd_exec_bin(xserver_t)
+corecmd_exec_shell(xserver_t)
+
+corenet_all_recvfrom_unlabeled(xserver_t)
+corenet_all_recvfrom_netlabel(xserver_t)
+corenet_tcp_sendrecv_generic_if(xserver_t)
+corenet_udp_sendrecv_generic_if(xserver_t)
+corenet_tcp_sendrecv_all_nodes(xserver_t)
+corenet_udp_sendrecv_all_nodes(xserver_t)
+corenet_tcp_sendrecv_all_ports(xserver_t)
+corenet_udp_sendrecv_all_ports(xserver_t)
+corenet_tcp_bind_all_nodes(xserver_t)
+corenet_tcp_bind_xserver_port(xserver_t)
+corenet_tcp_connect_all_ports(xserver_t)
+corenet_sendrecv_xserver_server_packets(xserver_t)
+corenet_sendrecv_all_client_packets(xserver_t)
+
+dev_rw_sysfs(xserver_t)
+dev_rw_mouse(xserver_t)
+dev_rw_mtrr(xserver_t)
+dev_rw_apm_bios(xserver_t)
+dev_rw_agp(xserver_t)
+dev_rw_framebuffer(xserver_t)
+dev_manage_dri_dev(xserver_t)
+dev_create_generic_dirs(xserver_t)
+dev_setattr_generic_dirs(xserver_t)
+# raw memory access is needed if not using the frame buffer
+dev_read_raw_memory(xserver_t)
+dev_wx_raw_memory(xserver_t)
+# for other device nodes such as the NVidia binary-only driver
+dev_rw_xserver_misc(xserver_t)
+# read events - the synaptics touchpad driver reads raw events
+dev_rw_input_dev(xserver_t)
+dev_rwx_zero(xserver_t)
+
+domain_mmap_low(xserver_t)
+
+files_read_etc_files(xserver_t)
+files_read_etc_runtime_files(xserver_t)
+files_read_usr_files(xserver_t)
+
+# brought on by rhgb
+files_search_mnt(xserver_t)
+# for nscd
+files_dontaudit_search_pids(xserver_t)
+
+fs_getattr_xattr_fs(xserver_t)
+fs_search_nfs(xserver_t)
+fs_search_auto_mountpoints(xserver_t)
+fs_search_ramfs(xserver_t)
+
+mls_xwin_read_to_clearance(xserver_t)
+
+selinux_validate_context(xserver_t)
+selinux_compute_access_vector(xserver_t)
+selinux_compute_create_context(xserver_t)
+
+auth_use_nsswitch(xserver_t)
+
+init_getpgid(xserver_t)
+
+term_setattr_unallocated_ttys(xserver_t)
+term_use_unallocated_ttys(xserver_t)
+
+getty_use_fds(xserver_t)
+
+libs_use_ld_so(xserver_t)
+libs_use_shared_libs(xserver_t)
+
+locallogin_use_fds(xserver_t)
+
+logging_send_syslog_msg(xserver_t)
+logging_send_audit_msgs(xserver_t)
+
+miscfiles_read_localization(xserver_t)
+miscfiles_read_fonts(xserver_t)
+
+modutils_domtrans_insmod(xserver_t)
+
+# read x_contexts
+seutil_read_default_contexts(xserver_t)
+
+ifndef(`distro_redhat',`
+        allow xserver_t self:process { execmem execheap execstack };
+')
+
+ifdef(`distro_rhel4',`
+        allow xserver_t self:process { execmem execheap execstack };
+')
+
+        tunable_policy(`!xserver_object_manager',`
+                # should be xserver_unconfined(xserver_t),
+                # but typeattribute doesnt work in conditionals
+                gen_require(`
+                        attribute x_server_domain, x_domain;
+                        attribute xproperty_type, xselection_type;
+                        attribute xextension_type, xevent_type;
+                        attribute rootwindow_type;
+
+                        type remote_xclient_t;
+                ')
+                allow xserver_t x_server_domain:x_server *;
+                allow xserver_t { x_domain rootwindow_type }:x_drawable *;
+                allow xserver_t x_server_domain:x_screen *;
+                allow xserver_t x_domain:x_gc *;
+                allow xserver_t { x_domain rootwindow_type }:x_colormap *;
+                allow xserver_t xproperty_type:x_property *;
+                allow xserver_t xselection_type:x_selection *;
+                allow xserver_t x_domain:x_cursor *;
+                allow xserver_t { x_domain remote_xclient_t }:x_client *;
+                allow xserver_t { x_domain x_server_domain }:x_device *;
+                allow xserver_t xextension_type:x_extension *;
+                allow xserver_t { x_domain x_server_domain }:x_resource *;
+                allow xserver_t xevent_type:{ x_event x_synthetic_event } *;
+        ')
+
+optional_policy(`
+        apm_stream_connect(xserver_t)
+')
+
+optional_policy(`
+        auth_search_pam_console_data(xserver_t)
+')
+
+optional_policy(`
+        rhgb_getpgid(xserver_t)
+        rhgb_signal(xserver_t)
+')
+
+optional_policy(`
+        xfs_stream_connect(xserver_t)
+')
+
+        ##############################
+        #
+        # $1_xserver_t Local policy
+        #
+
+        domtrans_pattern(xserver_t, xauth_exec_t, xauth_t)
+
+        allow xserver_t xauth_home_t:file { getattr read };
+
+        domtrans_pattern($2, xserver_exec_t, xserver_t)
+        allow xserver_t $2:process signal;
+
+        allow xserver_t $2:shm rw_shm_perms;
+
+        manage_dirs_pattern($2, user_fonts_t, user_fonts_t)
+        manage_files_pattern($2, user_fonts_t, user_fonts_t)
+        relabel_dirs_pattern($2, user_fonts_t, user_fonts_t)
+        relabel_files_pattern($2, user_fonts_t, user_fonts_t)
+
+        manage_dirs_pattern($2, user_fonts_config_t, user_fonts_config_t)
+        manage_files_pattern($2, user_fonts_config_t, user_fonts_config_t)
+        relabel_files_pattern($2, user_fonts_config_t, user_fonts_config_t)
+
+        # For startup relabel
+        allow $2 user_fonts_cache_t:{ dir file } { relabelto relabelfrom };
+
+        stream_connect_pattern($2, $1_xserver_tmp_t, $1_xserver_tmp_t, $1_xserver_t)
+
+        allow $2 $1_xserver_tmpfs_t:file rw_file_perms;
+
+        # Communicate via System V shared memory.
+        allow $1_xserver_t $2:shm rw_shm_perms;
+        allow $2 $1_xserver_t:shm rw_shm_perms;
+
+        userdom_search_user_home_dirs($1,$1_xserver_t)
+        userdom_use_user_ttys($1,$1_xserver_t)
+        userdom_setattr_user_ttys($1,$1_xserver_t)
+        userdom_rw_user_tmpfs_files($1,$1_xserver_t)
+
+        xserver_use_user_fonts($1,$1_xserver_t)
+
+        optional_policy(`
+                userhelper_search_config($1_xserver_t)
+        ')
+
+        ##############################
+        #
+        # User X object manager local policy
+        #
+
+        # Device rules
+        allow $1_x_domain xserver_t:x_device { read getattr use setattr setfocus grab bell };
+
+        allow $1_xserver_t { input_xevent_t $1_input_xevent_type }:x_event send;
+        allow $1_xserver_t { $1_rootwindow_t $1_x_domain }:x_drawable send;
+
+        # manage: xhost X11:ChangeHosts
+        # freeze: metacity X11:GrabKey
+        # force_cursor: metacity X11:GrabPointer
+        allow $2 xserver_t:x_device { manage freeze force_cursor };
+
+        # gnome-settings-daemon XKEYBOARD:SetControls
+        allow $2 xserver_t:x_server manage;
+
+        # gnome-settings-daemon RANDR:SelectInput
+        allow $2 xserver_t:x_resource write;
+
+        # metacity X11:InstallColormap X11:UninstallColormap
+        allow $2 $1_rootwindow_t:x_colormap { install uninstall };
+
+        # read: gnome-settings-daemon RANDR:GetScreenSizeRange
+        # write: gnome-settings-daemon RANDR:SelectInput
+        # setattr: gnome-settings-daemon X11:GrabKey
+        # manage: metacity X11:ChangeWindowAttributes
+        allow $2 $1_rootwindow_t:x_drawable { read write manage setattr };
+
+        # setattr: metacity X11:InstallColormap
+        allow $2 xserver_t:x_screen { saver_setattr saver_getattr setattr };
+
+        # xrdb X11:ChangeProperty prop=RESOURCE_MANAGER
+        allow $2 info_xproperty_t:x_property { create write append };
+
+        xserver_common_x_domain_template($1,$1,$2)
+')
+
-########################################
-#