Attachment 898974 Details for Bug 1100976 – [PATCH] contrib: Add KMSCon policy module

[patch] [PATCH] contrib: Add KMSCon policy module

0001-contrib-Add-KMSCon-policy-module.patch (text/plain), 3.04 KB, created by Lubomir Rintel on 2014-05-24 19:09:43 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Lubomir Rintel

Created: 2014-05-24 19:09:43 UTC

Size: 3.04 KB

patch

obsolete

>From 64df138b2b6f5ddb655b530be5f9a61703adcac7 Mon Sep 17 00:00:00 2001
>From: Lubomir Rintel <lkundrak@v3.sk>
>Date: Sat, 24 May 2014 21:06:04 +0200
>Subject: [PATCH] contrib: Add KMSCon policy module
>
>---
> kmscon.fc |  3 +++
> kmscon.if |  1 +
> kmscon.te | 78 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
> 3 files changed, 82 insertions(+)
> create mode 100644 kmscon.fc
> create mode 100644 kmscon.if
> create mode 100644 kmscon.te
>
>diff --git a/kmscon.fc b/kmscon.fc
>new file mode 100644
>index 0000000..4646b87
>--- /dev/null
>+++ b/kmscon.fc
>@@ -0,0 +1,3 @@
>+/usr/bin/kmscon					--	gen_context(system_u:object_r:kmscon_exec_t,s0)
>+/usr/lib/systemd/system/kmscon.*\.service	--	gen_context(system_u:object_r:kmscon_unit_file_t,s0)
>+/etc/kmscon(/.*)?					gen_context(system_u:object_r:kmscon_conf_t,s0)
>diff --git a/kmscon.if b/kmscon.if
>new file mode 100644
>index 0000000..240ca6c
>--- /dev/null
>+++ b/kmscon.if
>@@ -0,0 +1 @@
>+## <summary>Terminal emulator for Linux graphical console</summary>
>diff --git a/kmscon.te b/kmscon.te
>new file mode 100644
>index 0000000..112d09e
>--- /dev/null
>+++ b/kmscon.te
>@@ -0,0 +1,78 @@
>+# KMSCon SELinux policy module
>+# Contributed by Lubomir Rintel <lkundrak@v3.sk>
>+
>+policy_module(kmscon, 1.0)
>+
>+type kmscon_t;
>+type kmscon_exec_t;
>+init_daemon_domain(kmscon_t, kmscon_exec_t)
>+
>+type kmscon_conf_t;
>+files_config_file(kmscon_conf_t)
>+
>+type kmscon_unit_file_t;
>+systemd_unit_file(kmscon_unit_file_t)
>+
>+type kmscon_devpts_t;
>+term_pty(kmscon_devpts_t)
>+# Label this as t, so that login_t can read our terminal with use_all_ttys()
>+term_tty(kmscon_devpts_t)
>+
>+allow kmscon_t kmscon_devpts_t:chr_file { rw_chr_file_perms setattr_chr_file_perms };
>+term_create_pty(kmscon_t, kmscon_devpts_t)
>+
>+list_dirs_pattern(kmscon_t, kmscon_conf_t, kmscon_conf_t)
>+read_files_pattern(kmscon_t, kmscon_conf_t, kmscon_conf_t)
>+
>+locallogin_domtrans(kmscon_t)
>+auth_read_passwd(kmscon_t)
>+
>+miscfiles_read_fonts(kmscon_t)
>+miscfiles_manage_fonts_cache(kmscon_t)
>+
>+dev_rw_dri(kmscon_t)
>+dev_read_sysfs(kmscon_t)
>+dev_read_framebuffer(kmscon_t)
>+dev_write_framebuffer(kmscon_t)
>+dev_rw_input_dev(kmscon_t)
>+
>+# Switch the VT into a graphics mode
>+allow kmscon_t self:capability sys_tty_config;
>+
>+# Create an udev monitor
>+allow kmscon_t self:netlink_kobject_uevent_socket { bind create setopt getattr };
>+
>+# Set DRM master
>+allow kmscon_t self:capability sys_admin;
>+
>+# But why
>+dontaudit kmscon_t self:capability2 block_suspend;
>+
>+# Open the tty, so that it can be handed over to the seat manager
>+term_use_unallocated_ttys(kmscon_t)
>+
>+# Get allowed path length for directory with modules
>+fs_getattr_xattr_fs(kmscon_t)
>+
>+optional_policy(`
>+	# Learn about the input devices
>+	udev_read_db(kmscon_t)
>+')
>+
>+optional_policy(`
>+	# Fontconfig and Pango configuration
>+	gnome_read_home_config(kmscon_t)
>+')
>+
>+optional_policy(`
>+	dbus_system_bus_client(kmscon_t)
>+	init_dbus_chat(kmscon_t)
>+
>+	optional_policy(`
>+		systemd_dbus_chat_logind(kmscon_t)
>+
>+		# List seats
>+		systemd_login_list_pid_dirs(kmscon_t)
>+		systemd_login_read_pid_files(kmscon_t)
>+	')
>+')
>-- 
>1.9.3
>

Actions: View | Diff

Attachments on bug 1100976: 898974 | 898975