Attachment 898975 Details for Bug 1100976 – [PATCH] contrib: Add KMSCon policy module

[patch] [PATCH] contrib: Add KMSCon policy module

0001-contrib-Add-KMSCon-policy-module.patch (text/plain), 3.59 KB, created by Lubomir Rintel on 2014-05-24 19:49:37 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Lubomir Rintel

Created: 2014-05-24 19:49:37 UTC

Size: 3.59 KB

patch

obsolete

>From b28d46e4d1daeb3ffbf9094a9739af0b477942e7 Mon Sep 17 00:00:00 2001
>From: Lubomir Rintel <lkundrak@v3.sk>
>Date: Sat, 24 May 2014 21:06:04 +0200
>Subject: [PATCH] contrib: Add KMSCon policy module
>
>---
> kmscon.fc |  3 +++
> kmscon.if | 24 +++++++++++++++++++
> kmscon.te | 80 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
> 3 files changed, 107 insertions(+)
> create mode 100644 kmscon.fc
> create mode 100644 kmscon.if
> create mode 100644 kmscon.te
>
>diff --git a/kmscon.fc b/kmscon.fc
>new file mode 100644
>index 0000000..4646b87
>--- /dev/null
>+++ b/kmscon.fc
>@@ -0,0 +1,3 @@
>+/usr/bin/kmscon					--	gen_context(system_u:object_r:kmscon_exec_t,s0)
>+/usr/lib/systemd/system/kmscon.*\.service	--	gen_context(system_u:object_r:kmscon_unit_file_t,s0)
>+/etc/kmscon(/.*)?					gen_context(system_u:object_r:kmscon_conf_t,s0)
>diff --git a/kmscon.if b/kmscon.if
>new file mode 100644
>index 0000000..acdf0eb
>--- /dev/null
>+++ b/kmscon.if
>@@ -0,0 +1,24 @@
>+## <summary>Terminal emulator for Linux graphical console</summary>
>+
>+########################################
>+## <summary>
>+##	Execute kmscon in the kmscon domain.
>+## </summary>
>+## <param name="domain">
>+##	<summary>
>+##	Domain allowed to transition.
>+##	</summary>
>+## </param>
>+#
>+interface(`kmscon_systemctl',`
>+	gen_require(`
>+		type kmscon_unit_file_t;
>+		type kmscon_t;
>+	')
>+
>+	systemd_exec_systemctl($1)
>+	allow $1 kmscon_unit_file_t:file read_file_perms;
>+	allow $1 kmscon_unit_file_t:service manage_service_perms;
>+
>+	ps_process_pattern($1, kmscon_t)
>+')
>diff --git a/kmscon.te b/kmscon.te
>new file mode 100644
>index 0000000..e7aa7b9
>--- /dev/null
>+++ b/kmscon.te
>@@ -0,0 +1,80 @@
>+# KMSCon SELinux policy module
>+# Contributed by Lubomir Rintel <lkundrak@v3.sk>
>+
>+policy_module(kmscon, 1.0)
>+
>+type kmscon_t;
>+type kmscon_exec_t;
>+init_daemon_domain(kmscon_t, kmscon_exec_t)
>+
>+type kmscon_conf_t;
>+files_config_file(kmscon_conf_t)
>+
>+type kmscon_unit_file_t;
>+systemd_unit_file(kmscon_unit_file_t)
>+
>+type kmscon_devpts_t;
>+term_pty(kmscon_devpts_t)
>+# Label this as t, so that login_t can read our terminal with use_all_ttys()
>+term_tty(kmscon_devpts_t)
>+
>+allow kmscon_t kmscon_devpts_t:chr_file { rw_chr_file_perms setattr_chr_file_perms };
>+term_create_pty(kmscon_t, kmscon_devpts_t)
>+
>+list_dirs_pattern(kmscon_t, kmscon_conf_t, kmscon_conf_t)
>+read_files_pattern(kmscon_t, kmscon_conf_t, kmscon_conf_t)
>+
>+locallogin_domtrans(kmscon_t)
>+auth_read_passwd(kmscon_t)
>+
>+miscfiles_read_fonts(kmscon_t)
>+miscfiles_manage_fonts_cache(kmscon_t)
>+
>+dev_rw_dri(kmscon_t)
>+dev_read_sysfs(kmscon_t)
>+dev_read_framebuffer(kmscon_t)
>+dev_write_framebuffer(kmscon_t)
>+dev_rw_input_dev(kmscon_t)
>+
>+# Switch the VT into a graphics mode
>+allow kmscon_t self:capability sys_tty_config;
>+
>+# Create an udev monitor
>+allow kmscon_t self:netlink_kobject_uevent_socket { bind create setopt getattr };
>+
>+# Set DRM master
>+allow kmscon_t self:capability sys_admin;
>+
>+# But why
>+dontaudit kmscon_t self:capability2 block_suspend;
>+
>+# Open the tty, so that it can be handed over to the seat manager
>+term_use_unallocated_ttys(kmscon_t)
>+
>+# Get allowed path length for directory with modules
>+fs_getattr_xattr_fs(kmscon_t)
>+
>+optional_policy(`
>+	# Learn about the input devices
>+	udev_read_db(kmscon_t)
>+')
>+
>+optional_policy(`
>+	# Fontconfig and Pango configuration
>+	gnome_read_home_config(kmscon_t)
>+')
>+
>+optional_policy(`
>+	dbus_system_bus_client(kmscon_t)
>+	init_dbus_chat(kmscon_t)
>+
>+	optional_policy(`
>+		systemd_dbus_chat_logind(kmscon_t)
>+
>+		# List seats
>+		systemd_login_list_pid_dirs(kmscon_t)
>+		systemd_login_read_pid_files(kmscon_t)
>+
>+		kmscon_systemctl(systemd_logind_t)
>+	')
>+')
>-- 
>1.9.3
>

Actions: View | Diff

Attachments on bug 1100976: 898974 | 898975