rendered paste bodyIndex: policy/modules/kernel/corenetwork.te.in
===================================================================
--- policy/modules/kernel/corenetwork.te.in (revision 2473)
+++ policy/modules/kernel/corenetwork.te.in (working copy)
@@ -168,6 +168,7 @@
network_port(xserver, tcp, 6000, s0, tcp,6001,s0, tcp,6002,s0, tcp,6003,s0, tcp,6004,s0, tcp,6005,s0, tcp,6006,s0, tcp,6007,s0, tcp,6008,s0, tcp,6009,s0, tcp,6010,s0, tcp,6011,s0, tcp,6012,s0, tcp,6013,s0, tcp,6014,s0, tcp,6015,s0, tcp,6016,s0, tcp,6017,s0, tcp,6018,s0, tcp,6019,s0)
network_port(zebra, tcp,2600,s0, tcp,2601,s0, tcp,2602,s0, tcp,2603,s0, tcp,2604,s0, tcp,2606,s0, udp,2600,s0, udp,2601,s0, udp,2602,s0, udp,2603,s0, udp,2604,s0, udp,2606,s0)
network_port(zope, tcp,8021,s0)
+network_port(xchat, tcp,4990,s0);
# Defaults for reserved ports. Earlier portcon entries take precedence;
# these entries just cover any remaining reserved ports not otherwise declared.
Index: policy/modules/apps/xchat.fc
===================================================================
--- policy/modules/apps/xchat.fc (revision 0)
+++ policy/modules/apps/xchat.fc (revision 0)
@@ -0,0 +1,3 @@
+/usr/bin/xchat -- gen_context(system_u:object_r:xchat_exec_t,s0)
+
+HOME_DIR/\.xchat2(/.*)? gen_context(system_u:object_r:ROLE_xchat_home_t,s0)
Index: policy/modules/apps/xchat.te
===================================================================
--- policy/modules/apps/xchat.te (revision 0)
+++ policy/modules/apps/xchat.te (revision 0)
@@ -0,0 +1,8 @@
+policy_module(xchat,1.0.0)
+
+########################################
+#
+# Declarations
+#
+type xchat_exec_t;
+application_executable_file(xchat_exec_t)
Index: policy/modules/apps/xchat.if
===================================================================
--- policy/modules/apps/xchat.if (revision 0)
+++ policy/modules/apps/xchat.if (revision 0)
@@ -0,0 +1,441 @@
+## <summary>SELinux policy module</summary>
+## <desc>
+## <p>
+## SELinux policy module for XChat
+## XChat scripting engines not supported
+## </p>
+## </desc>
+
+#######################################
+## <summary>
+## The per role template for the XChat module.
+## </summary>
+## <desc>
+## <p>
+## This template creates derived domains which are used
+## for XChat.
+## </p>
+## <p>
+## This template is invoked automatically for each user, and
+## generally does not need to be invoked directly
+## by policy writers.
+## </p>
+## </desc>
+## <param name="userdomain_prefix">
+## <summary>
+## The prefix of the user domain (e.g., user
+## is the prefix for user_t).
+## </summary>
+## </param>
+## <param name="user_domain">
+## <summary>
+## The type of the user domain.
+## </summary>
+## </param>
+## <param name="user_role">
+## <summary>
+## The role associated with the user domain.
+## </summary>
+## </param>
+#
+template(`xchat_per_role_template',`
+ gen_require(`
+ type xchat_exec_t;
+ ')
+
+ ########################################
+ #
+ # Declarations
+ #
+ type $1_xchat_t;
+ application_domain($1_xchat_t,xchat_exec_t)
+ role $3 types $1_xchat_t;
+
+ type $1_xchat_home_t alias $1_xchat_rw_t;
+ files_poly_member($1_xchat_home_t)
+ userdom_user_home_content($1,$1_xchat_home_t)
+
+ type $1_xchat_tmpfs_t;
+ files_tmpfs_file($1_xchat_tmpfs_t)
+
+ ########################################
+ #
+ # Local Policy
+ #
+ allow $1_xchat_t self:process { signal getsched setsched sigkill };
+ allow $1_xchat_t self:fifo_file rw_fifo_file_perms;
+ allow $1_xchat_t self:sem create_sem_perms;
+ allow $1_xchat_t self:netlink_route_socket r_netlink_socket_perms;
+ allow $1_xchat_t self:tcp_socket { create_socket_perms accept listen };
+ allow $1_xchat_t self:udp_socket create_socket_perms;
+
+ allow $1_xchat_t $2:fd use;
+ allow $1_xchat_t $2:process sigchld;
+
+ # XChat(GConfd-2) wants to stream connect to /tmp/orbit-*
+ allow $1_xchat_t $2:unix_stream_socket connectto;
+ allow $2 $1_xchat_t:unix_stream_socket connectto;
+
+ allow $2 $1_xchat_t:fd use;
+ allow $2 $1_xchat_t:shm { associate getattr unix_read unix_write };
+ allow $2 $1_xchat_t:process ptrace;
+
+ manage_dirs_pattern($1_xchat_t,$1_xchat_home_t,$1_xchat_home_t)
+ manage_files_pattern($1_xchat_t,$1_xchat_home_t,$1_xchat_home_t)
+ manage_sock_files_pattern($1_xchat_t,$1_xchat_home_t,$1_xchat_home_t)
+
+ userdom_user_home_dir_filetrans($1,$1_xchat_t,$1_xchat_home_t,{ dir sock_file file })
+ userdom_search_user_home_dirs($1,$1_xchat_t)
+
+ userdom_list_user_home_content_dirs($1,$1_xchat_t)
+
+ userdom_dbus_sendrecv_all_users($1_xchat_t)
+
+ userdom_read_user_home_content_files($1,$1_xchat_t)
+ userdom_read_user_home_content_symlinks($1,$1_xchat_t)
+ userdom_read_user_tmp_files($1,$1_xchat_t)
+ userdom_manage_user_tmp_dirs($1,$1_xchat_t)
+ userdom_manage_user_tmp_files($1,$1_xchat_t)
+ userdom_manage_user_tmp_sockets($1,$1_xchat_t)
+ userdom_tmp_filetrans_user_tmp($1,$1_xchat_t, { file dir sock_file })
+
+ # XChat wants getattr to Beagle sock_file in home
+ dontaudit $1_xchat_t $1_home_t:sock_file getattr;
+
+ userdom_unlink_unpriv_users_home_content_files($1_xchat_t)
+ userdom_dontaudit_write_user_home_content_files($1,$1_xchat_t)
+
+ manage_dirs_pattern($2,$1_xchat_home_t,$1_xchat_home_t)
+ manage_files_pattern($2,$1_xchat_home_t,$1_xchat_home_t)
+ manage_sock_files_pattern($2,$1_xchat_home_t,$1_xchat_home_t)
+
+ relabel_dirs_pattern($2,$1_xchat_home_t,$1_xchat_home_t)
+ relabel_files_pattern($2,$1_xchat_home_t,$1_xchat_home_t)
+ relabel_sock_files_pattern($2,$1_xchat_home_t,$1_xchat_home_t)
+
+ manage_files_pattern($1_xchat_t,$1_xchat_tmpfs_t,$1_xchat_tmpfs_t)
+ manage_lnk_files_pattern($1_xchat_t,$1_xchat_tmpfs_t,$1_xchat_tmpfs_t)
+ manage_fifo_files_pattern($1_xchat_t,$1_xchat_tmpfs_t,$1_xchat_tmpfs_t)
+ manage_sock_files_pattern($1_xchat_t,$1_xchat_tmpfs_t,$1_xchat_tmpfs_t)
+ fs_tmpfs_filetrans($1_xchat_t,$1_xchat_tmpfs_t,{ file lnk_file sock_file fifo_file })
+ fs_rw_tmpfs_files($1_xchat_t)
+
+ corenet_tcp_bind_xchat_port($1_xchat_t)
+
+ corenet_all_recvfrom_netlabel($1_xchat_t)
+ corenet_tcp_sendrecv_all_ports($1_xchat_t)
+ corenet_tcp_connect_all_ports($1_xchat_t)
+ corenet_tcp_connect_generic_port($1_xchat_t)
+ corenet_all_recvfrom_unlabeled($1_xchat_t)
+ corenet_tcp_sendrecv_all_if($1_xchat_t)
+ corenet_tcp_sendrecv_all_nodes($1_xchat_t)
+ corenet_tcp_bind_all_nodes($1_xchat_t)
+ corenet_raw_sendrecv_generic_if($1_xchat_t)
+ corenet_raw_sendrecv_all_nodes($1_xchat_t)
+ corenet_sendrecv_generic_client_packets($1_xchat_t)
+
+ corenet_dontaudit_tcp_sendrecv_generic_port($1_xchat_t)
+ corenet_dontaudit_tcp_bind_generic_port($1_xchat_t)
+
+ kernel_read_system_state($1_xchat_t)
+ sysnet_read_config($1_xchat_t)
+
+ files_read_etc_files($1_xchat_t)
+ files_read_etc_symlinks($1_xchat_t)
+ files_read_etc_runtime_files($1_xchat_t)
+
+ files_read_usr_files($1_xchat_t)
+ files_read_usr_symlinks($1_xchat_t)
+
+ kernel_dontaudit_list_unlabeled($1_xchat_t)
+ kernel_dontaudit_getattr_unlabeled_files($1_xchat_t)
+ kernel_dontaudit_read_unlabeled_files($1_xchat_t)
+
+ files_dontaudit_list_non_security($1_xchat_t)
+ files_dontaudit_getattr_non_security_files($1_xchat_t)
+ fs_dontaudit_getattr_all_fs($1_xchat_t)
+
+ dev_getattr_sysfs_dirs($1_xchat_t)
+ fs_search_auto_mountpoints($1_xchat_t)
+ fs_list_inotifyfs($1_xchat_t)
+
+ term_dontaudit_getattr_pty_dirs($1_xchat_t)
+
+ selinux_dontaudit_getattr_fs($1_xchat_t)
+
+ dev_dontaudit_getattr_all_blk_files($1_xchat_t)
+ dev_dontaudit_getattr_all_chr_files($1_xchat_t)
+
+ domain_auto_trans($2, xchat_exec_t, $1_xchat_t)
+ allow $2 $1_xchat_t:process { noatsecure siginh rlimitinh };
+
+ ps_process_pattern($2,$1_xchat_t)
+ allow $2 $1_xchat_t:process signal_perms;
+
+ libs_exec_lib_files($1_xchat_t)
+ libs_use_ld_so($1_xchat_t)
+
+ miscfiles_read_localization($1_xchat_t)
+
+ logging_send_syslog_msg($1_xchat_t)
+
+ corecmd_exec_bin($1_xchat_t)
+ corecmd_dontaudit_exec_all_executables($1_xchat_t)
+ corecmd_bin_entry_type($1_xchat_t)
+ corecmd_read_bin_symlinks($1_xchat_t)
+ corecmd_shell_entry_type($1_xchat_t)
+
+ dev_read_urand($1_xchat_t)
+ dev_read_rand($1_xchat_t)
+
+ dev_read_sound($1_xchat_t)
+ dev_write_sound($1_xchat_t)
+
+ alsa_read_rw_config($1_xchat_t)
+
+ userdom_use_user_terminals($1,$1_xchat_t)
+
+ xserver_user_client_template($1,$1_xchat_t,$1_xchat_tmpfs_t)
+
+ xserver_dontaudit_read_xdm_tmp_files($1_xchat_t)
+ xserver_dontaudit_getattr_xdm_tmp_sockets($1_xchat_t)
+
+ ifdef(`enable_mls',`',`
+ fs_search_removable($1_xchat_t)
+ fs_read_removable_files($1_xchat_t)
+ fs_read_removable_symlinks($1_xchat_t)
+ ')
+
+ tunable_policy(`write_untrusted_content',`
+ userdom_manage_user_home_content_dirs($1,$1_xchat_t)
+ userdom_manage_user_home_content_files($1,$1_xchat_t)
+ userdom_manage_user_home_content_sockets($1,$1_xchat_t)
+ userdom_read_user_home_content_symlinks($1,$1_xchat_t)
+ ')
+
+ tunable_policy(`use_nfs_home_dirs',`
+ fs_manage_nfs_dirs($1_xchat_t)
+ fs_manage_nfs_files($1_xchat_t)
+ fs_manage_nfs_symlinks($1_xchat_t)
+ ')
+
+ tunable_policy(`use_samba_home_dirs',`
+ fs_manage_cifs_dirs($1_xchat_t)
+ fs_manage_cifs_files($1_xchat_t)
+ fs_manage_cifs_symlinks($1_xchat_t)
+ ')
+
+ optional_policy(`
+ dbus_user_bus_client_template($1,$1_xchat,$1_xchat_t)
+ dbus_manage_user_bus($1,$1_xchat_t)
+ dbus_system_bus_client_template($1_xchat,$1_xchat_t)
+ dbus_send_system_bus($1_xchat_t)
+ ')
+
+ optional_policy(`
+ gnome_manage_user_gnome_config($1,$1_xchat_t)
+ gnome_domtrans_user_gconf($1,$1_xchat_t)
+ gnome_stream_connect_gconf_template($1,$1_xchat_t)
+ ')
+
+ optional_policy(`
+ mozilla_read_user_home_files($1,$1_xchat_t)
+ mozilla_domtrans_user_mozilla($1,$1_xchat_t)
+ mozilla_dbus_chat($1,$1_xchat_t)
+ ')
+')
+
+########################################
+## <summary>
+## Read XChat per user homedir
+## </summary>
+## <desc>
+## <p>
+## Read XChat per user homedir
+## </p>
+## <p>
+## This is a templated interface, and should only
+## be called from a per-userdomain template.
+## </p>
+## </desc>
+## <param name="userdomain_prefix">
+## <summary>
+## The prefix of the user domain (e.g., user
+## is the prefix for user_t).
+## </summary>
+## </param>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+template(`xchat_read_user_home_files',`
+ gen_require(`
+ type $1_xchat_home_t;
+ ')
+
+ allow $2 $1_xchat_home_t:dir list_dir_perms;
+ allow $2 $1_xchat_home_t:file read_file_perms;
+')
+
+########################################
+## <summary>
+## Write XChat per user homedir
+## </summary>
+## <desc>
+## <p>
+## Write XChat per user homedir
+## </p>
+## <p>
+## This is a templated interface, and should only
+## be called from a per-userdomain template.
+## </p>
+## </desc>
+## <param name="userdomain_prefix">
+## <summary>
+## The prefix of the user domain (e.g., user
+## is the prefix for user_t).
+## </summary>
+## </param>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+template(`xchat_write_user_home_files',`
+ gen_require(`
+ type $1_xchat_home_t;
+ ')
+
+ allow $2 $1_xchat_home_t:dir list_dir_perms;
+ allow $2 $1_xchat_home_t:file write;
+')
+
+########################################
+## <summary>
+## Run XChat in user XChat domain.
+## </summary>
+## <desc>
+## <p>
+## Run XChat in user XChat domain.
+## </p>
+## <p>
+## This is a templated interface, and should only
+## be called from a per-userdomain template.
+## </p>
+## </desc>
+## <param name="userdomain_prefix">
+## <summary>
+## The prefix of the user domain (e.g., user
+## is the prefix for user_t).
+## </summary>
+## </param>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+template(`xchat_domtrans_user_xchat',`
+ gen_require(`
+ type $1_xchat_t, xchat_exec_t;
+ ')
+
+ domtrans_pattern($2, xchat_exec_t,$1_xchat_t)
+')
+
+########################################
+## <summary>
+## Read/write XChat per user tcp_socket
+## </summary>
+## <desc>
+## <p>
+## Read/write XChat per user tcp_socket
+## </p>
+## <p>
+## This is a templated interface, and should only
+## be called from a per-userdomain template.
+## </p>
+## </desc>
+## <param name="userdomain_prefix">
+## <summary>
+## The prefix of the user domain (e.g., user
+## is the prefix for user_t).
+## </summary>
+## </param>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+template(`xchat_rw_user_tcp_sockets',`
+ gen_require(`
+ type $1_xchat_t;
+ ')
+
+ allow $2 $1_xchat_t:tcp_socket rw_socket_perms;
+')
+
+########################################
+## <summary>
+## XChat connection template.
+## </summary>
+## <param name="userdomain_prefix">
+## <summary>
+## The prefix of the user domain (e.g., user
+## is the prefix for user_t).
+## </summary>
+## </param>
+## <param name="user_domain">
+## <summary>
+## The type of the user domain.
+## </summary>
+## </param>
+#
+template(`xchat_stream_connect_template',`
+ gen_require(`
+ type $1_xchat_t;
+ ')
+
+ allow $2 $1_xchat_t:unix_stream_socket connectto;
+')
+
+########################################
+## <summary>
+## Send and receive messages from
+## XChat over dbus.
+## </summary>
+## <desc>
+## <p>
+## Send and receive messages from
+## XChat over dbus.
+## </p>
+## <p>
+## This is a templated interface, and should only
+## be called from a per-userdomain template.
+## </p>
+## </desc>
+## <param name="userdomain_prefix">
+## <summary>
+## The prefix of the user domain (e.g., user
+## is the prefix for user_t).
+## </summary>
+## </param>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+template(`xchat_dbus_chat',`
+ gen_require(`
+ type $1_xchat_t;
+ class dbus send_msg;
+ ')
+
+ allow $2 $1_xchat_t:dbus send_msg;
+ allow $1_xchat_t $2:dbus send_msg;
+')
Index: policy/modules/services/dbus.if
===================================================================
--- policy/modules/services/dbus.if (revision 2473)
+++ policy/modules/services/dbus.if (working copy)
@@ -369,3 +369,29 @@
allow $1 system_dbusd_t:dbus *;
')
+
+########################################
+## <summary>
+## Send a message and acquire service
+## on user/application specific DBUS.
+## </summary>
+## <param name="user_prefix">
+## <summary>
+## The prefix of the domain (e.g., user
+## is the prefix for user_t).
+## </summary>
+## </param>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+template(`dbus_manage_user_bus',`
+ gen_require(`
+ type $1_dbusd_t;
+ class dbus all_dbus_perms;
+ ')
+
+ allow $2 $1_dbusd_t:dbus *;
+')
Index: policy/modules/system/userdomain.if
===================================================================
--- policy/modules/system/userdomain.if (revision 2473)
+++ policy/modules/system/userdomain.if (working copy)
@@ -5559,3 +5559,82 @@
interface(`userdom_unconfined',`
refpolicywarn(`$0($*) has been deprecated.')
')
+
+########################################
+## <summary>
+## List directories
+## in a user home subdirectory.
+## </summary>
+## <desc>
+## <p>
+## List directories
+## in a user home subdirectory.
+## </p>
+## <p>
+## This is a templated interface, and should only
+## be called from a per-userdomain template.
+## </p>
+## </desc>
+## <param name="userdomain_prefix">
+## <summary>
+## The prefix of the user domain (e.g., user
+## is the prefix for user_t).
+## </summary>
+## </param>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+template(`userdom_list_user_home_content_dirs',`
+ gen_require(`
+ type $1_home_dir_t, $1_home_t;
+ attribute user_home_type;
+ ')
+
+ files_search_home($2)
+ list_dirs_pattern($2,{ $1_home_dir_t user_home_type },$1_home_t)
+')
+
+########################################
+## <summary>
+## Send and receive a dbus message to
+## and from all user domains.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`userdom_dbus_sendrecv_all_users',`
+ gen_require(`
+ attribute userdomain;
+ class dbus send_msg;
+ ')
+
+ allow $1 userdomain:dbus send_msg;
+ allow userdomain $1:dbus send_msg;
+')
+
+########################################
+## <summary>
+## Unlink all unprivileged users home directory
+## files.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`userdom_unlink_unpriv_users_home_content_files',`
+ gen_require(`
+ attribute user_home_dir_type, user_home_type;
+ ')
+
+ files_search_home($1)
+ allow $1 user_home_dir_type:dir list_dir_perms;
+ allow $1 user_home_type:file unlink;
+')