rendered paste bodyIndex: policy/modules/kernel/devices.fc
===================================================================
--- policy/modules/kernel/devices.fc (revision 2539)
+++ policy/modules/kernel/devices.fc (working copy)
@@ -28,12 +28,12 @@
/dev/i915 -c gen_context(system_u:object_r:dri_device_t,s0)
/dev/irlpt[0-9]+ -c gen_context(system_u:object_r:printer_device_t,s0)
/dev/js.* -c gen_context(system_u:object_r:mouse_device_t,s0)
-/dev/kmem -c gen_context(system_u:object_r:memory_device_t,mls_systemhigh)
+/dev/kmem -c gen_context(system_u:object_r:memory_device_t,s0)
/dev/kmsg -c gen_context(system_u:object_r:kmsg_device_t,mls_systemhigh)
/dev/logibm -c gen_context(system_u:object_r:mouse_device_t,s0)
/dev/lp.* -c gen_context(system_u:object_r:printer_device_t,s0)
/dev/mcelog -c gen_context(system_u:object_r:kmsg_device_t,mls_systemhigh)
-/dev/mem -c gen_context(system_u:object_r:memory_device_t,mls_systemhigh)
+/dev/mem -c gen_context(system_u:object_r:memory_device_t,s0)
/dev/mice -c gen_context(system_u:object_r:mouse_device_t,s0)
/dev/microcode -c gen_context(system_u:object_r:cpu_device_t,s0)
/dev/midi.* -c gen_context(system_u:object_r:sound_device_t,s0)
Index: policy/modules/services/xwindows.te
===================================================================
--- policy/modules/services/xwindows.te (revision 2539)
+++ policy/modules/services/xwindows.te (working copy)
@@ -11,7 +11,7 @@
## Support X userspace object manager
## </p>
## </desc>
-gen_tunable(xwindows_object_manager,false)
+gen_tunable(xwindows_object_manager,true)
# Domains
attribute x_unconfined;
Index: policy/modules/services/xwindows.fc
===================================================================
--- policy/modules/services/xwindows.fc (revision 2539)
+++ policy/modules/services/xwindows.fc (working copy)
@@ -13,3 +13,6 @@
/usr/libexec/gnome-settings-daemon -- gen_context(system_u:object_r:xpriv_exec_t,s0)
/usr/local/bin/Xorg -- gen_context(system_u:object_r:xserver_exec_t,s0)
+
+/usr/local/X/bin/Xorg -- gen_context(system_u:object_r:xserver_exec_t,s0)
+/usr/local/X/var/log -- gen_context(system_u:object_r:var_log_t,s0-mls_systemhigh)
Index: policy/modules/services/xwindows.if
===================================================================
--- policy/modules/services/xwindows.if (revision 2539)
+++ policy/modules/services/xwindows.if (working copy)
@@ -96,16 +96,16 @@
typeattribute $3 xclient_type;
# Type for windows
- tunable_policy(`xwindows_object_manager',`
+# tunable_policy(`xwindows_object_manager',`
type_transition $3 x_rootwindow_t:x_drawable $3;
- ')
+# ')
# Types for properties
type $2_default_xproperty_t, $1_default_xproperty_type, xproperty_type;
role $4 types $2_default_xproperty_t;
- tunable_policy(`xwindows_object_manager',`
+# tunable_policy(`xwindows_object_manager',`
type_transition $3 default_xproperty_t:x_property $2_default_xproperty_t;
- ')
+# ')
# Types for events
attribute $2_xevent_type;
@@ -119,13 +119,13 @@
role $4 types $2_manage_xevent_t;
type $2_default_xevent_t, $2_xevent_type, xevent_type;
role $4 types $2_default_xevent_t;
- tunable_policy(`xwindows_object_manager',`
+# tunable_policy(`xwindows_object_manager',`
type_transition $3 input_xevent_t:x_event $2_input_xevent_t;
type_transition $3 focus_xevent_t:x_event $2_focus_xevent_t;
type_transition $3 property_xevent_t:x_event $2_property_xevent_t;
type_transition $3 manage_xevent_t:x_event $2_manage_xevent_t;
type_transition $3 default_xevent_t:x_event $2_default_xevent_t;
- ')
+# ')
type $2_client_xevent_t, $2_xevent_type, xevent_type;
role $4 types $2_client_xevent_t;
@@ -134,7 +134,7 @@
# Local Policy
#
- tunable_policy(`xwindows_object_manager',`
+# tunable_policy(`xwindows_object_manager',`
# Hacks
# everyone can get the input focus of everyone else
# this is a fundamental brokenness in the X protocol
@@ -225,7 +225,7 @@
allow $3 self:x_colormap *;
# can read and write own objects
allow $3 self:x_resource { read write };
- ')
+# ')
')
@@ -258,7 +258,7 @@
typeattribute $1 xdevice_type;
typeattribute $1 xresource_type;
- tunable_policy(`xwindows_object_manager',`
+# tunable_policy(`xwindows_object_manager',`
# Labeling rules for default windows, screens, and colormaps
type_transition $1 $1:x_drawable x_rootwindow_t;
type_transition $1 $1:x_colormap x_rootcolormap_t;
@@ -268,7 +268,7 @@
selinux_validate_context($1)
selinux_compute_access_vector($1)
selinux_compute_create_context($1)
- ')
+# ')
xwindows_unconfined($1)
')
@@ -350,6 +350,7 @@
template(`xwindows_per_role_template',`
gen_require(`
type $1_dbusd_t;
+ type $1_xserver_t;
')
##############################
@@ -377,7 +378,7 @@
xwindows_domain_template($1,$1_xpriv,$1_xpriv_t,$3)
xwindows_unconfined($1_xpriv_t)
- tunable_policy(`xwindows_object_manager',`
+# tunable_policy(`xwindows_object_manager',`
domain_auto_trans($2,xpriv_exec_t,$1_xpriv_t)
domain_auto_trans($1_dbusd_t,xpriv_exec_t,$1_xpriv_t)
@@ -387,5 +388,26 @@
allow $2 input_xevent_t:x_event send;
allow $2 x_rootwindow_t:x_drawable send;
- ')
+# ')
+
+
+ # mlsdemo
+ allow $1_dbusd_t self:x_client manage;
+ allow $1_dbusd_t self:x_drawable { write read create getattr };
+ allow $1_dbusd_t self:x_gc { destroy create use setattr };
+
+ allow $1_dbusd_t $1_xserver_t:x_colormap use;
+ allow $1_dbusd_t $1_xserver_t:x_drawable { get_property setattr show receive create manage send add_child write read getattr list_child override set_property };
+ allow $1_dbusd_t $1_xserver_t:x_screen { saver_setattr saver_getattr };
+
+ allow $2 $1_dbusd_t:x_client destroy;
+ allow $2 $1_dbusd_t:x_drawable getattr;
+ allow $2 $1_xserver_t:x_colormap use;
+ allow $2 $1_xserver_t:x_drawable { get_property show read manage add_child remove_child list_child hide setattr receive create send write getattr override destroy set_property };
+
+ allow $1_xserver_t self:x_drawable send;
+
+ xwindows_unconfined($1_dbusd_t)
+ xwindows_unconfined($2)
+
')
Index: policy/modules/system/logging.fc
===================================================================
--- policy/modules/system/logging.fc (revision 2539)
+++ policy/modules/system/logging.fc (working copy)
@@ -26,6 +26,7 @@
/var/dnscache/log/main(/.*)? gen_context(system_u:object_r:var_log_t,s0)
/var/log -d gen_context(system_u:object_r:var_log_t,s0-mls_systemhigh)
+/usr/local/X/var/log -d gen_context(system_u:object_r:var_log_t,s0-mls_systemhigh)
/var/log/.* gen_context(system_u:object_r:var_log_t,s0)
/var/log/audit(/.*)? gen_context(system_u:object_r:auditd_log_t,mls_systemhigh)
Index: build.conf
===================================================================
--- build.conf (revision 2539)
+++ build.conf (working copy)
@@ -12,13 +12,13 @@
# Policy Type
# standard, mls, mcs
-TYPE = standard
+TYPE = mls
# Policy Name
# If set, this will be used as the policy
# name. Otherwise the policy type will be
# used for the name.
-NAME = refpolicy
+NAME = xselinux-trunk
# Distribution
# Some distributions have portions of policy
@@ -27,7 +27,7 @@
# for the distribution.
# redhat, gentoo, debian, suse, and rhel4 are current options.
# Fedora users should enable redhat.
-#DISTRO = redhat
+DISTRO = redhat
# Unknown Permissions Handling
# The behavior for handling permissions defined in the
@@ -46,7 +46,7 @@
# Build monolithic policy. Putting n here
# will build a loadable module policy.
-MONOLITHIC=y
+MONOLITHIC=n
# Number of MLS Sensitivities
# The sensitivities will be s0 to s(MLS_SENS-1).