[gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/contrib/

[Sven Vermeulen]

commit:     b49bdbc0c5cba13cc94db4d7fe28dab4ab589a34
Author:     Dominick Grift <dominick.grift <AT> gmail <DOT> com>
AuthorDate: Wed Oct 31 11:31:39 2012 +0000
Commit:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
CommitDate: Wed Oct 31 18:06:49 2012 +0000
URL:        http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=b49bdbc0

Changes to the wm policy module

Ported from Fedora with changes

Implement wm_domain attribute to write policy that applies to all
wm_domains efficiently

Left out some rules related to pulseaudio (will be re-added later in a
different shape)

Allows wm to create user home dirs and file for config data content

This because we do not have private types for user config and data
content yet

Also allows wm to create user tmp sockets, this is broken since this is
for gconfd and that dir in tmp is problably labeled gconf_tmp_t

Should probably take a good look at gconf tmp file context spec for
sockets, implement a gnome_gconfd_tmp_filetrans and use that instead

Signed-off-by: Dominick Grift <dominick.grift <AT> gmail.com>

---
 policy/modules/contrib/wm.if |   79 ++++++++++++++++++++++++++----------------
 policy/modules/contrib/wm.te |   35 +++++++++++++++++-
 2 files changed, 82 insertions(+), 32 deletions(-)

diff --git a/policy/modules/contrib/wm.if b/policy/modules/contrib/wm.if
index a115e8c..8791e25 100644
--- a/policy/modules/contrib/wm.if
+++ b/policy/modules/contrib/wm.if
@@ -1,4 +1,4 @@
-## <summary>X Window Managers</summary>
+## <summary>X Window Managers.</summary>
 
 #######################################
 ## <summary>
@@ -29,41 +29,37 @@
 #
 template(`wm_role_template',`
 	gen_require(`
+		attribute wm_domain;
 		type wm_exec_t;
-		class dbus send_msg;
 	')
 
-	type $1_wm_t;
-	domain_type($1_wm_t)
-	domain_entry_file($1_wm_t, wm_exec_t)
+	########################################
+	#
+	# Declarations
+	#
+
+	type $1_wm_t, wm_domain;
+	userdom_user_application_domain($1_wm_t, wm_exec_t)
 	role $2 types $1_wm_t;
 
-	allow $1_wm_t self:fifo_file rw_fifo_file_perms;
-	allow $1_wm_t self:process getsched;
-	allow $1_wm_t self:shm create_shm_perms;
+	########################################
+	#
+	# Policy
+	#
 
 	allow $1_wm_t $3:unix_stream_socket connectto;
 	allow $3 $1_wm_t:unix_stream_socket connectto;
-	allow $3 $1_wm_t:process { signal sigchld signull };
-	allow $1_wm_t $3:process { signull sigkill };
 
-	allow $1_wm_t $3:dbus send_msg;
-	allow $3 $1_wm_t:dbus send_msg;
+	allow $3 $1_wm_t:process { ptrace signal_perms };
+	ps_process_pattern($3, $1_wm_t)
 
-	domtrans_pattern($3, wm_exec_t, $1_wm_t)
+	allow $1_wm_t $3:process { signull sigkill };
 
-	kernel_read_system_state($1_wm_t)
+	domtrans_pattern($3, wm_exec_t, $1_wm_t)
 
 	corecmd_bin_domtrans($1_wm_t, $3)
 	corecmd_shell_domtrans($1_wm_t, $3)
 
-	dev_read_urand($1_wm_t)
-
-	files_read_etc_files($1_wm_t)
-	files_read_usr_files($1_wm_t)
-
-	fs_getattr_tmpfs($1_wm_t)
-
 	mls_file_read_all_levels($1_wm_t)
 	mls_file_write_all_levels($1_wm_t)
 	mls_xwin_read_all_levels($1_wm_t)
@@ -72,18 +68,13 @@ template(`wm_role_template',`
 
 	auth_use_nsswitch($1_wm_t)
 
-	application_signull($1_wm_t)
-
-	miscfiles_read_fonts($1_wm_t)
-	miscfiles_read_localization($1_wm_t)
-
 	optional_policy(`
 		dbus_system_bus_client($1_wm_t)
 		dbus_spec_session_bus_client($1, $1_wm_t)
-	')
 
-	optional_policy(`
-		pulseaudio_stream_connect($1_wm_t)
+		optional_policy(`
+			wm_dbus_chat($1, $3)
+		')
 	')
 
 	optional_policy(`
@@ -94,7 +85,7 @@ template(`wm_role_template',`
 
 ########################################
 ## <summary>
-##	Execute the wm program in the wm domain.
+##	Execute wm in the caller domain.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -107,5 +98,33 @@ interface(`wm_exec',`
 		type wm_exec_t;
 	')
 
+	corecmd_search_bin($1)
 	can_exec($1, wm_exec_t)
 ')
+
+########################################
+## <summary>
+##	Send and receive messages from
+##	specified wm over dbus.
+## </summary>
+## <param name="role_prefix">
+##	<summary>
+##	The prefix of the user domain (e.g., user
+##	is the prefix for user_t).
+##	</summary>
+## </param>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`wm_dbus_chat',`
+	gen_require(`
+		type $1_wm_t;
+		class dbus send_msg;
+	')
+
+	allow $2 $1_wm_t:dbus send_msg;
+	allow $1_wm_t $2:dbus send_msg;
+')

diff --git a/policy/modules/contrib/wm.te b/policy/modules/contrib/wm.te
index 10ed15f..fdc97cc 100644
--- a/policy/modules/contrib/wm.te
+++ b/policy/modules/contrib/wm.te
@@ -1,9 +1,40 @@
-policy_module(wm, 1.2.2)
+policy_module(wm, 1.2.3)
 
 ########################################
 #
 # Declarations
 #
 
+attribute wm_domain;
+
 type wm_exec_t;
-corecmd_executable_file(wm_exec_t)
+application_executable_file(wm_exec_t)
+
+########################################
+#
+# Common wm domain local policy
+#
+
+allow wm_domain self:fifo_file rw_fifo_file_perms;
+allow wm_domain self:process getsched;
+allow wm_domain self:shm create_shm_perms;
+
+kernel_read_system_state(wm_domain)
+
+dev_read_urand(wm_domain)
+
+files_read_usr_files(wm_domain)
+
+miscfiles_read_fonts(wm_domain)
+miscfiles_read_localization(wm_domain)
+
+userdom_manage_user_tmp_sockets(wm_domain)
+userdom_tmp_filetrans_user_tmp(wm_domain, sock_file)
+
+userdom_manage_user_home_content_dirs(wm_domain)
+userdom_manage_user_home_content_files(wm_domain)
+userdom_user_home_dir_filetrans_user_home_content(wm_domain, { dir file })
+
+optional_policy(`
+	pulseaudio_stream_connect(wm_domain)
+')