1 |
commit: fa460d674228cdbe2e16cd33b5b5d83c85e72008 |
2 |
Author: Guido Trentalancia via refpolicy <refpolicy <AT> oss <DOT> tresys <DOT> com> |
3 |
AuthorDate: Mon Sep 19 11:15:44 2016 +0000 |
4 |
Commit: Jason Zaman <perfinion <AT> gentoo <DOT> org> |
5 |
CommitDate: Mon Oct 3 06:13:33 2016 +0000 |
6 |
URL: https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=fa460d67 |
7 |
|
8 |
gnome: add support for the OIL Runtime Compiler (ORC) optimized code execution |
9 |
|
10 |
Add a new gstreamer_orcexec_t type and file context to the gnome |
11 |
module in order to support the OIL Runtime Compiler (ORC) optimized |
12 |
code execution (used for example by pulseaudio). |
13 |
|
14 |
Add optional policy to the pulseaudio module to support the ORC |
15 |
optimized code execution. |
16 |
|
17 |
This patch has been anticipated a few weeks ago as part of a |
18 |
larger gnome patch. It has now been split as a smaller patch, |
19 |
as required. |
20 |
|
21 |
Signed-off-by: Guido Trentalancia <guido <AT> trentalancia.net> |
22 |
|
23 |
policy/modules/contrib/gnome.fc | 4 ++ |
24 |
policy/modules/contrib/gnome.if | 98 ++++++++++++++++++++++++++++++++++++ |
25 |
policy/modules/contrib/gnome.te | 3 ++ |
26 |
policy/modules/contrib/pulseaudio.te | 6 +++ |
27 |
4 files changed, 111 insertions(+) |
28 |
|
29 |
diff --git a/policy/modules/contrib/gnome.fc b/policy/modules/contrib/gnome.fc |
30 |
index 31d8c6c..ce12193 100644 |
31 |
--- a/policy/modules/contrib/gnome.fc |
32 |
+++ b/policy/modules/contrib/gnome.fc |
33 |
@@ -7,6 +7,8 @@ HOME_DIR/\.gnome2(/.*)? gen_context(system_u:object_r:gnome_home_t,s0) |
34 |
HOME_DIR/\.gnome2/keyrings(/.*)? gen_context(system_u:object_r:gnome_keyring_home_t,s0) |
35 |
HOME_DIR/\.gnome2_private(/.*)? gen_context(system_u:object_r:gnome_home_t,s0) |
36 |
|
37 |
+HOME_DIR/orcexec\..* gen_context(system_u:object_r:gstreamer_orcexec_t,s0) |
38 |
+ |
39 |
/etc/gconf(/.*)? gen_context(system_u:object_r:gconf_etc_t,s0) |
40 |
|
41 |
/tmp/gconfd-USER/.* -- gen_context(system_u:object_r:gconf_tmp_t,s0) |
42 |
@@ -16,6 +18,8 @@ HOME_DIR/\.gnome2_private(/.*)? gen_context(system_u:object_r:gnome_home_t,s0) |
43 |
/usr/lib/[^/]*/gconf/gconfd-2 -- gen_context(system_u:object_r:gconfd_exec_t,s0) |
44 |
/usr/libexec/gconfd-2 -- gen_context(system_u:object_r:gconfd_exec_t,s0) |
45 |
|
46 |
+/var/run/user/[^/]*/orcexec\..* -- gen_context(system_u:object_r:gstreamer_orcexec_t,s0) |
47 |
+/var/run/user/%{USERID}/orcexec\..* -- gen_context(system_u:object_r:gstreamer_orcexec_t,s0) |
48 |
|
49 |
ifdef(`distro_gentoo',` |
50 |
HOME_DIR/\.config/dconf(/.*)? gen_context(system_u:object_r:gnome_xdg_config_home_t,s0) |
51 |
|
52 |
diff --git a/policy/modules/contrib/gnome.if b/policy/modules/contrib/gnome.if |
53 |
index cad0e95..190fa16 100644 |
54 |
--- a/policy/modules/contrib/gnome.if |
55 |
+++ b/policy/modules/contrib/gnome.if |
56 |
@@ -610,6 +610,66 @@ interface(`gnome_gconf_home_filetrans',` |
57 |
|
58 |
######################################## |
59 |
## <summary> |
60 |
+## Create objects in user home |
61 |
+## directories with the gstreamer |
62 |
+## orcexec type. |
63 |
+## </summary> |
64 |
+## <param name="domain"> |
65 |
+## <summary> |
66 |
+## Domain allowed access. |
67 |
+## </summary> |
68 |
+## </param> |
69 |
+## <param name="object_class"> |
70 |
+## <summary> |
71 |
+## Class of the object being created. |
72 |
+## </summary> |
73 |
+## </param> |
74 |
+## <param name="name" optional="true"> |
75 |
+## <summary> |
76 |
+## The name of the object being created. |
77 |
+## </summary> |
78 |
+## </param> |
79 |
+# |
80 |
+interface(`gnome_user_home_dir_filetrans_gstreamer_orcexec',` |
81 |
+ gen_require(` |
82 |
+ type gstreamer_orcexec_t; |
83 |
+ ') |
84 |
+ |
85 |
+ userdom_user_home_dir_filetrans($1, gstreamer_orcexec_t, $2, $3) |
86 |
+') |
87 |
+ |
88 |
+######################################## |
89 |
+## <summary> |
90 |
+## Create objects in the user |
91 |
+## runtime directories with the |
92 |
+## gstreamer orcexec type. |
93 |
+## </summary> |
94 |
+## <param name="domain"> |
95 |
+## <summary> |
96 |
+## Domain allowed access. |
97 |
+## </summary> |
98 |
+## </param> |
99 |
+## <param name="object_class"> |
100 |
+## <summary> |
101 |
+## Class of the object being created. |
102 |
+## </summary> |
103 |
+## </param> |
104 |
+## <param name="name" optional="true"> |
105 |
+## <summary> |
106 |
+## The name of the object being created. |
107 |
+## </summary> |
108 |
+## </param> |
109 |
+# |
110 |
+interface(`gnome_user_runtime_filetrans_gstreamer_orcexec',` |
111 |
+ gen_require(` |
112 |
+ type gstreamer_orcexec_t; |
113 |
+ ') |
114 |
+ |
115 |
+ userdom_user_runtime_filetrans($1, gstreamer_orcexec_t, $2, $3) |
116 |
+') |
117 |
+ |
118 |
+######################################## |
119 |
+## <summary> |
120 |
## Read generic gnome keyring home files. |
121 |
## </summary> |
122 |
## <param name="domain"> |
123 |
@@ -764,3 +824,41 @@ interface(`gnome_dbus_chat_gconfd',` |
124 |
allow $1 gconfd_t:dbus send_msg; |
125 |
allow gconfd_t $1:dbus send_msg; |
126 |
') |
127 |
+ |
128 |
+######################################## |
129 |
+## <summary> |
130 |
+## Manage gstreamer ORC optimized |
131 |
+## code. |
132 |
+## </summary> |
133 |
+## <param name="domain"> |
134 |
+## <summary> |
135 |
+## Domain allowed access. |
136 |
+## </summary> |
137 |
+## </param> |
138 |
+# |
139 |
+interface(`gnome_manage_gstreamer_orcexec',` |
140 |
+ gen_require(` |
141 |
+ type gstreamer_orcexec_t; |
142 |
+ ') |
143 |
+ |
144 |
+ allow $1 gstreamer_orcexec_t:file manage_file_perms; |
145 |
+') |
146 |
+ |
147 |
+######################################## |
148 |
+## <summary> |
149 |
+## Mmap gstreamer ORC optimized |
150 |
+## code. |
151 |
+## </summary> |
152 |
+## <param name="domain"> |
153 |
+## <summary> |
154 |
+## Domain allowed access. |
155 |
+## </summary> |
156 |
+## </param> |
157 |
+# |
158 |
+interface(`gnome_mmap_gstreamer_orcexec',` |
159 |
+ gen_require(` |
160 |
+ type gstreamer_orcexec_t; |
161 |
+ ') |
162 |
+ |
163 |
+ allow $1 gstreamer_orcexec_t:file mmap_file_perms; |
164 |
+') |
165 |
|
166 |
diff --git a/policy/modules/contrib/gnome.te b/policy/modules/contrib/gnome.te |
167 |
index dd6ac04..8c79849 100644 |
168 |
--- a/policy/modules/contrib/gnome.te |
169 |
+++ b/policy/modules/contrib/gnome.te |
170 |
@@ -46,6 +46,9 @@ userdom_user_home_content(gnome_keyring_home_t) |
171 |
type gnome_keyring_tmp_t; |
172 |
userdom_user_tmp_file(gnome_keyring_tmp_t) |
173 |
|
174 |
+type gstreamer_orcexec_t; |
175 |
+application_executable_file(gstreamer_orcexec_t) |
176 |
+ |
177 |
############################## |
178 |
# |
179 |
# Common local Policy |
180 |
|
181 |
diff --git a/policy/modules/contrib/pulseaudio.te b/policy/modules/contrib/pulseaudio.te |
182 |
index 214e9c6..7f30a72 100644 |
183 |
--- a/policy/modules/contrib/pulseaudio.te |
184 |
+++ b/policy/modules/contrib/pulseaudio.te |
185 |
@@ -193,6 +193,12 @@ optional_policy(` |
186 |
|
187 |
optional_policy(` |
188 |
gnome_stream_connect_gconf(pulseaudio_t) |
189 |
+ |
190 |
+ # OIL Runtime Compiler (ORC) optimized code execution |
191 |
+ gnome_manage_gstreamer_orcexec(pulseaudio_t) |
192 |
+ gnome_mmap_gstreamer_orcexec(pulseaudio_t) |
193 |
+ gnome_user_runtime_filetrans_gstreamer_orcexec(pulseaudio_t, file) |
194 |
+ gnome_user_home_dir_filetrans_gstreamer_orcexec(pulseaudio_t, file) |
195 |
') |
196 |
|
197 |
optional_policy(` |