From 31bb56f011dca51fa7fd30d6750d27cc49434eb8981a4b35053facd3ff7e8197 Mon Sep 17 00:00:00 2001 From: Johannes Segitz Date: Wed, 28 Sep 2022 07:58:24 +0000 Subject: [PATCH] Accepting request 1006413 from home:fbonazzi:branches:security:SELinux - Update fix_xserver.patch to add greetd support (bsc#1198559) OBS-URL: https://build.opensuse.org/request/show/1006413 OBS-URL: https://build.opensuse.org/package/show/security:SELinux/selinux-policy?expand=0&rev=146 --- fix_xserver.patch | 39 ++++++++++++++++++++++++++++++++------- selinux-policy.changes | 5 +++++ 2 files changed, 37 insertions(+), 7 deletions(-) diff --git a/fix_xserver.patch b/fix_xserver.patch index 686a68d..f969707 100644 --- a/fix_xserver.patch +++ b/fix_xserver.patch @@ -1,7 +1,7 @@ -Index: fedora-policy-20211111/policy/modules/services/xserver.fc +Index: fedora-policy-20220714/policy/modules/services/xserver.fc =================================================================== ---- fedora-policy-20211111.orig/policy/modules/services/xserver.fc -+++ fedora-policy-20211111/policy/modules/services/xserver.fc +--- fedora-policy-20220714.orig/policy/modules/services/xserver.fc ++++ fedora-policy-20220714/policy/modules/services/xserver.fc @@ -71,6 +71,7 @@ HOME_DIR/\.dmrc.* -- gen_context(system_ /etc/X11/[wxg]dm/Xsession -- gen_context(system_u:object_r:xsession_exec_t,s0) /etc/X11/wdm(/.*)? gen_context(system_u:object_r:xdm_rw_etc_t,s0) @@ -18,7 +18,15 @@ Index: fedora-policy-20211111/policy/modules/services/xserver.fc /usr/bin/gpe-dm -- gen_context(system_u:object_r:xdm_exec_t,s0) /usr/bin/iceauth -- gen_context(system_u:object_r:iceauth_exec_t,s0) /usr/bin/razor-lightdm-.* -- gen_context(system_u:object_r:xdm_exec_t,s0) -@@ -137,6 +139,7 @@ HOME_DIR/\.dmrc.* -- gen_context(system_ +@@ -114,6 +116,7 @@ HOME_DIR/\.dmrc.* -- gen_context(system_ + /usr/bin/Xwayland -- gen_context(system_u:object_r:xserver_exec_t,s0) + /usr/bin/x11vnc -- gen_context(system_u:object_r:xserver_exec_t,s0) + /usr/bin/nvidia.* -- gen_context(system_u:object_r:xserver_exec_t,s0) ++/usr/bin/greetd -- gen_context(system_u:object_r:xdm_exec_t,s0) + + /usr/libexec/Xorg\.bin -- gen_context(system_u:object_r:xserver_exec_t,s0) + /usr/libexec/Xorg\.wrap -- gen_context(system_u:object_r:xserver_exec_t,s0) +@@ -137,6 +140,7 @@ HOME_DIR/\.dmrc.* -- gen_context(system_ /usr/X11R6/lib/X11/xkb -d gen_context(system_u:object_r:xkb_var_lib_t,s0) /usr/X11R6/lib/X11/xkb/.* -- gen_context(system_u:object_r:xkb_var_lib_t,s0) @@ -26,10 +34,27 @@ Index: fedora-policy-20211111/policy/modules/services/xserver.fc ifndef(`distro_debian',` /usr/var/[xgkw]dm(/.*)? gen_context(system_u:object_r:xserver_log_t,s0) ') -Index: fedora-policy-20211111/policy/modules/services/xserver.te +@@ -155,6 +159,7 @@ ifndef(`distro_debian',` + /var/lib/[mxkwg]dm(/.*)? gen_context(system_u:object_r:xdm_var_lib_t,s0) + /var/lib/xkb(/.*)? gen_context(system_u:object_r:xkb_var_lib_t,s0) + /var/lib/xorg(/.*)? gen_context(system_u:object_r:xserver_var_lib_t,s0) ++/var/lib/greetd(/.*)? gen_context(system_u:object_r:xdm_var_lib_t,s0) + + /var/cache/lightdm(/.*)? gen_context(system_u:object_r:xdm_var_lib_t,s0) + /var/cache/[mg]dm(/.*)? gen_context(system_u:object_r:xdm_var_lib_t,s0) +@@ -184,6 +189,8 @@ ifndef(`distro_debian',` + /var/run/xauth(/.*)? gen_context(system_u:object_r:xdm_var_run_t,s0) + /var/run/xdmctl(/.*)? gen_context(system_u:object_r:xdm_var_run_t,s0) + /var/run/sddm(/.*)? gen_context(system_u:object_r:xdm_var_run_t,s0) ++/var/run/greetd[^/]*\.sock -s gen_context(system_u:object_r:xdm_var_run_t,s0) ++/var/run/greetd\.run -- gen_context(system_u:object_r:xdm_var_run_t,s0) + + /var/run/video.rom -- gen_context(system_u:object_r:xserver_var_run_t,s0) + /var/run/xorg(/.*)? gen_context(system_u:object_r:xserver_var_run_t,s0) +Index: fedora-policy-20220714/policy/modules/services/xserver.te =================================================================== ---- fedora-policy-20211111.orig/policy/modules/services/xserver.te -+++ fedora-policy-20211111/policy/modules/services/xserver.te +--- fedora-policy-20220714.orig/policy/modules/services/xserver.te ++++ fedora-policy-20220714/policy/modules/services/xserver.te @@ -473,6 +473,10 @@ userdom_delete_user_home_content_files(x userdom_signull_unpriv_users(xdm_t) userdom_dontaudit_read_admin_home_lnk_files(xdm_t) diff --git a/selinux-policy.changes b/selinux-policy.changes index e53d771..2dc52d7 100644 --- a/selinux-policy.changes +++ b/selinux-policy.changes @@ -1,3 +1,8 @@ +------------------------------------------------------------------- +Tue Sep 27 13:00:35 UTC 2022 - Filippo Bonazzi + +- Update fix_xserver.patch to add greetd support (bsc#1198559) + ------------------------------------------------------------------- Fri Aug 26 06:08:23 UTC 2022 - Thorsten Kukuk