forked from pool/selinux-policy
b66c2b8ce6
- Update to version 20221019. Refreshed: * distro_suse_to_distro_redhat.patch * fix_apache.patch * fix_chronyd.patch * fix_cron.patch * fix_init.patch * fix_kernel_sysctl.patch * fix_networkmanager.patch * fix_rpm.patch * fix_sysnetwork.patch * fix_systemd.patch * fix_systemd_watch.patch * fix_unconfined.patch * fix_unconfineduser.patch * fix_unprivuser.patch * fix_xserver.patch - Dropped fix_cockpit.patch as this is now packaged with cockpit itself - Remove the ipa module, freeip ships their own module - Added fix_alsa.patch to allow reading of config files in home directories - Extended fix_networkmanager.patch and fix_postfix.patch to account for SUSE systems - Added dontaudit_interface_kmod_tmpfs.patch to prevent AVCs when startproc queries the running processes - Updated fix_snapper.patch to allow snapper to talk to rpm via dbus OBS-URL: https://build.opensuse.org/request/show/1035580 OBS-URL: https://build.opensuse.org/package/show/security:SELinux/selinux-policy?expand=0&rev=155
69 lines
3.7 KiB
Diff
69 lines
3.7 KiB
Diff
Index: fedora-policy-20221019/policy/modules/services/xserver.fc
|
|
===================================================================
|
|
--- fedora-policy-20221019.orig/policy/modules/services/xserver.fc
|
|
+++ fedora-policy-20221019/policy/modules/services/xserver.fc
|
|
@@ -71,6 +71,7 @@ HOME_DIR/\.dmrc.* -- gen_context(system_
|
|
/etc/X11/[wxg]dm/Xsession -- gen_context(system_u:object_r:xsession_exec_t,s0)
|
|
/etc/X11/wdm(/.*)? gen_context(system_u:object_r:xdm_rw_etc_t,s0)
|
|
/etc/X11/wdm/Xsetup.* -- gen_context(system_u:object_r:xsession_exec_t,s0)
|
|
+/etc/X11/xdm/Xsetup -- gen_context(system_u:object_r:xsession_exec_t,s0)
|
|
/etc/X11/wdm/Xstartup.* -- gen_context(system_u:object_r:xsession_exec_t,s0)
|
|
/etc/X11/Xsession[^/]* -- gen_context(system_u:object_r:xsession_exec_t,s0)
|
|
|
|
@@ -102,6 +103,7 @@ HOME_DIR/\.dmrc.* -- gen_context(system_
|
|
|
|
/usr/bin/sddm -- gen_context(system_u:object_r:xdm_exec_t,s0)
|
|
/usr/bin/sddm-greeter -- gen_context(system_u:object_r:xdm_exec_t,s0)
|
|
+/usr/lib/sddm/sddm-helper -- gen_context(system_u:object_r:xdm_exec_t,s0)
|
|
/usr/bin/gpe-dm -- gen_context(system_u:object_r:xdm_exec_t,s0)
|
|
/usr/bin/iceauth -- gen_context(system_u:object_r:iceauth_exec_t,s0)
|
|
/usr/bin/razor-lightdm-.* -- gen_context(system_u:object_r:xdm_exec_t,s0)
|
|
@@ -114,6 +116,7 @@ HOME_DIR/\.dmrc.* -- gen_context(system_
|
|
/usr/bin/Xwayland -- gen_context(system_u:object_r:xserver_exec_t,s0)
|
|
/usr/bin/x11vnc -- gen_context(system_u:object_r:xserver_exec_t,s0)
|
|
/usr/bin/nvidia.* -- gen_context(system_u:object_r:xserver_exec_t,s0)
|
|
+/usr/bin/greetd -- gen_context(system_u:object_r:xdm_exec_t,s0)
|
|
|
|
/usr/libexec/Xorg\.bin -- gen_context(system_u:object_r:xserver_exec_t,s0)
|
|
/usr/libexec/Xorg\.wrap -- gen_context(system_u:object_r:xserver_exec_t,s0)
|
|
@@ -137,6 +140,7 @@ HOME_DIR/\.dmrc.* -- gen_context(system_
|
|
/usr/X11R6/lib/X11/xkb -d gen_context(system_u:object_r:xkb_var_lib_t,s0)
|
|
/usr/X11R6/lib/X11/xkb/.* -- gen_context(system_u:object_r:xkb_var_lib_t,s0)
|
|
|
|
+/usr/lib/X11/display-manager -- gen_context(system_u:object_r:xdm_exec_t,s0)
|
|
ifndef(`distro_debian',`
|
|
/usr/var/[xgkw]dm(/.*)? gen_context(system_u:object_r:xserver_log_t,s0)
|
|
')
|
|
@@ -155,6 +159,7 @@ ifndef(`distro_debian',`
|
|
/var/lib/[mxkwg]dm(/.*)? gen_context(system_u:object_r:xdm_var_lib_t,s0)
|
|
/var/lib/xkb(/.*)? gen_context(system_u:object_r:xkb_var_lib_t,s0)
|
|
/var/lib/xorg(/.*)? gen_context(system_u:object_r:xserver_var_lib_t,s0)
|
|
+/var/lib/greetd(/.*)? gen_context(system_u:object_r:xdm_var_lib_t,s0)
|
|
|
|
/var/cache/lightdm(/.*)? gen_context(system_u:object_r:xdm_var_lib_t,s0)
|
|
/var/cache/[mg]dm(/.*)? gen_context(system_u:object_r:xdm_var_lib_t,s0)
|
|
@@ -184,6 +189,8 @@ ifndef(`distro_debian',`
|
|
/var/run/xauth(/.*)? gen_context(system_u:object_r:xdm_var_run_t,s0)
|
|
/var/run/xdmctl(/.*)? gen_context(system_u:object_r:xdm_var_run_t,s0)
|
|
/var/run/sddm(/.*)? gen_context(system_u:object_r:xdm_var_run_t,s0)
|
|
+/var/run/greetd[^/]*\.sock -s gen_context(system_u:object_r:xdm_var_run_t,s0)
|
|
+/var/run/greetd\.run -- gen_context(system_u:object_r:xdm_var_run_t,s0)
|
|
|
|
/var/run/video.rom -- gen_context(system_u:object_r:xserver_var_run_t,s0)
|
|
/var/run/xorg(/.*)? gen_context(system_u:object_r:xserver_var_run_t,s0)
|
|
Index: fedora-policy-20221019/policy/modules/services/xserver.te
|
|
===================================================================
|
|
--- fedora-policy-20221019.orig/policy/modules/services/xserver.te
|
|
+++ fedora-policy-20221019/policy/modules/services/xserver.te
|
|
@@ -475,6 +475,10 @@ userdom_dontaudit_read_admin_home_lnk_fi
|
|
|
|
kernel_read_vm_sysctls(xdm_t)
|
|
|
|
+files_manage_generic_pids_symlinks(xdm_t)
|
|
+userdom_manage_user_home_content_dirs(xdm_t)
|
|
+userdom_manage_user_home_content_files(xdm_t)
|
|
+
|
|
# Allow gdm to run gdm-binary
|
|
can_exec(xdm_t, xdm_exec_t)
|
|
can_exec(xdm_t, xsession_exec_t)
|