commit: d92c0e639cb7f7842e76a2c054ab5ddcac61e38c
Author: Guido Trentalancia <guido <AT> trentalancia <DOT> net>
AuthorDate: Fri Dec 2 13:44:07 2016 +0000
Commit: Jason Zaman <perfinion <AT> gentoo <DOT> org>
CommitDate: Tue Dec 6 12:39:33 2016 +0000
URL:
https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=d92c0e63
xserver: remove unneeded user content permissions
Remove unneeded permissions to read user content from the
xserver module (xserver and xdm domains).
Signed-off-by: Guido Trentalancia <guido <AT> trentalancia.net>
policy/modules/services/xserver.fc | 1 +
policy/modules/services/xserver.if | 19 +++++++++++++++++++
policy/modules/services/xserver.te | 9 +++++++--
3 files changed, 27 insertions(+), 2 deletions(-)
diff --git a/policy/modules/services/xserver.fc
b/policy/modules/services/xserver.fc
index 4cbba44..41b97e2 100644
--- a/policy/modules/services/xserver.fc
+++ b/policy/modules/services/xserver.fc
@@ -1,6 +1,7 @@
#
# HOME_DIR
#
+HOME_DIR/\.dmrc --
gen_context(system_u:object_r:dmrc_home_t,s0)
HOME_DIR/\.fonts\.conf --
gen_context(system_u:object_r:user_fonts_config_t,s0)
HOME_DIR/\.fonts(/.*)? gen_context(system_u:object_r:user_fonts_t,s0)
HOME_DIR/\.fonts/auto(/.*)?
gen_context(system_u:object_r:user_fonts_cache_t,s0)
diff --git a/policy/modules/services/xserver.if
b/policy/modules/services/xserver.if
index afc157f..a5dbdaa 100644
--- a/policy/modules/services/xserver.if
+++ b/policy/modules/services/xserver.if
@@ -602,6 +602,25 @@ interface(`xserver_read_user_xauth',`
########################################
## <summary>
+## Read all users .dmrc.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`xserver_read_user_dmrc',`
+ gen_require(`
+ type dmrc_home_t;
+ ')
+
+ allow $1 dmrc_home_t:file read_file_perms;
+ userdom_search_user_home_dirs($1)
+')
+
+########################################
+## <summary>
## Set the attributes of the X windows console named pipes.
## </summary>
## <param name="domain">
diff --git a/policy/modules/services/xserver.te
b/policy/modules/services/xserver.te
index 097fd07..96cc1ff 100644
--- a/policy/modules/services/xserver.te
+++ b/policy/modules/services/xserver.te
@@ -211,6 +211,9 @@ corecmd_executable_file(xsession_exec_t)
type xserver_log_t;
logging_log_file(xserver_log_t)
+type dmrc_home_t;
+userdom_user_home_content(dmrc_home_t)
+
ifdef(`enable_mcs',`
init_ranged_domain(xdm_t, xdm_exec_t, s0 - mcs_systemhigh)
init_ranged_daemon_domain(xdm_t, xdm_exec_t, s0 - mcs_systemhigh)
@@ -467,12 +470,14 @@ sysnet_read_config(xdm_t)
userdom_dontaudit_use_unpriv_user_fds(xdm_t)
userdom_create_all_users_keys(xdm_t)
-# for .dmrc
-userdom_read_user_home_content_files(xdm_t)
# Search /proc for any user domain processes.
userdom_read_all_users_state(xdm_t)
userdom_signal_all_users(xdm_t)
+# for .dmrc: this was used by the Gnome Display Manager (gdm)
+# and it is now obsolete in Gnome3
+xserver_read_user_dmrc(xdm_t)
+
xserver_rw_session(xdm_t, xdm_tmpfs_t)
xserver_unconfined(xdm_t)
