Allow mozilla to read the alsa config files

PATCH New Sven Vermeulen 4 participants 8 messages Mar 9, 2011 – Mar 14, 2011

Share & tools

Sven Vermeulen

author

2011-03-09 21:13 UTC #0 lore raw

PATCH 7/15 Allow mozilla to read the alsa config files

In order to allow firefox plugins playing music through ALSA, the mozilla domain needs read access on the alsa_rw_config files.

Signed-off-by Sven Vermeulen <[email protected]>

---
 policy/modules/apps/mozilla.te |    4 ++++
 1 files changed, 4 insertions(+), 0 deletions(-)

policy/modules/apps/mozilla.te +4 -0

index c8c459c..6e0f04f 100644
@@ -223,6 +223,10 @@ tunable_policy(`mozilla_read_content',`
 ')
 
 optional_policy(`
+	alsa_read_rw_config(mozilla_t)
+')
+
+optional_policy(`
 	apache_read_user_scripts(mozilla_t)
 	apache_read_user_content(mozilla_t)
 ')

Signature · 1 line

1.7.3.4

Guido Trentalancia

2011-03-09 22:46 UTC #1 lore raw

PATCH 7/15 Allow mozilla to read the alsa config files

I have the same question as for [PATCH 05/15]. Tested at least with the moonlight plugin and with the totem plugin. Sounds strange...

Regards,

Guido

Quoted 23 lines · Sven Vermeulen

In order to allow firefox plugins playing music through ALSA, the mozilla domain needs read access on the alsa_rw_config files.
Signed-off-by Sven Vermeulen <[email protected]>
---
 policy/modules/apps/mozilla.te |    4 ++++
 1 files changed, 4 insertions(+), 0 deletions(-)
policy/modules/apps/mozilla.te +4 -0
index c8c459c..6e0f04f 100644
@@ -223,6 +223,10 @@ tunable_policy(`mozilla_read_content',`
 ')
 
 optional_policy(`
+	alsa_read_rw_config(mozilla_t)
+')
+
+optional_policy(`
 	apache_read_user_scripts(mozilla_t)
 	apache_read_user_content(mozilla_t)
 ')

Dominick Grift

2011-03-10 08:21 UTC #2 lore raw

PATCH 7/15 Allow mozilla to read the alsa config files

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Quoted 2 lines · Guido Trentalancia

I have the same question as for [PATCH 05/15]. Tested at least with the moonlight plugin and with the totem plugin. Sounds strange...

probably because you were using pulseaudio?

Quoted 20 lines

Regards,
Guido
Quoted 15 lines · Sven Vermeulen
In order to allow firefox plugins playing music through ALSA, the mozilla domain needs read access on the alsa_rw_config files.
Signed-off-by Sven Vermeulen <[email protected]>
---
 policy/modules/apps/mozilla.te |    4 ++++
 1 files changed, 4 insertions(+), 0 deletions(-)
policy/modules/apps/mozilla.te +0 -0
index c8c459c..6e0f04f 100644
@@ -223,6 +223,10 @@ tunable_policy(`mozilla_read_content',`
 ')
 

Quoted 14 lines

policy/modules/apps/mozilla.te tunable_policy(`mozilla_read_content',` · line 232
Quoted 8 lines
policy/modules/apps/mozilla.te +4 -0
 optional_policy(`
+	alsa_read_rw_config(mozilla_t)
+')
+
+optional_policy(`
 	apache_read_user_scripts(mozilla_t)
 	apache_read_user_content(mozilla_t)
 ')
_______________________________________________
refpolicy mailing list
refpolicy at oss.tresys.com
http://oss.tresys.com/mailman/listinfo/refpolicy

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.16 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/

iEYEARECAAYFAk14ihIACgkQMlxVo39jgT9aKwCfZGNcORrUtJDB2xqzPg5kIsyG 78cAnRgz/GjcccO6ku6ptd50794tuPx0
=gleZ
-----END PGP SIGNATURE-----

Guido Trentalancia

2011-03-10 11:51 UTC #3 lore raw

PATCH 7/15 Allow mozilla to read the alsa config files

Hello Dominick !

Quoted 5 lines · Dominick Grift

Quoted 2 lines · Guido Trentalancia
I have the same question as for [PATCH 05/15]. Tested at least with the moonlight plugin and with the totem plugin. Sounds strange...
probably because you were using pulseaudio?

Indeed. Just do not consider that then.

Quoted 48 lines

Quoted 20 lines
Regards,
Guido
Quoted 15 lines · Sven Vermeulen
In order to allow firefox plugins playing music through ALSA, the mozilla domain needs read access on the alsa_rw_config files.
Signed-off-by Sven Vermeulen <[email protected]>
---
 policy/modules/apps/mozilla.te |    4 ++++
 1 files changed, 4 insertions(+), 0 deletions(-)
policy/modules/apps/mozilla.te +0 -0
index c8c459c..6e0f04f 100644
@@ -223,6 +223,10 @@ tunable_policy(`mozilla_read_content',`
 ')
 
Quoted 14 lines
policy/modules/apps/mozilla.te tunable_policy(`mozilla_read_content',` · line 232
Quoted 8 lines
policy/modules/apps/mozilla.te +4 -0
 optional_policy(`
+	alsa_read_rw_config(mozilla_t)
+')
+
+optional_policy(`
 	apache_read_user_scripts(mozilla_t)
 	apache_read_user_content(mozilla_t)
 ')
_______________________________________________
refpolicy mailing list
refpolicy at oss.tresys.com
http://oss.tresys.com/mailman/listinfo/refpolicy
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.16 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
iEYEARECAAYFAk14ihIACgkQMlxVo39jgT9aKwCfZGNcORrUtJDB2xqzPg5kIsyG 78cAnRgz/GjcccO6ku6ptd50794tuPx0
=gleZ
-----END PGP SIGNATURE-----
_______________________________________________
refpolicy mailing list
refpolicy at oss.tresys.com
http://oss.tresys.com/mailman/listinfo/refpolicy

Christopher J. PeBenito

2011-03-14 15:29 UTC #4 lore raw

PATCH 7/15 Allow mozilla to read the alsa config files

Quoted 10 lines · Guido Trentalancia

Hello Dominick !
Quoted 5 lines · Dominick Grift
Quoted 2 lines · Guido Trentalancia
I have the same question as for [PATCH 05/15]. Tested at least with the moonlight plugin and with the totem plugin. Sounds strange...
probably because you were using pulseaudio?
Indeed. Just do not consider that then.

This makes me think that we need a more abstract pulseaudio interface, perhaps pulseaudio_client(), which has this access and also others. It looks like the interface should include:

pulseaudio_stream_connect()
pulseaudio_exec()
optional_policy(`alsa_read_rw_config()')

and possibly
corenet_tcp_connect_pulseaudio_port()
corenet_sendrecv_pulseaudio_client_packets()

though we probably want to make those conditional.

Quoted 28 lines

Quoted 28 lines
Quoted 28 lines
Regards,
Guido
Quoted 23 lines · Sven Vermeulen
In order to allow firefox plugins playing music through ALSA, the mozilla domain needs read access on the alsa_rw_config files.
Signed-off-by Sven Vermeulen <[email protected]>
---
 policy/modules/apps/mozilla.te |    4 ++++
 1 files changed, 4 insertions(+), 0 deletions(-)
policy/modules/apps/mozilla.te +4 -0
index c8c459c..6e0f04f 100644
@@ -223,6 +223,10 @@ tunable_policy(`mozilla_read_content',`
 ')
 
 optional_policy(`
+	alsa_read_rw_config(mozilla_t)
+')
+
+optional_policy(`
 	apache_read_user_scripts(mozilla_t)
 	apache_read_user_content(mozilla_t)
 ')

Signature · 3 lines

Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com

Dominick Grift

2011-03-14 15:36 UTC #5 lore raw

PATCH 7/15 Allow mozilla to read the alsa config files

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Quoted 20 lines · Christopher J. PeBenito

Quoted 10 lines · Guido Trentalancia
Hello Dominick !
Quoted 5 lines · Dominick Grift
Quoted 2 lines · Guido Trentalancia
I have the same question as for [PATCH 05/15]. Tested at least with the moonlight plugin and with the totem plugin. Sounds strange...
probably because you were using pulseaudio?
Indeed. Just do not consider that then.
This makes me think that we need a more abstract pulseaudio interface, perhaps pulseaudio_client(), which has this access and also others. It looks like the interface should include:
pulseaudio_stream_connect()
pulseaudio_exec()
optional_policy(`alsa_read_rw_config()')

Quoted 5 lines

and possibly
corenet_tcp_connect_pulseaudio_port()
corenet_sendrecv_pulseaudio_client_packets()
though we probably want to make those conditional.

i do have a pulseaudio_client_template() implemented in my personal policy:

http://fedorapeople.org/gitweb?p=domg472/public_git/refpolicy.git;a=blob;f=policy/modules/apps/pulseaudio.if;h=44312194ff98ff1f04ce50fa182314076d95de77;hb=HEAD

problem is that, to do this right in my view, we would need to rethink pulseaudio policy. I did only the gnome-pulseaudio part in my personal policy and i do not know how other desktop environments deal with pulseaudio, i also have not implemented pulseaudio as a system service policy.

Quoted 20 lines

Quoted 20 lines
Quoted 20 lines
Quoted 20 lines
Regards,
Guido
Quoted 15 lines · Sven Vermeulen
In order to allow firefox plugins playing music through ALSA, the mozilla domain needs read access on the alsa_rw_config files.
Signed-off-by Sven Vermeulen <[email protected]>
---
 policy/modules/apps/mozilla.te |    4 ++++
 1 files changed, 4 insertions(+), 0 deletions(-)
policy/modules/apps/mozilla.te +0 -0
index c8c459c..6e0f04f 100644
@@ -223,6 +223,10 @@ tunable_policy(`mozilla_read_content',`
 ')
 

Quoted 9 lines

Quoted 8 lines
Quoted 8 lines
Quoted 8 lines
policy/modules/apps/mozilla.te tunable_policy(`mozilla_read_content',` · line 232
Quoted 8 lines
policy/modules/apps/mozilla.te +4 -0
 optional_policy(`
+	alsa_read_rw_config(mozilla_t)
+')
+
+optional_policy(`
 	apache_read_user_scripts(mozilla_t)
 	apache_read_user_content(mozilla_t)
 ')

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.16 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/

iEYEARECAAYFAk1+NhsACgkQMlxVo39jgT+GnwCbBBy/wL9vmmTrYLi5wX6wr6br 9H8An3JcShBgPymbnkUOzRoT8GZTCL0i
=YpWC
-----END PGP SIGNATURE-----

Dominick Grift

2011-03-14 15:39 UTC #6 lore raw

PATCH 7/15 Allow mozilla to read the alsa config files

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Quoted 30 lines · Dominick Grift

Quoted 20 lines · Christopher J. PeBenito
Quoted 10 lines · Guido Trentalancia
Hello Dominick !
Quoted 5 lines · Dominick Grift
Quoted 2 lines · Guido Trentalancia
I have the same question as for [PATCH 05/15]. Tested at least with the moonlight plugin and with the totem plugin. Sounds strange...
probably because you were using pulseaudio?
Indeed. Just do not consider that then.
This makes me think that we need a more abstract pulseaudio interface, perhaps pulseaudio_client(), which has this access and also others. It looks like the interface should include:
pulseaudio_stream_connect()
pulseaudio_exec()
optional_policy(`alsa_read_rw_config()')
Quoted 5 lines
and possibly
corenet_tcp_connect_pulseaudio_port()
corenet_sendrecv_pulseaudio_client_packets()
though we probably want to make those conditional.
i do have a pulseaudio_client_template() implemented in my personal policy:

Quoted 8 lines

http://fedorapeople.org/gitweb?p=domg472/public_git/refpolicy.git;a=blob;f=policy/modules/apps/pulseaudio.if;h=44312194ff98ff1f04ce50fa182314076d95de77;hb=HEAD
problem is that, to do this right in my view, we would need to rethink pulseaudio policy. I did only the gnome-pulseaudio part in my personal policy and i do not know how other desktop environments deal with pulseaudio, i also have not implemented pulseaudio as a system service policy.

And becuase pulseaudio is so tightly integrated with gnome, in my view, it would be best to implement policy for gnome as well (gconf, gnome settings daemon etc)

problem is that with gnome 3 coming up, things may (or may not) change dramatically... so i do not know where to draw the line.

Quoted 20 lines

Quoted 20 lines
Quoted 20 lines
Quoted 20 lines
Quoted 20 lines
Regards,
Guido
Quoted 15 lines · Sven Vermeulen
In order to allow firefox plugins playing music through ALSA, the mozilla domain needs read access on the alsa_rw_config files.
Signed-off-by Sven Vermeulen <[email protected]>
---
 policy/modules/apps/mozilla.te |    4 ++++
 1 files changed, 4 insertions(+), 0 deletions(-)
policy/modules/apps/mozilla.te +0 -0
index c8c459c..6e0f04f 100644
@@ -223,6 +223,10 @@ tunable_policy(`mozilla_read_content',`
 ')
 

Quoted 10 lines

Quoted 8 lines
Quoted 8 lines
Quoted 8 lines
Quoted 8 lines
policy/modules/apps/mozilla.te tunable_policy(`mozilla_read_content',` · line 232
Quoted 8 lines
policy/modules/apps/mozilla.te +4 -0
 optional_policy(`
+	alsa_read_rw_config(mozilla_t)
+')
+
+optional_policy(`
 	apache_read_user_scripts(mozilla_t)
 	apache_read_user_content(mozilla_t)
 ')

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.16 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/

iEYEARECAAYFAk1+Ns4ACgkQMlxVo39jgT9YEQCgo9d8VGtPbxeaXv94V+Odktnn FNUAn1xyRTCTDL7JgoTk54MuJp4Hg+jg
=vzCJ
-----END PGP SIGNATURE-----

Dominick Grift

2011-03-14 15:42 UTC #7 lore raw

PATCH 7/15 Allow mozilla to read the alsa config files

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Quoted 12 lines · Dominick Grift

Quoted 11 lines · Dominick Grift
Quoted 10 lines · Christopher J. PeBenito
Quoted 9 lines · Guido Trentalancia
Hello Dominick !
Quoted 5 lines · Dominick Grift
Quoted 2 lines · Guido Trentalancia
I have the same question as for [PATCH 05/15]. Tested at least with the moonlight plugin and with the totem plugin. Sounds strange...
probably because you were using pulseaudio?

Quoted 8 lines

Quoted 8 lines
Quoted 8 lines
Quoted 1 line
Indeed. Just do not consider that then.
This makes me think that we need a more abstract pulseaudio interface, perhaps pulseaudio_client(), which has this access and also others. It looks like the interface should include:
pulseaudio_stream_connect()
pulseaudio_exec()

I do not think one wants pulseaudio_exec, i think clients need to be able to (re) start pulseaudio in the pulseaudio domain.

Quoted 47 lines

Quoted 11 lines
Quoted 7 lines
optional_policy(`alsa_read_rw_config()')
and possibly
corenet_tcp_connect_pulseaudio_port()
corenet_sendrecv_pulseaudio_client_packets()
though we probably want to make those conditional.
i do have a pulseaudio_client_template() implemented in my personal policy:
Quoted 7 lines
http://fedorapeople.org/gitweb?p=domg472/public_git/refpolicy.git;a=blob;f=policy/modules/apps/pulseaudio.if;h=44312194ff98ff1f04ce50fa182314076d95de77;hb=HEAD
problem is that, to do this right in my view, we would need to rethink pulseaudio policy. I did only the gnome-pulseaudio part in my personal policy and i do not know how other desktop environments deal with pulseaudio, i also have not implemented pulseaudio as a system service policy.
And becuase pulseaudio is so tightly integrated with gnome, in my view, it would be best to implement policy for gnome as well (gconf, gnome settings daemon etc)
problem is that with gnome 3 coming up, things may (or may not) change dramatically... so i do not know where to draw the line.
Quoted 20 lines
Quoted 20 lines
Quoted 20 lines
Quoted 20 lines
Quoted 20 lines
Regards,
Guido
Quoted 15 lines · Sven Vermeulen
In order to allow firefox plugins playing music through ALSA, the mozilla domain needs read access on the alsa_rw_config files.
Signed-off-by Sven Vermeulen <[email protected]>
---
 policy/modules/apps/mozilla.te |    4 ++++
 1 files changed, 4 insertions(+), 0 deletions(-)
policy/modules/apps/mozilla.te +0 -0
index c8c459c..6e0f04f 100644
@@ -223,6 +223,10 @@ tunable_policy(`mozilla_read_content',`
 ')
 

Quoted 10 lines

Quoted 8 lines
Quoted 8 lines
Quoted 8 lines
Quoted 8 lines
Quoted 8 lines
policy/modules/apps/mozilla.te tunable_policy(`mozilla_read_content',` · line 232
Quoted 8 lines
policy/modules/apps/mozilla.te +4 -0
 optional_policy(`
+	alsa_read_rw_config(mozilla_t)
+')
+
+optional_policy(`
 	apache_read_user_scripts(mozilla_t)
 	apache_read_user_content(mozilla_t)
 ')

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.16 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/

iEYEARECAAYFAk1+N1IACgkQMlxVo39jgT9aMACginVYJjp7FffStk6lfVlrZrZs xzcAn2nLDhznyqyk0rjYSfYlHKfTl9o4
=6eUT
-----END PGP SIGNATURE-----