wm: update the window manager (wm) module and enable its role template

Enable the window manager role (wm contrib module) and update the module to work with gnome-shell.

This second version introduces better integration with common desktop applications and requires the following recently posted patch for the games module:

[PATCH 1/2] games: general update and improved pulseaudio integration
http://oss.tresys.com/pipermail/refpolicy/2016-December/008650.html

This patch might need some more testing.

Signed-off-by Guido Trentalancia <[email protected]>

---
 policy/modules/contrib/pulseaudio.if |   19 +++++++++
 policy/modules/contrib/wm.if         |   44 +++++++++++++++++++++
 policy/modules/contrib/wm.te         |   73 +++++++++++++++++++++++++++++++++++
 policy/modules/roles/staff.te        |    1
 policy/modules/roles/sysadm.te       |    1
 policy/modules/roles/unprivuser.te   |    1
 6 files changed, 139 insertions(+)

diff -pruN refpolicy-git-07122016-orig/policy/modules/contrib/pulseaudio.if refpolicy-git-07122016/policy/modules/contrib/pulseaudio.if

policy/modules/contrib/pulseaudio.if +9 -0

@@ -424,3 +424,22 @@ interface(`pulseaudio_rw_tmpfs_files',`
 	fs_search_tmpfs($1)
 	rw_files_pattern($1, pulseaudio_tmpfs_t, pulseaudio_tmpfs_t)
 ')
+
+#######################################
+## <summary>
+##	Manage pulseaudio tmpfs files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>

diff -pruN refpolicy-git-07122016-orig/policy/modules/contrib/wm.if refpolicy-git-07122016/policy/modules/contrib/wm.if

policy/modules/contrib/wm.if +3 -0

@@ -47,6 +47,8 @@ template(`wm_role_template',`
 	# Policy
 	#
 
+	allow $3 $1_wm_t:fd use;
+
 	allow $1_wm_t $3:unix_stream_socket connectto;
 	allow $3 $1_wm_t:unix_stream_socket connectto;
 

@@ -72,6 +74,7 @@ template(`wm_role_template',`
 	xserver_manage_core_devices($1_wm_t)
 
 	optional_policy(`
+		dbus_connect_spec_session_bus($1, $1_wm_t)
 		dbus_spec_session_bus_client($1, $1_wm_t)
 		dbus_system_bus_client($1_wm_t)
 

@@ -81,11 +84,14 @@ template(`wm_role_template',`
 	')

policy/modules/contrib/wm.if +38 -0

 	')
 ')
 

@@ -134,3 +140,41 @@ interface(`wm_dbus_chat',`
 	allow $2 $1_wm_t:dbus send_msg;
 	allow $1_wm_t $2:dbus send_msg;
 ')
+
+########################################
+## <summary>
+##	Do not audit attempts to execute
+##	files in temporary directories.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain to not audit.
+##	</summary>
+## </param>
+#
+interface(`wm_dontaudit_exec_tmp_files',`
+	gen_require(`
+		type wm_tmp_t;
+	')
+
+	dontaudit $1 wm_tmp_t:file exec_file_perms;
+')
+
+########################################
+## <summary>
+##	Do not audit attempts to execute
+##	files in temporary filesystems.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain to not audit.
+##	</summary>
+## </param>
+#
+interface(`wm_dontaudit_exec_tmpfs_files',`
+	gen_require(`
+		type wm_tmpfs_t;
+	')
+
+	dontaudit $1 wm_tmpfs_t:file exec_file_perms;
+')

diff -pruN refpolicy-git-07122016-orig/policy/modules/contrib/wm.te refpolicy-git-07122016/policy/modules/contrib/wm.te

policy/modules/contrib/wm.te +18 -0

+
 ########################################
 #
 # Common wm domain local policy

@@ -21,31 +29,60 @@ allow wm_domain self:netlink_kobject_uev
 allow wm_domain self:shm create_shm_perms;
 allow wm_domain self:unix_dgram_socket create_socket_perms;
 
+manage_dirs_pattern(wm_domain, wm_tmp_t, wm_tmp_t)
+manage_files_pattern(wm_domain, wm_tmp_t, wm_tmp_t)
+manage_lnk_files_pattern(wm_domain, wm_tmp_t, wm_tmp_t)
+files_tmp_filetrans(wm_domain, wm_tmp_t, { dir file lnk_file })
+
+manage_dirs_pattern(wm_domain, wm_tmpfs_t, wm_tmpfs_t)
+manage_files_pattern(wm_domain, wm_tmpfs_t, wm_tmpfs_t)
+manage_lnk_files_pattern(wm_domain, wm_tmpfs_t, wm_tmpfs_t)
+fs_tmpfs_filetrans(wm_domain, wm_tmpfs_t, { dir file lnk_file })
+
+can_exec(wm_domain, wm_exec_t)
+
 kernel_read_system_state(wm_domain)
 
 corecmd_getattr_all_executables(wm_domain)
 
+dev_read_rand(wm_domain)
 dev_read_sound(wm_domain)
 dev_read_sysfs(wm_domain)
 dev_read_urand(wm_domain)
+dev_rw_dri(wm_domain)
 dev_rw_wireless(wm_domain)
 dev_write_sound(wm_domain)
 
+files_read_etc_runtime_files(wm_domain)
 files_read_usr_files(wm_domain)
 
 fs_getattr_all_fs(wm_domain)
 
+kernel_read_fs_sysctls(wm_domain)
+kernel_read_proc_symlinks(wm_domain)

policy/modules/contrib/wm.te +37 -0

+
 optional_policy(`
 	accountsd_dbus_chat(wm_domain)
 ')

@@ -55,10 +92,42 @@ optional_policy(`
 ')		
 
 optional_policy(`
+	consolekit_dbus_chat(wm_domain)
+')
+
+optional_policy(`
 	devicekit_dbus_chat_power(wm_domain)
 ')
 
 optional_policy(`
+	evolution_dbus_chat(wm_domain)
+	evolution_alarm_dbus_chat(wm_domain)
+	evolution_domtrans(wm_domain)
+')
+
+optional_policy(`
+	games_dbus_chat(wm_domain)
+	games_domtrans(wm_domain)
+')
+
+optional_policy(`
+	java_domtrans(wm_domain)
+')
+
+optional_policy(`
+	mono_domtrans(wm_domain)
+')
+
+optional_policy(`
+	mozilla_domtrans(wm_domain)
+	mozilla_dbus_chat(wm_domain)
+')
+
+optional_policy(`
+	mplayer_domtrans(wm_domain)
+')
+
+optional_policy(`
 	networkmanager_dbus_chat(wm_domain)
 ')
 

@@ -71,5 +140,9 @@ optional_policy(`
 ')
 
 optional_policy(`
+	telepathy_mission_control_dbus_chat(wm_domain)
+')
+
+optional_policy(`
 	userhelper_exec_consolehelper(wm_domain)
 ')

diff -pruN refpolicy-git-07122016-orig/policy/modules/roles/staff.te refpolicy-git-07122016/policy/modules/roles/staff.te

policy/modules/roles/staff.te +1 -0

@@ -85,6 +85,7 @@ ifndef(`distro_redhat',`
 
 		optional_policy(`
 			gnome_role_template(staff, staff_r, staff_t)
+			wm_role_template(staff, staff_r, staff_t)
 		')
 
 		optional_policy(`

diff -pruN refpolicy-git-07122016-orig/policy/modules/roles/sysadm.te refpolicy-git-07122016/policy/modules/roles/sysadm.te

policy/modules/roles/sysadm.te +1 -0

@@ -1245,6 +1245,7 @@ ifndef(`distro_redhat',`
 
 		optional_policy(`
 			gnome_role_template(sysadm, sysadm_r, sysadm_t)
+			wm_role_template(sysadm, sysadm_r, sysadm_t)
 		')
 	')
 

diff -pruN refpolicy-git-07122016-orig/policy/modules/roles/unprivuser.te refpolicy-git-07122016/policy/modules/roles/unprivuser.te

policy/modules/roles/unprivuser.te +1 -0

@@ -54,6 +54,7 @@ ifndef(`distro_redhat',`
 
 		optional_policy(`
 			gnome_role_template(user, user_r, user_t)
+			wm_role_template(user, user_r, user_t)
 		')
 
 		optional_policy(`

_______________________________________________
refpolicy mailing list
refpolicy at oss.tresys.com
http://oss.tresys.com/mailman/listinfo/refpolicy

i

Quoted 8 lines · Guido Trentalancia via refpolicy

Enable the window manager role (wm contrib module) and update the module to work with gnome-shell.

This second version introduces better integration with common desktop applications and requires the following recently posted patch for the games module:

Quoted 5 lines

[PATCH 1/2] games: general update and improved pulseaudio integration
http://oss.tresys.com/pipermail/refpolicy/2016-December/008650.html

This patch might need some more testing.

Yes, i dont think this should be merged.

Also gnome-shell is a wm but its not every wm needs the permissions that
gnome-shell needs. We should either give gnome-shell its own domain or
add the gnome-shell specific rules to a tunable.

For example: gnome-shell is a wayland compositor. but there are many more things that gnome shell needs that a "normal" window manager should
never need.

Quoted 40 lines

Signed-off-by Guido Trentalancia <[email protected]>

---

?policy/modules/contrib/pulseaudio.if |???19 +++++++++
?policy/modules/contrib/wm.if?????????|???44 +++++++++++++++++++++
?policy/modules/contrib/wm.te?????????|???73
+++++++++++++++++++++++++++++++++++
?policy/modules/roles/staff.te????????|????1
?policy/modules/roles/sysadm.te???????|????1
?policy/modules/roles/unprivuser.te???|????1

?6 files changed, 139 insertions(+)

diff -pruN refpolicy-git-07122016- orig/policy/modules/contrib/pulseaudio.if refpolicy-git- 07122016/policy/modules/contrib/pulseaudio.if
--- refpolicy-git-07122016-
orig/policy/modules/contrib/pulseaudio.if 2016-09-27
16:28:51.964139648 +0200
+++ refpolicy-git-07122016/policy/modules/contrib/pulseaudio.if

2016-12-08 15:47:40.117740787 +0100

(quoted diff) +0 -0

@@ -424,3 +424,22 @@ interface(`pulseaudio_rw_tmpfs_files',`
 ?	fs_search_tmpfs($1)
 ?	rw_files_pattern($1, pulseaudio_tmpfs_t,
 pulseaudio_tmpfs_t)

?')

policy/modules/contrib/pulseaudio.if +16 -0

+
+#######################################
+## <summary>
+##	Manage pulseaudio tmpfs files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`pulseaudio_manage_tmpfs_files',`
+	gen_require(`
+		type pulseaudio_tmpfs_t;
+	')
+

Quoted 4 lines

(quoted diff) +2 -0

+	fs_search_tmpfs($1)
+	manage_files_pattern($1, pulseaudio_tmpfs_t,

pulseaudio_tmpfs_t)
+')

does not make sense, and i would like to know what prompted you to add
this (preferably backed with avc denials)

wm should is a pulseaudio_client and pulseaudio_client can already rw and delete pulseaudio_tmpfs_files. It should not need more than that.

Quoted 30 lines

diff -pruN refpolicy-git-07122016-orig/policy/modules/contrib/wm.if refpolicy-git-07122016/policy/modules/contrib/wm.if
--- refpolicy-git-07122016-orig/policy/modules/contrib/wm.if

2016-08-14 21:28:11.597521187 +0200

+++ refpolicy-git-07122016/policy/modules/contrib/wm.if 2016
-12-08 15:47:40.118740804 +0100

(quoted diff) +0 -0

@@ -47,6 +47,8 @@ template(`wm_role_template',`

? # Policy
? #
?

policy/modules/contrib/wm.if +2 -0

+	allow $3 $1_wm_t:fd use;
+

? allow $1_wm_t $3:unix_stream_socket connectto;
? allow $3 $1_wm_t:unix_stream_socket connectto;
?

(quoted diff) +0 -0

@@ -72,6 +74,7 @@ template(`wm_role_template',`
 ?	xserver_manage_core_devices($1_wm_t)

?
? optional_policy(`

policy/modules/contrib/wm.if +1 -0

+		dbus_connect_spec_session_bus($1, $1_wm_t)

? dbus_spec_session_bus_client($1, $1_wm_t)
? dbus_system_bus_client($1_wm_t)
?

(quoted diff) +0 -0

@@ -81,11 +84,14 @@ template(`wm_role_template',`
 ?	')

?
? optional_policy(`

policy/modules/contrib/wm.if +1 -0

+		gnome_dbus_chat_gkeyringd($1, $1_wm_t)

? gnome_stream_connect_gkeyringd($1, $1_wm_t)
? ')

policy/modules/contrib/wm.if template(`wm_role_template',` · line 94

Quoted 5 lines

?
? optional_policy(`
? pulseaudio_run($1_wm_t, $2)

policy/modules/contrib/wm.if +2 -0

+		pulseaudio_manage_tmpfs_files($1_wm_t)
+		pulseaudio_use_fds($1_wm_t)

these shouldnt be needed. what prompted you to add these? (preferably show avc denials)

Quoted 58 lines

? ')
?')
?

policy/modules/contrib/wm.if +38 -0

@@ -134,3 +140,41 @@ interface(`wm_dbus_chat',`
 ?	allow $2 $1_wm_t:dbus send_msg;
 ?	allow $1_wm_t $2:dbus send_msg;
 ?')
+
+########################################
+## <summary>
+##	Do not audit attempts to execute
+##	files in temporary directories.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain to not audit.
+##	</summary>
+## </param>
+#
+interface(`wm_dontaudit_exec_tmp_files',`
+	gen_require(`
+		type wm_tmp_t;
+	')
+
+	dontaudit $1 wm_tmp_t:file exec_file_perms;
+')
+
+########################################
+## <summary>
+##	Do not audit attempts to execute
+##	files in temporary filesystems.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain to not audit.
+##	</summary>
+## </param>
+#
+interface(`wm_dontaudit_exec_tmpfs_files',`
+	gen_require(`
+		type wm_tmpfs_t;
+	')
+
+	dontaudit $1 wm_tmpfs_t:file exec_file_perms;
+')

diff -pruN refpolicy-git-07122016-orig/policy/modules/contrib/wm.te refpolicy-git-07122016/policy/modules/contrib/wm.te
--- refpolicy-git-07122016-orig/policy/modules/contrib/wm.te

2016-10-29 16:29:19.762328008 +0200

+++ refpolicy-git-07122016/policy/modules/contrib/wm.te 2016
-12-08 17:57:40.843768477 +0100

(quoted diff) +0 -0

@@ -10,6 +10,14 @@ attribute wm_domain;
 ?type wm_exec_t;
 ?corecmd_executable_file(wm_exec_t)

?

(quoted diff) +2 -0

+type wm_tmp_t;
+typealias wm_tmp_t alias { user_wm_tmp_t staff_wm_tmp_t

sysadm_wm_tmp_t };

Quoted 6 lines

policy/modules/contrib/wm.te +4 -0

+userdom_user_tmp_file(wm_tmp_t)
+
+type wm_tmpfs_t;
+typealias wm_tmpfs_t alias { user_wm_tmpfs_t staff_wm_tmpfs_t

sysadm_wm_tmpfs_t };
+userdom_user_tmpfs_file(wm_tmpfs_t)

this is a pulseaudio_tmpfs_file()

Quoted 43 lines

+
?########################################
?#
?# Common wm domain local policy

(quoted diff) +0 -0

@@ -21,31 +29,60 @@ allow wm_domain self:netlink_kobject_uev
 ?allow wm_domain self:shm create_shm_perms;
 ?allow wm_domain self:unix_dgram_socket create_socket_perms;

?

policy/modules/contrib/wm.te +12 -0

+manage_dirs_pattern(wm_domain, wm_tmp_t, wm_tmp_t)
+manage_files_pattern(wm_domain, wm_tmp_t, wm_tmp_t)
+manage_lnk_files_pattern(wm_domain, wm_tmp_t, wm_tmp_t)
+files_tmp_filetrans(wm_domain, wm_tmp_t, { dir file lnk_file })
+
+manage_dirs_pattern(wm_domain, wm_tmpfs_t, wm_tmpfs_t)
+manage_files_pattern(wm_domain, wm_tmpfs_t, wm_tmpfs_t)
+manage_lnk_files_pattern(wm_domain, wm_tmpfs_t, wm_tmpfs_t)
+fs_tmpfs_filetrans(wm_domain, wm_tmpfs_t, { dir file lnk_file })
+
+can_exec(wm_domain, wm_exec_t)
+

?kernel_read_system_state(wm_domain)
?
?corecmd_getattr_all_executables(wm_domain)
?
+dev_read_rand(wm_domain)
?dev_read_sound(wm_domain)
?dev_read_sysfs(wm_domain)
?dev_read_urand(wm_domain)
+dev_rw_dri(wm_domain)
?dev_rw_wireless(wm_domain)
?dev_write_sound(wm_domain)
?
+files_read_etc_runtime_files(wm_domain)
?files_read_usr_files(wm_domain)
?
?fs_getattr_all_fs(wm_domain)
?

policy/modules/contrib/wm.te +4 -0

+kernel_read_fs_sysctls(wm_domain)
+kernel_read_proc_symlinks(wm_domain)
+kernel_read_sysctl(wm_domain)
+

?miscfiles_read_fonts(wm_domain)
+miscfiles_read_generic_certs(wm_domain)

policy/modules/contrib/wm.te allow wm_domain self:netlink_kobject_uev · line 72

Quoted 6 lines

?miscfiles_read_localization(wm_domain)
?

policy/modules/contrib/wm.te +4 -0

+udev_read_pid_files(wm_domain)
+
+# this is needed by gnome-shell
+userdom_exec_user_home_content_files(wm_domain)

What exactly is it executing here?

Quoted 7 lines

+
?userdom_manage_user_tmp_sockets(wm_domain) ?userdom_tmp_filetrans_user_tmp(wm_domain, sock_file) ?userdom_user_runtime_filetrans_user_tmp(wm_domain, sock_file) ?
?userdom_manage_user_home_content_dirs(wm_domain) ?userdom_manage_user_home_content_files(wm_domain)

policy/modules/contrib/wm.te allow wm_domain self:netlink_kobject_uev · line 84

Quoted 6 lines

+ ?userdom_user_home_dir_filetrans_user_home_content(wm_domain, { dir file })
?

policy/modules/contrib/wm.te +2 -0

+wm_dontaudit_exec_tmp_files(wm_domain)
+wm_dontaudit_exec_tmpfs_files(wm_domain)

why dontaudit the above? gnome-shell needs to mmap some files

Quoted 97 lines

+
?optional_policy(`
? accountsd_dbus_chat(wm_domain)
?')

(quoted diff) +0 -0

@@ -55,10 +92,42 @@ optional_policy(`
 ?')		

?
?optional_policy(`

policy/modules/contrib/wm.te +4 -0

+	consolekit_dbus_chat(wm_domain)
+')
+
+optional_policy(`

? devicekit_dbus_chat_power(wm_domain)
?')
?
?optional_policy(`

policy/modules/contrib/wm.te +28 -0

+	evolution_dbus_chat(wm_domain)
+	evolution_alarm_dbus_chat(wm_domain)
+	evolution_domtrans(wm_domain)
+')
+
+optional_policy(`
+	games_dbus_chat(wm_domain)
+	games_domtrans(wm_domain)
+')
+
+optional_policy(`
+	java_domtrans(wm_domain)
+')
+
+optional_policy(`
+	mono_domtrans(wm_domain)
+')
+
+optional_policy(`
+	mozilla_domtrans(wm_domain)
+	mozilla_dbus_chat(wm_domain)
+')
+
+optional_policy(`
+	mplayer_domtrans(wm_domain)
+')
+
+optional_policy(`

? networkmanager_dbus_chat(wm_domain)
?')
?

(quoted diff) +0 -0

@@ -71,5 +140,9 @@ optional_policy(`
 ?')

?
?optional_policy(`

policy/modules/contrib/wm.te +4 -0

+	telepathy_mission_control_dbus_chat(wm_domain)
+')
+
+optional_policy(`

? userhelper_exec_consolehelper(wm_domain)
?')
diff -pruN refpolicy-git-07122016- orig/policy/modules/roles/staff.te refpolicy-git- 07122016/policy/modules/roles/staff.te
--- refpolicy-git-07122016-orig/policy/modules/roles/staff.te

2016-12-07 13:39:08.669449296 +0100

+++ refpolicy-git-07122016/policy/modules/roles/staff.te 201
6-12-08 15:47:40.140741170 +0100

(quoted diff) +0 -0

@@ -85,6 +85,7 @@ ifndef(`distro_redhat',`

?
? optional_policy(`
? gnome_role_template(staff, staff_r,
staff_t)

policy/modules/roles/staff.te +1 -0

+			wm_role_template(staff, staff_r, staff_t)

? ')
?
? optional_policy(`
diff -pruN refpolicy-git-07122016- orig/policy/modules/roles/sysadm.te refpolicy-git- 07122016/policy/modules/roles/sysadm.te
--- refpolicy-git-07122016-orig/policy/modules/roles/sysadm.te

2016-12-07 13:39:08.669449296 +0100

+++ refpolicy-git-07122016/policy/modules/roles/sysadm.te 20
16-12-08 15:47:40.141741187 +0100

(quoted diff) +0 -0

@@ -1245,6 +1245,7 @@ ifndef(`distro_redhat',`

?
? optional_policy(`
? gnome_role_template(sysadm, sysadm_r,
sysadm_t)

(quoted diff) +1 -0

+			wm_role_template(sysadm, sysadm_r,

sysadm_t)
? ')
? ')
?
diff -pruN refpolicy-git-07122016- orig/policy/modules/roles/unprivuser.te refpolicy-git- 07122016/policy/modules/roles/unprivuser.te
--- refpolicy-git-07122016-orig/policy/modules/roles/unprivuser.te

2016-12-07 13:39:08.669449296 +0100
+++ refpolicy-git-07122016/policy/modules/roles/unprivuser.te	
2016-12-08 15:47:40.141741187 +0100

Quoted 8 lines

(quoted diff) +0 -0

@@ -54,6 +54,7 @@ ifndef(`distro_redhat',`

?
? optional_policy(`
? gnome_role_template(user, user_r, user_t)

policy/modules/roles/unprivuser.te +1 -0

+			wm_role_template(user, user_r, user_t)

? ')
?
? optional_policy(`

Quoted 14 lines · Dominick Grift via refpolicy

i

Quoted 12 lines · Guido Trentalancia via refpolicy

Enable the window manager role (wm contrib module) and update the module to work with gnome-shell.

This second version introduces better integration with common desktop applications and requires the following recently posted patch for the games module:

[PATCH 1/2] games: general update and improved pulseaudio integration
http://oss.tresys.com/pipermail/refpolicy/2016-December/008650.html

Quoted 3 lines

Quoted 1 line

This patch might need some more testing.

Yes, i dont think this should be merged.

It needs to be tested with other window managers.

Have you found any actual limitation with the old gnome (gnome- panel/metacity), kde or others ?

Quoted 6 lines

Also gnome-shell is a wm but its not every wm needs the permissions that
gnome-shell needs. We should either give gnome-shell its own domain or
add the gnome-shell specific rules to a tunable.

Quoted 4 lines

For example: gnome-shell is a wayland compositor. but there are many more things that gnome shell needs that a "normal" window manager should
never need.

The permissions that have been added are very general and harmless.

Quoted 38 lines

Quoted 38 lines

 policy/modules/contrib/pulseaudio.if |   19 +++++++++
 policy/modules/contrib/wm.if         |   44 +++++++++++++++++++++
 policy/modules/contrib/wm.te         |   73
+++++++++++++++++++++++++++++++++++
 policy/modules/roles/staff.te        |    1
 policy/modules/roles/sysadm.te       |    1
 policy/modules/roles/unprivuser.te  |    1
 6 files changed, 139 insertions(+)

diff -pruN refpolicy-git-07122016- orig/policy/modules/contrib/pulseaudio.if refpolicy-git- 07122016/policy/modules/contrib/pulseaudio.if
--- refpolicy-git-07122016-
orig/policy/modules/contrib/pulseaudio.if 2016-09-27
16:28:51.964139648 +0200
+++ refpolicy-git-07122016/policy/modules/contrib/pulseaudio.if

2016-12-08 15:47:40.117740787 +0100

policy/modules/contrib/pulseaudio.if +16 -0

@@ -424,3 +424,22 @@ interface(`pulseaudio_rw_tmpfs_files',`
 	fs_search_tmpfs($1)
 	rw_files_pattern($1, pulseaudio_tmpfs_t,
 pulseaudio_tmpfs_t)
 ')
+
+#######################################
+## <summary>
+##	Manage pulseaudio tmpfs files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`pulseaudio_manage_tmpfs_files',`
+	gen_require(`
+		type pulseaudio_tmpfs_t;
+	')
+

Quoted 8 lines

Quoted 4 lines

(quoted diff) +2 -0

+	fs_search_tmpfs($1)
+	manage_files_pattern($1, pulseaudio_tmpfs_t,

pulseaudio_tmpfs_t)
+')

does not make sense, and i would like to know what prompted you to add
this (preferably backed with avc denials)

It's needed to unlink them. Probably stale files from previous sessions.

Quoted 2 lines

wm should is a pulseaudio_client and pulseaudio_client can already rw and delete pulseaudio_tmpfs_files. It should not need more than that.

I decided to avoid using the pulseaudio_client attribute because it implies other unneeded permissions, including corenet permissions that are quite undesirable.

Quoted 31 lines

Quoted 31 lines

diff -pruN refpolicy-git-07122016-orig/policy/modules/contrib/wm.if refpolicy-git-07122016/policy/modules/contrib/wm.if
--- refpolicy-git-07122016-orig/policy/modules/contrib/wm.if

2016-08-14 21:28:11.597521187 +0200

+++ refpolicy-git-07122016/policy/modules/contrib/wm.if 2016
-12-08 15:47:40.118740804 +0100

policy/modules/contrib/wm.if +4 -0

@@ -47,6 +47,8 @@ template(`wm_role_template',`
 	# Policy
 	#
 
+	allow $3 $1_wm_t:fd use;
+
 	allow $1_wm_t $3:unix_stream_socket connectto;
 	allow $3 $1_wm_t:unix_stream_socket connectto;
 

@@ -72,6 +74,7 @@ template(`wm_role_template',`
 	xserver_manage_core_devices($1_wm_t)
 
 	optional_policy(`
+		dbus_connect_spec_session_bus($1, $1_wm_t)
 		dbus_spec_session_bus_client($1, $1_wm_t)
 		dbus_system_bus_client($1_wm_t)
 

@@ -81,11 +84,14 @@ template(`wm_role_template',`
 	')
 
 	optional_policy(`
+		gnome_dbus_chat_gkeyringd($1, $1_wm_t)
 		gnome_stream_connect_gkeyringd($1, $1_wm_t)
 	')
 

Quoted 7 lines

policy/modules/contrib/wm.if template(`wm_role_template',` · line 94

Quoted 4 lines

policy/modules/contrib/wm.if +2 -0

 	optional_policy(`
 		pulseaudio_run($1_wm_t, $2)
+		pulseaudio_manage_tmpfs_files($1_wm_t)
+		pulseaudio_use_fds($1_wm_t)

these shouldnt be needed. what prompted you to add these? (preferably show avc denials)

See above. Stale files need to be unlinked.

Quoted 56 lines

Quoted 56 lines

policy/modules/contrib/wm.if +38 -0

 	')
 ')
 

@@ -134,3 +140,41 @@ interface(`wm_dbus_chat',`
 	allow $2 $1_wm_t:dbus send_msg;
 	allow $1_wm_t $2:dbus send_msg;
 ')
+
+########################################
+## <summary>
+##	Do not audit attempts to execute
+##	files in temporary directories.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain to not audit.
+##	</summary>
+## </param>
+#
+interface(`wm_dontaudit_exec_tmp_files',`
+	gen_require(`
+		type wm_tmp_t;
+	')
+
+	dontaudit $1 wm_tmp_t:file exec_file_perms;
+')
+
+########################################
+## <summary>
+##	Do not audit attempts to execute
+##	files in temporary filesystems.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain to not audit.
+##	</summary>
+## </param>
+#
+interface(`wm_dontaudit_exec_tmpfs_files',`
+	gen_require(`
+		type wm_tmpfs_t;
+	')
+
+	dontaudit $1 wm_tmpfs_t:file exec_file_perms;
+')

diff -pruN refpolicy-git-07122016-orig/policy/modules/contrib/wm.te refpolicy-git-07122016/policy/modules/contrib/wm.te
--- refpolicy-git-07122016-orig/policy/modules/contrib/wm.te

2016-10-29 16:29:19.762328008 +0200

+++ refpolicy-git-07122016/policy/modules/contrib/wm.te 2016
-12-08 17:57:40.843768477 +0100

policy/modules/contrib/wm.te +0 -0

@@ -10,6 +10,14 @@ attribute wm_domain;
 type wm_exec_t;
 corecmd_executable_file(wm_exec_t)
 

Quoted 11 lines

policy/modules/contrib/wm.te attribute wm_domain; · line 19

Quoted 9 lines

policy/modules/contrib/wm.te +7 -0

+type wm_tmp_t;
+typealias wm_tmp_t alias { user_wm_tmp_t staff_wm_tmp_t
 sysadm_wm_tmp_t };
+userdom_user_tmp_file(wm_tmp_t)
+
+type wm_tmpfs_t;
+typealias wm_tmpfs_t alias { user_wm_tmpfs_t staff_wm_tmpfs_t
 sysadm_wm_tmpfs_t };
+userdom_user_tmpfs_file(wm_tmpfs_t)

this is a pulseaudio_tmpfs_file()

I am not sure about that.

It works fine, so at the moment I can't see a reason to change it.

It is probably used to create libffi files and not pulseaudio files (that I expect to be created by the pulseaudio process). See below.

Quoted 45 lines

Quoted 45 lines

(quoted diff) +1 -0

+
 ########################################

#
# Common wm domain local policy

policy/modules/contrib/wm.te +20 -0

@@ -21,31 +29,60 @@ allow wm_domain self:netlink_kobject_uev
 allow wm_domain self:shm create_shm_perms;
 allow wm_domain self:unix_dgram_socket create_socket_perms;
 
+manage_dirs_pattern(wm_domain, wm_tmp_t, wm_tmp_t)
+manage_files_pattern(wm_domain, wm_tmp_t, wm_tmp_t)
+manage_lnk_files_pattern(wm_domain, wm_tmp_t, wm_tmp_t)
+files_tmp_filetrans(wm_domain, wm_tmp_t, { dir file lnk_file })
+
+manage_dirs_pattern(wm_domain, wm_tmpfs_t, wm_tmpfs_t)
+manage_files_pattern(wm_domain, wm_tmpfs_t, wm_tmpfs_t)
+manage_lnk_files_pattern(wm_domain, wm_tmpfs_t, wm_tmpfs_t)
+fs_tmpfs_filetrans(wm_domain, wm_tmpfs_t, { dir file lnk_file })
+
+can_exec(wm_domain, wm_exec_t)
+
 kernel_read_system_state(wm_domain)
 
 corecmd_getattr_all_executables(wm_domain)
 
+dev_read_rand(wm_domain)
 dev_read_sound(wm_domain)
 dev_read_sysfs(wm_domain)
 dev_read_urand(wm_domain)
+dev_rw_dri(wm_domain)
 dev_rw_wireless(wm_domain)
 dev_write_sound(wm_domain)
 
+files_read_etc_runtime_files(wm_domain)
 files_read_usr_files(wm_domain)
 
 fs_getattr_all_fs(wm_domain)
 
+kernel_read_fs_sysctls(wm_domain)
+kernel_read_proc_symlinks(wm_domain)
+kernel_read_sysctl(wm_domain)
+
 miscfiles_read_fonts(wm_domain)
+miscfiles_read_generic_certs(wm_domain)
 miscfiles_read_localization(wm_domain)
 

Quoted 6 lines

policy/modules/contrib/wm.te allow wm_domain self:netlink_kobject_uev · line 72

Quoted 4 lines

policy/modules/contrib/wm.te +4 -0

+udev_read_pid_files(wm_domain)
+
+# this is needed by gnome-shell
+userdom_exec_user_home_content_files(wm_domain)

What exactly is it executing here?

I think it is executing files generated by libffi.

Quoted 12 lines

Quoted 12 lines

policy/modules/contrib/wm.te +2 -0

+
 userdom_manage_user_tmp_sockets(wm_domain)
 userdom_tmp_filetrans_user_tmp(wm_domain, sock_file)
 userdom_user_runtime_filetrans_user_tmp(wm_domain, sock_file)
 
 userdom_manage_user_home_content_dirs(wm_domain)
 userdom_manage_user_home_content_files(wm_domain)
+
 userdom_user_home_dir_filetrans_user_home_content(wm_domain, { dir
 file })
 

Quoted 4 lines

policy/modules/contrib/wm.te allow wm_domain self:netlink_kobject_uev · line 84

Quoted 2 lines

policy/modules/contrib/wm.te +2 -0

+wm_dontaudit_exec_tmp_files(wm_domain)
+wm_dontaudit_exec_tmpfs_files(wm_domain)

why dontaudit the above? gnome-sheM

Quoted 100 lines

Quoted 100 lines

policy/modules/contrib/wm.te +1 -0

+
 optional_policy(`
 	accountsd_dbus_chat(wm_domain)

')

policy/modules/contrib/wm.te +36 -0

@@ -55,10 +92,42 @@ optional_policy(`
 ')		
 
 optional_policy(`
+	consolekit_dbus_chat(wm_domain)
+')
+
+optional_policy(`
 	devicekit_dbus_chat_power(wm_domain)
 ')
 
 optional_policy(`
+	evolution_dbus_chat(wm_domain)
+	evolution_alarm_dbus_chat(wm_domain)
+	evolution_domtrans(wm_domain)
+')
+
+optional_policy(`
+	games_dbus_chat(wm_domain)
+	games_domtrans(wm_domain)
+')
+
+optional_policy(`
+	java_domtrans(wm_domain)
+')
+
+optional_policy(`
+	mono_domtrans(wm_domain)
+')
+
+optional_policy(`
+	mozilla_domtrans(wm_domain)
+	mozilla_dbus_chat(wm_domain)
+')
+
+optional_policy(`
+	mplayer_domtrans(wm_domain)
+')
+
+optional_policy(`
 	networkmanager_dbus_chat(wm_domain)
 ')
 

@@ -71,5 +140,9 @@ optional_policy(`
 ')
 
 optional_policy(`
+	telepathy_mission_control_dbus_chat(wm_domain)
+')
+
+optional_policy(`
 	userhelper_exec_consolehelper(wm_domain)
 ')

diff -pruN refpolicy-git-07122016- orig/policy/modules/roles/staff.te refpolicy-git- 07122016/policy/modules/roles/staff.te
--- refpolicy-git-07122016-orig/policy/modules/roles/staff.te

2016-12-07 13:39:08.669449296 +0100

+++ refpolicy-git-07122016/policy/modules/roles/staff.te 201
6-12-08 15:47:40.140741170 +0100

policy/modules/roles/staff.te +1 -0

@@ -85,6 +85,7 @@ ifndef(`distro_redhat',`
 
 		optional_policy(`
 			gnome_role_template(staff, staff_r,
 staff_t)
+			wm_role_template(staff, staff_r, staff_t)
 		')
 

optional_policy(`
diff -pruN refpolicy-git-07122016- orig/policy/modules/roles/sysadm.te refpolicy-git- 07122016/policy/modules/roles/sysadm.te
--- refpolicy-git-07122016-orig/policy/modules/roles/sysadm.te

2016-12-07 13:39:08.669449296 +0100

+++ refpolicy-git-07122016/policy/modules/roles/sysadm.te 20
16-12-08 15:47:40.141741187 +0100

(quoted diff) +1 -0

@@ -1245,6 +1245,7 @@ ifndef(`distro_redhat',`
 
 		optional_policy(`
 			gnome_role_template(sysadm, sysadm_r,
 sysadm_t)
+			wm_role_template(sysadm, sysadm_r,
 sysadm_t)
 		')

')

diff -pruN refpolicy-git-07122016- orig/policy/modules/roles/unprivuser.te refpolicy-git- 07122016/policy/modules/roles/unprivuser.te
--- refpolicy-git-07122016-orig/policy/modules/roles/unprivuser.te

2016-12-07 13:39:08.669449296 +0100
+++ refpolicy-git-07122016/policy/modules/roles/unprivuser.te	
2016-12-08 15:47:40.141741187 +0100

(quoted diff) +0 -0

@@ -54,6 +54,7 @@ ifndef(`distro_redhat',`
 

Quoted 6 lines

policy/modules/roles/unprivuser.te ifndef(`distro_redhat',` · line 60

Quoted 6 lines

policy/modules/roles/unprivuser.te +1 -0

 		optional_policy(`
 			gnome_role_template(user, user_r, user_t)
+			wm_role_template(user, user_r, user_t)
 		')
 
 		optional_policy(`

Guido

_______________________________________________
refpolicy mailing list
refpolicy at oss.tresys.com
http://oss.tresys.com/mailman/listinfo/refpolicy

Quoted 20 lines · Guido Trentalancia via refpolicy

Quoted 17 lines · Dominick Grift via refpolicy

i

Quoted 14 lines · Guido Trentalancia via refpolicy

Enable the window manager role (wm contrib module) and update the module to work with gnome-shell.

This second version introduces better integration with common desktop applications and requires the following recently posted patch for the games module:

[PATCH 1/2] games: general update and improved pulseaudio integration
http://oss.tresys.com/pipermail/refpolicy/2016-December/008650.
html

Quoted 9 lines

Quoted 3 lines

Quoted 1 line

This patch might need some more testing.

Yes, i dont think this should be merged.

It needs to be tested with other window managers.

Have you found any actual limitation with the old gnome (gnome- panel/metacity), kde or others ?

It is hard to explain but consider some of this stuff. gnome-shell connects to http ports, gnome-shell needs to be able to run programs on
behalf of the calling user (ALT-f2), gnome-shell is a pulseaudio client,
gnome-shell needs comms with: bluetooth, accountsd, geoclue, upower,
logind: all things that a normal windows manager does not need.

Not to mention that gnome requires permissions that are specific to wayland compositors

Quoted 8 lines

Quoted 8 lines

Also gnome-shell is a wm but its not every wm needs the permissions
that
gnome-shell needs. We should either give gnome-shell its own domain
or
add the gnome-shell specific rules to a tunable.

Quoted 8 lines

Quoted 5 lines

For example: gnome-shell is a wayland compositor. but there are many
more things that gnome shell needs that a "normal" window manager should
never need.

The permissions that have been added are very general and harmless.?

For now maybe because the policy is not comprehensive

Quoted 62 lines

Quoted 44 lines

Quoted 44 lines

?policy/modules/contrib/pulseaudio.if |???19 +++++++++ ?policy/modules/contrib/wm.if?????????|???44
+++++++++++++++++++++
?policy/modules/contrib/wm.te?????????|???73
+++++++++++++++++++++++++++++++++++
?policy/modules/roles/staff.te????????|????1 ?policy/modules/roles/sysadm.te???????|????1 ?policy/modules/roles/unprivuser.te??|????1 ?6 files changed, 139 insertions(+)

diff -pruN refpolicy-git-07122016- orig/policy/modules/contrib/pulseaudio.if refpolicy-git- 07122016/policy/modules/contrib/pulseaudio.if
--- refpolicy-git-07122016-
orig/policy/modules/contrib/pulseaudio.if 2016-09-27
16:28:51.964139648 +0200
+++ refpolicy-git-07122016/policy/modules/contrib/pulseaudio.if

2016-12-08 15:47:40.117740787 +0100

(quoted diff) +0 -0

@@ -424,3 +424,22 @@ interface(`pulseaudio_rw_tmpfs_files',`
 ?	fs_search_tmpfs($1)
 ?	rw_files_pattern($1, pulseaudio_tmpfs_t,
 pulseaudio_tmpfs_t)

?')

policy/modules/contrib/pulseaudio.if +17 -0

+
+#######################################
+## <summary>
+##	Manage pulseaudio tmpfs files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`pulseaudio_manage_tmpfs_files',`
+	gen_require(`
+		type pulseaudio_tmpfs_t;
+	')
+
+	fs_search_tmpfs($1)

Quoted 8 lines

Quoted 3 lines

(quoted diff) +1 -0

+	manage_files_pattern($1, pulseaudio_tmpfs_t,

pulseaudio_tmpfs_t)
+')

does not make sense, and i would like to know what prompted you to
add
this (preferably backed with avc denials)

It's needed to unlink them. Probably stale files from previous sessions.

Quoted 5 lines

wm should is a pulseaudio_client and pulseaudio_client can already rw
and delete pulseaudio_tmpfs_files. It should not need more than that.

Quoted 5 lines

I decided to avoid using the pulseaudio_client attribute because it implies other unneeded permissions, including corenet permissions that
are quite undesirable.

Those permissions aren't unneeded. They should be conditional maybe but
there are configurations where clients may want to connect to pulseaudio
via the network.

Quoted 45 lines

Quoted 36 lines

Quoted 36 lines

diff -pruN refpolicy-git-07122016- orig/policy/modules/contrib/wm.if? refpolicy-git-07122016/policy/modules/contrib/wm.if --- refpolicy-git-07122016-orig/policy/modules/contrib/wm.if

2016-08-14 21:28:11.597521187 +0200

+++ refpolicy-git-07122016/policy/modules/contrib/wm.if 2016
-12-08 15:47:40.118740804 +0100

(quoted diff) +0 -0

@@ -47,6 +47,8 @@ template(`wm_role_template',`

? # Policy
? #
?

policy/modules/contrib/wm.if +2 -0

+	allow $3 $1_wm_t:fd use;
+

? allow $1_wm_t $3:unix_stream_socket connectto;
? allow $3 $1_wm_t:unix_stream_socket connectto;
?

(quoted diff) +0 -0

@@ -72,6 +74,7 @@ template(`wm_role_template',`
 ?	xserver_manage_core_devices($1_wm_t)

?
? optional_policy(`

policy/modules/contrib/wm.if +1 -0

+		dbus_connect_spec_session_bus($1, $1_wm_t)

? dbus_spec_session_bus_client($1, $1_wm_t)
? dbus_system_bus_client($1_wm_t)
?

(quoted diff) +0 -0

@@ -81,11 +84,14 @@ template(`wm_role_template',`
 ?	')

?
? optional_policy(`

policy/modules/contrib/wm.if +1 -0

+		gnome_dbus_chat_gkeyringd($1, $1_wm_t)

? gnome_stream_connect_gkeyringd($1, $1_wm_t)
? ')
?

Quoted 8 lines

policy/modules/contrib/wm.if template(`wm_role_template',` · line 94

Quoted 4 lines

? optional_policy(`
? pulseaudio_run($1_wm_t, $2)

policy/modules/contrib/wm.if +2 -0

+		pulseaudio_manage_tmpfs_files($1_wm_t)
+		pulseaudio_use_fds($1_wm_t)

these shouldnt be needed. what prompted you to add these? (preferably
show avc denials)

Quoted 1 line

See above. Stale files need to be unlinked.

That is a bug here then:

https://github.com/TresysTechnology/refpolicy-contrib/blob/master/pul
seaudio.te#L241

clients should then also be able to delete pulseaudio tmpfs files

Quoted 73 lines

Quoted 64 lines

Quoted 64 lines

? ')
?')
?

policy/modules/contrib/wm.if +38 -0

@@ -134,3 +140,41 @@ interface(`wm_dbus_chat',`
 ?	allow $2 $1_wm_t:dbus send_msg;
 ?	allow $1_wm_t $2:dbus send_msg;
 ?')
+
+########################################
+## <summary>
+##	Do not audit attempts to execute
+##	files in temporary directories.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain to not audit.
+##	</summary>
+## </param>
+#
+interface(`wm_dontaudit_exec_tmp_files',`
+	gen_require(`
+		type wm_tmp_t;
+	')
+
+	dontaudit $1 wm_tmp_t:file exec_file_perms;
+')
+
+########################################
+## <summary>
+##	Do not audit attempts to execute
+##	files in temporary filesystems.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain to not audit.
+##	</summary>
+## </param>
+#
+interface(`wm_dontaudit_exec_tmpfs_files',`
+	gen_require(`
+		type wm_tmpfs_t;
+	')
+
+	dontaudit $1 wm_tmpfs_t:file exec_file_perms;
+')

diff -pruN refpolicy-git-07122016- orig/policy/modules/contrib/wm.te? refpolicy-git-07122016/policy/modules/contrib/wm.te --- refpolicy-git-07122016-orig/policy/modules/contrib/wm.te

2016-10-29 16:29:19.762328008 +0200

+++ refpolicy-git-07122016/policy/modules/contrib/wm.te 2016
-12-08 17:57:40.843768477 +0100

(quoted diff) +0 -0

@@ -10,6 +10,14 @@ attribute wm_domain;
 ?type wm_exec_t;
 ?corecmd_executable_file(wm_exec_t)

?

(quoted diff) +2 -0

+type wm_tmp_t;
+typealias wm_tmp_t alias { user_wm_tmp_t staff_wm_tmp_t

sysadm_wm_tmp_t };

Quoted 8 lines

Quoted 6 lines

policy/modules/contrib/wm.te +4 -0

+userdom_user_tmp_file(wm_tmp_t)
+
+type wm_tmpfs_t;
+typealias wm_tmpfs_t alias { user_wm_tmpfs_t staff_wm_tmpfs_t

sysadm_wm_tmpfs_t };
+userdom_user_tmpfs_file(wm_tmpfs_t)

this is a pulseaudio_tmpfs_file()

Quoted 7 lines

I am not sure about that.

It works fine, so at the moment I can't see a reason to change it.

It is probably used to create libffi files and not pulseaudio files (that I expect to be created by the pulseaudio process). See below.

All pulseaudio clients need to be able to read/write/unlink eachother tmpfs files.

Quoted 57 lines

Quoted 56 lines

Quoted 50 lines

+
?########################################
?#
?# Common wm domain local policy

(quoted diff) +0 -0

@@ -21,31 +29,60 @@ allow wm_domain self:netlink_kobject_uev
 ?allow wm_domain self:shm create_shm_perms;
 ?allow wm_domain self:unix_dgram_socket create_socket_perms;

?

policy/modules/contrib/wm.te +4 -0

+manage_dirs_pattern(wm_domain, wm_tmp_t, wm_tmp_t)
+manage_files_pattern(wm_domain, wm_tmp_t, wm_tmp_t)
+manage_lnk_files_pattern(wm_domain, wm_tmp_t, wm_tmp_t)
+files_tmp_filetrans(wm_domain, wm_tmp_t, { dir file lnk_file

})

policy/modules/contrib/wm.te +5 -0

+
+manage_dirs_pattern(wm_domain, wm_tmpfs_t, wm_tmpfs_t)
+manage_files_pattern(wm_domain, wm_tmpfs_t, wm_tmpfs_t)
+manage_lnk_files_pattern(wm_domain, wm_tmpfs_t, wm_tmpfs_t)
+fs_tmpfs_filetrans(wm_domain, wm_tmpfs_t, { dir file lnk_file

})

policy/modules/contrib/wm.te +3 -0

+
+can_exec(wm_domain, wm_exec_t)
+

?kernel_read_system_state(wm_domain)
?
?corecmd_getattr_all_executables(wm_domain)
?
+dev_read_rand(wm_domain)
?dev_read_sound(wm_domain)
?dev_read_sysfs(wm_domain)
?dev_read_urand(wm_domain)
+dev_rw_dri(wm_domain)
?dev_rw_wireless(wm_domain)
?dev_write_sound(wm_domain)
?
+files_read_etc_runtime_files(wm_domain)
?files_read_usr_files(wm_domain)
?
?fs_getattr_all_fs(wm_domain)
?

policy/modules/contrib/wm.te +4 -0

+kernel_read_fs_sysctls(wm_domain)
+kernel_read_proc_symlinks(wm_domain)
+kernel_read_sysctl(wm_domain)
+

?miscfiles_read_fonts(wm_domain)
+miscfiles_read_generic_certs(wm_domain)
?miscfiles_read_localization(wm_domain)
?

policy/modules/contrib/wm.te allow wm_domain self:netlink_kobject_uev · line 72

Quoted 4 lines

policy/modules/contrib/wm.te +4 -0

+udev_read_pid_files(wm_domain)
+
+# this is needed by gnome-shell
+userdom_exec_user_home_content_files(wm_domain)

What exactly is it executing here?

Quoted 1 line

I think it is executing files generated by libffi.

and how do those files end up in $HOME, maybe because you're blocking access to tmp (XDG_RUNTIME_DIR)?

/run/user/UID is first choice

Quoted 8 lines

Quoted 8 lines

Quoted 8 lines

+
?userdom_manage_user_tmp_sockets(wm_domain) ?userdom_tmp_filetrans_user_tmp(wm_domain, sock_file) ?userdom_user_runtime_filetrans_user_tmp(wm_domain, sock_file) ?
?userdom_manage_user_home_content_dirs(wm_domain) ?userdom_manage_user_home_content_files(wm_domain)
+

Quoted 8 lines

Quoted 8 lines

policy/modules/contrib/wm.te allow wm_domain self:netlink_kobject_uev · line 84

Quoted 6 lines

?userdom_user_home_dir_filetrans_user_home_content(wm_domain, { dir
file })
?

policy/modules/contrib/wm.te +2 -0

+wm_dontaudit_exec_tmp_files(wm_domain)
+wm_dontaudit_exec_tmpfs_files(wm_domain)

why dontaudit the above? gnome-sheM

These files are probably initially created in $CDG_RUNTIME_DIR which is
the best place. However if you block that then it falls back to ~/.cache
(which is second best)

Quoted 106 lines

Quoted 106 lines

Quoted 106 lines

+
?optional_policy(`
? accountsd_dbus_chat(wm_domain)
?')

(quoted diff) +0 -0

@@ -55,10 +92,42 @@ optional_policy(`
 ?')		

?
?optional_policy(`

policy/modules/contrib/wm.te +4 -0

+	consolekit_dbus_chat(wm_domain)
+')
+
+optional_policy(`

? devicekit_dbus_chat_power(wm_domain)
?')
?
?optional_policy(`

policy/modules/contrib/wm.te +28 -0

+	evolution_dbus_chat(wm_domain)
+	evolution_alarm_dbus_chat(wm_domain)
+	evolution_domtrans(wm_domain)
+')
+
+optional_policy(`
+	games_dbus_chat(wm_domain)
+	games_domtrans(wm_domain)
+')
+
+optional_policy(`
+	java_domtrans(wm_domain)
+')
+
+optional_policy(`
+	mono_domtrans(wm_domain)
+')
+
+optional_policy(`
+	mozilla_domtrans(wm_domain)
+	mozilla_dbus_chat(wm_domain)
+')
+
+optional_policy(`
+	mplayer_domtrans(wm_domain)
+')
+
+optional_policy(`

? networkmanager_dbus_chat(wm_domain)
?')
?

(quoted diff) +0 -0

@@ -71,5 +140,9 @@ optional_policy(`
 ?')

?
?optional_policy(`

policy/modules/contrib/wm.te +4 -0

+	telepathy_mission_control_dbus_chat(wm_domain)
+')
+
+optional_policy(`

? userhelper_exec_consolehelper(wm_domain)
?')
diff -pruN refpolicy-git-07122016- orig/policy/modules/roles/staff.te refpolicy-git- 07122016/policy/modules/roles/staff.te
--- refpolicy-git-07122016-orig/policy/modules/roles/staff.te

2016-12-07 13:39:08.669449296 +0100

+++ refpolicy-git-07122016/policy/modules/roles/staff.te 201
6-12-08 15:47:40.140741170 +0100

(quoted diff) +0 -0

@@ -85,6 +85,7 @@ ifndef(`distro_redhat',`

?
? optional_policy(`
? gnome_role_template(staff, staff_r,
staff_t)

(quoted diff) +1 -0

+			wm_role_template(staff, staff_r,

staff_t)
? ')
?
? optional_policy(`
diff -pruN refpolicy-git-07122016- orig/policy/modules/roles/sysadm.te refpolicy-git- 07122016/policy/modules/roles/sysadm.te
--- refpolicy-git-07122016-orig/policy/modules/roles/sysadm.te

2016-12-07 13:39:08.669449296 +0100

+++ refpolicy-git-07122016/policy/modules/roles/sysadm.te 20
16-12-08 15:47:40.141741187 +0100

(quoted diff) +0 -0

@@ -1245,6 +1245,7 @@ ifndef(`distro_redhat',`

?
? optional_policy(`
? gnome_role_template(sysadm, sysadm_r,
sysadm_t)

(quoted diff) +1 -0

+			wm_role_template(sysadm, sysadm_r,

sysadm_t)
? ')
? ')
?
diff -pruN refpolicy-git-07122016- orig/policy/modules/roles/unprivuser.te refpolicy-git- 07122016/policy/modules/roles/unprivuser.te --- refpolicy-git-07122016- orig/policy/modules/roles/unprivuser.te

2016-12-07 13:39:08.669449296 +0100
+++ refpolicy-git-07122016/policy/modules/roles/unprivuser.te	
2016-12-08 15:47:40.141741187 +0100

(quoted diff) +0 -0

@@ -54,6 +54,7 @@ ifndef(`distro_redhat',`

Quoted 8 lines

Quoted 8 lines

Quoted 8 lines

?
? optional_policy(`
? gnome_role_template(user, user_r,
user_t)

policy/modules/roles/unprivuser.te +1 -0

+			wm_role_template(user, user_r, user_t)

? ')
?
? optional_policy(`

Enable the window manager role (wm contrib module) and update the module to work with gnome-shell.

This second version introduces better integration with common desktop applications and requires the following recently posted patch for the games module:

[PATCH v3 1/2] games: general update and improved pulseaudio integration
http://oss.tresys.com/pipermail/refpolicy/2016-December/008679.html

This patch might need some more testing (I have received no feedback yet).

Signed-off-by Guido Trentalancia <[email protected]>

---
 policy/modules/contrib/wm.if       |   42 ++++++++++++++++++++
 policy/modules/contrib/wm.te       |   75 ++++++++++++++++++++++++++++++++++++-
 policy/modules/roles/staff.te      |    1
 policy/modules/roles/sysadm.te     |    1
 policy/modules/roles/unprivuser.te |    1
 5 files changed, 119 insertions(+), 1 deletion(-)

diff -pruN refpolicy-git-07122016-orig/policy/modules/roles/staff.te refpolicy-git-07122016/policy/modules/roles/staff.te

policy/modules/roles/staff.te +1 -0

@@ -85,6 +85,7 @@ ifndef(`distro_redhat',`
 
 		optional_policy(`
 			gnome_role_template(staff, staff_r, staff_t)
+			wm_role_template(staff, staff_r, staff_t)
 		')
 
 		optional_policy(`

diff -pruN refpolicy-git-07122016-orig/policy/modules/roles/sysadm.te refpolicy-git-07122016/policy/modules/roles/sysadm.te

policy/modules/roles/sysadm.te +1 -0

@@ -1245,6 +1245,7 @@ ifndef(`distro_redhat',`
 
 		optional_policy(`
 			gnome_role_template(sysadm, sysadm_r, sysadm_t)
+			wm_role_template(sysadm, sysadm_r, sysadm_t)
 		')
 	')
 

diff -pruN refpolicy-git-07122016-orig/policy/modules/roles/unprivuser.te refpolicy-git-07122016/policy/modules/roles/unprivuser.te

Quoted 24 lines · Guido Trentalancia via refpolicy

Enable the window manager role (wm contrib module) and update the module to work with gnome-shell.

This second version introduces better integration with common desktop applications and requires the following recently posted patch for the games module:

[PATCH v3 1/2] games: general update and improved pulseaudio integration
http://oss.tresys.com/pipermail/refpolicy/2016-December/008679.html

This patch might need some more testing (I have received no feedback yet).

Signed-off-by Guido Trentalancia <[email protected]>

---
?policy/modules/contrib/wm.if???????|???42 ++++++++++++++++++++ ?policy/modules/contrib/wm.te???????|???75
++++++++++++++++++++++++++++++++++++-

?policy/modules/roles/staff.te??????|????1
?policy/modules/roles/sysadm.te?????|????1
?policy/modules/roles/unprivuser.te |????1

?5 files changed, 119 insertions(+), 1 deletion(-)

[...]

Quoted 43 lines

diff -pruN refpolicy-git-07122016- orig/policy/modules/roles/staff.te refpolicy-git- 07122016/policy/modules/roles/staff.te
--- refpolicy-git-07122016-orig/policy/modules/roles/staff.te

2016-12-07 13:39:08.669449296 +0100

+++ refpolicy-git-07122016/policy/modules/roles/staff.te 201
6-12-08 22:25:26.327711806 +0100

(quoted diff) +0 -0

@@ -85,6 +85,7 @@ ifndef(`distro_redhat',`
 

? optional_policy(`
? gnome_role_template(staff, staff_r,
staff_t)

policy/modules/roles/staff.te +1 -0

+			wm_role_template(staff, staff_r, staff_t)

? ')

? optional_policy(`
diff -pruN refpolicy-git-07122016- orig/policy/modules/roles/sysadm.te refpolicy-git- 07122016/policy/modules/roles/sysadm.te
--- refpolicy-git-07122016-orig/policy/modules/roles/sysadm.te

2016-12-07 13:39:08.669449296 +0100

+++ refpolicy-git-07122016/policy/modules/roles/sysadm.te 20
16-12-08 22:25:26.343712120 +0100

(quoted diff) +0 -0

@@ -1245,6 +1245,7 @@ ifndef(`distro_redhat',`
 

? optional_policy(`
? gnome_role_template(sysadm, sysadm_r,
sysadm_t)

(quoted diff) +1 -0

+			wm_role_template(sysadm, sysadm_r,

sysadm_t)
? ')
? ')

diff -pruN refpolicy-git-07122016- orig/policy/modules/roles/unprivuser.te refpolicy-git- 07122016/policy/modules/roles/unprivuser.te
--- refpolicy-git-07122016-orig/policy/modules/roles/unprivuser.te

2016-12-07 13:39:08.669449296 +0100
+++ refpolicy-git-07122016/policy/modules/roles/unprivuser.te	
2016-12-08 22:25:26.344712139 +0100

(quoted diff) +0 -0

@@ -54,6 +54,7 @@ ifndef(`distro_redhat',`
 

Quoted 4 lines

? optional_policy(`
? gnome_role_template(user, user_r, user_t)

policy/modules/roles/unprivuser.te +1 -0

+			wm_role_template(user, user_r, user_t)

? ')

So this change is essentially saying is you can't use the gnome policy?
without the wm module.??Is that really the case???It seems like they? would be separate optionals.

Quoted 71 lines · Chris PeBenito

Quoted 24 lines · Guido Trentalancia via refpolicy

Enable the window manager role (wm contrib module) and update the module to work with gnome-shell.

This second version introduces better integration with common desktop applications and requires the following recently posted patch for the games module:

[PATCH v3 1/2] games: general update and improved pulseaudio integration
http://oss.tresys.com/pipermail/refpolicy/2016-December/008679.html

This patch might need some more testing (I have received no feedback yet).

Signed-off-by Guido Trentalancia <[email protected]>

---
 policy/modules/contrib/wm.if       |   42 ++++++++++++++++++++
 policy/modules/contrib/wm.te       |   75
++++++++++++++++++++++++++++++++++++-
 policy/modules/roles/staff.te      |    1
 policy/modules/roles/sysadm.te     |    1
 policy/modules/roles/unprivuser.te |    1
 5 files changed, 119 insertions(+), 1 deletion(-)

[...]

Quoted 43 lines

diff -pruN refpolicy-git-07122016- orig/policy/modules/roles/staff.te refpolicy-git- 07122016/policy/modules/roles/staff.te
--- refpolicy-git-07122016-orig/policy/modules/roles/staff.te

2016-12-07 13:39:08.669449296 +0100

+++ refpolicy-git-07122016/policy/modules/roles/staff.te 201
6-12-08 22:25:26.327711806 +0100

policy/modules/roles/staff.te +1 -0

@@ -85,6 +85,7 @@ ifndef(`distro_redhat',`
 
 		optional_policy(`
 			gnome_role_template(staff, staff_r,
 staff_t)
+			wm_role_template(staff, staff_r, staff_t)
 		')
 

optional_policy(`
diff -pruN refpolicy-git-07122016- orig/policy/modules/roles/sysadm.te refpolicy-git- 07122016/policy/modules/roles/sysadm.te
--- refpolicy-git-07122016-orig/policy/modules/roles/sysadm.te

2016-12-07 13:39:08.669449296 +0100

+++ refpolicy-git-07122016/policy/modules/roles/sysadm.te 20
16-12-08 22:25:26.343712120 +0100

(quoted diff) +1 -0

@@ -1245,6 +1245,7 @@ ifndef(`distro_redhat',`
 
 		optional_policy(`
 			gnome_role_template(sysadm, sysadm_r,
 sysadm_t)
+			wm_role_template(sysadm, sysadm_r,
 sysadm_t)
 		')

')

diff -pruN refpolicy-git-07122016- orig/policy/modules/roles/unprivuser.te refpolicy-git- 07122016/policy/modules/roles/unprivuser.te
--- refpolicy-git-07122016-orig/policy/modules/roles/unprivuser.te

2016-12-07 13:39:08.669449296 +0100
+++ refpolicy-git-07122016/policy/modules/roles/unprivuser.te	
2016-12-08 22:25:26.344712139 +0100

(quoted diff) +0 -0

@@ -54,6 +54,7 @@ ifndef(`distro_redhat',`
 

Quoted 9 lines

policy/modules/roles/unprivuser.te ifndef(`distro_redhat',` · line 58

Quoted 4 lines

policy/modules/roles/unprivuser.te +1 -0

 		optional_policy(`
 			gnome_role_template(user, user_r, user_t)
+			wm_role_template(user, user_r, user_t)
 		')

So this change is essentially saying is you can't use the gnome policy
without the wm module. Is that really the case? It seems like they would be separate optionals.

It's preferable to have a confined window manager, instead of one

running in the user domain and that is therefore more easily exploited.

That's the meaning of this patch.

However, I understand we should make sure it works with all window managers, so I am actually seeking help to test it with window managers other than gnome-shell.

Because at the moment, the patch is only tested with gnome-shell (to be honest, not even with gnome-panel/metacity because of a lack of time), I do not suggest (yet) making them separate optionals. That would mandate a confined window manager even for setups that have not been tested yet.

Quoted 93 lines · Guido Trentalancia via refpolicy

Quoted 79 lines · Chris PeBenito

Quoted 26 lines · Guido Trentalancia via refpolicy

Enable the window manager role (wm contrib module) and update the module to work with gnome-shell.

This second version introduces better integration with common desktop applications and requires the following recently posted patch for the games module:

[PATCH v3 1/2] games: general update and improved pulseaudio integration
http://oss.tresys.com/pipermail/refpolicy/2016-December/008679.
html

This patch might need some more testing (I have received no feedback yet).

Signed-off-by Guido Trentalancia <[email protected]>

---
?policy/modules/contrib/wm.if???????|???42 ++++++++++++++++++++ ?policy/modules/contrib/wm.te???????|???75
++++++++++++++++++++++++++++++++++++-

?policy/modules/roles/staff.te??????|????1
?policy/modules/roles/sysadm.te?????|????1
?policy/modules/roles/unprivuser.te |????1

?5 files changed, 119 insertions(+), 1 deletion(-)

[...]

Quoted 48 lines

diff -pruN refpolicy-git-07122016- orig/policy/modules/roles/staff.te refpolicy-git- 07122016/policy/modules/roles/staff.te
--- refpolicy-git-07122016-orig/policy/modules/roles/staff.te

2016-12-07 13:39:08.669449296 +0100

+++ refpolicy-git-07122016/policy/modules/roles/staff.te 201
6-12-08 22:25:26.327711806 +0100

(quoted diff) +0 -0

@@ -85,6 +85,7 @@ ifndef(`distro_redhat',`
 

? optional_policy(`
? gnome_role_template(staff, staff_r,
staff_t)

(quoted diff) +1 -0

+			wm_role_template(staff, staff_r,

staff_t)
? ')

? optional_policy(`
diff -pruN refpolicy-git-07122016- orig/policy/modules/roles/sysadm.te refpolicy-git- 07122016/policy/modules/roles/sysadm.te
--- refpolicy-git-07122016-orig/policy/modules/roles/sysadm.te

2016-12-07 13:39:08.669449296 +0100

+++ refpolicy-git-07122016/policy/modules/roles/sysadm.te 20
16-12-08 22:25:26.343712120 +0100

(quoted diff) +0 -0

@@ -1245,6 +1245,7 @@ ifndef(`distro_redhat',`
 

? optional_policy(`
? gnome_role_template(sysadm, sysadm_r,
sysadm_t)

(quoted diff) +1 -0

+			wm_role_template(sysadm, sysadm_r,

sysadm_t)
? ')
? ')

diff -pruN refpolicy-git-07122016- orig/policy/modules/roles/unprivuser.te refpolicy-git- 07122016/policy/modules/roles/unprivuser.te --- refpolicy-git-07122016- orig/policy/modules/roles/unprivuser.te

2016-12-07 13:39:08.669449296 +0100
+++ refpolicy-git-07122016/policy/modules/roles/unprivuser.te	
2016-12-08 22:25:26.344712139 +0100

(quoted diff) +0 -0

@@ -54,6 +54,7 @@ ifndef(`distro_redhat',`
 

Quoted 11 lines

Quoted 5 lines

? optional_policy(`
? gnome_role_template(user, user_r,
user_t)

policy/modules/roles/unprivuser.te +1 -0

+			wm_role_template(user, user_r, user_t)

? ')

So this change is essentially saying is you can't use the gnome policy
without the wm module.??Is that really the case???It seems like they
would be separate optionals.

Quoted 1 line

It's preferable to have a confined window manager, instead of one

In this case, I'd emphasize "preferable" here.??It's not for everyone.

Quoted 5 lines

running in the user domain and that is therefore more easily exploited.

That's the meaning of this patch.

?>

Quoted 6 lines

However, I understand we should make sure it works with all window managers, so I am actually seeking help to test it with window managers
other than gnome-shell.

Quoted 8 lines

Because at the moment, the patch is only tested with gnome-shell (to be
honest, not even with gnome-panel/metacity because of a lack of time),
I do not suggest (yet) making them separate optionals. That would mandate a confined window manager even for setups that have not been
tested yet.

I don't understand how making separate optionals mandates a confined? window manager.??It does the reverse.

Quoted 2 lines

I don't understand how making separate optionals mandates a confined window manager.??It does the reverse.

As it is, the wm role should be enabled only if the dbus and gnome modules are loaded.

On 14 Dec 2016 09:54, "Guido Trentalancia via refpolicy" <refpolicy@o ss.tresys.com> wrote:
Enable the window manager role (wm contrib module) and update the module to work with gnome-shell.

This patch requires the following recently posted patch for the games module:

[PATCH v3 1/2] games: general update and improved pulseaudio integration
http://oss.tresys.com/pipermail/refpolicy/2016-December/008679.html

This patch has received some testing with the following two configurations:
- gnome-shell executing in normal mode (with display managers other than gdm, such as xdm from XOrg);
- gnome-shell executing in gdm mode (with the Gnome Display Manager).

Patches 3/5, 4/5 and 5/5 are needed when gnome-shell is used in conjunction with gdm.

Since the window managers are not limited by gnome-shell, this latter version of the patch (along with part 2/5) uses separate optional conditionals for the gnome and wm role templates.

Signed-off-by Guido Trentalancia <[email protected]>

---

?policy/modules/contrib/colord.te? ?|? ? 5 ++
?policy/modules/contrib/dbus.te? ? ?|? ? 5 ++
?policy/modules/contrib/wm.if? ? ? ?|? ?43 +++++++++++++++++-
?policy/modules/contrib/wm.te? ? ? ?|? ?88
++++++++++++++++++++++++++++++++++++-
?policy/modules/roles/staff.te? ? ? |? ? 8 ++-
?policy/modules/roles/sysadm.te? ? ?|? ? 4 +
?policy/modules/roles/unprivuser.te |? ? 8 ++-

?7 files changed, 155 insertions(+), 6 deletions(-)

diff -pruN refpolicy-git-07122016- orig/policy/modules/contrib/colord.te refpolicy-git- 07122016/policy/modules/contrib/colord.te
--- refpolicy-git-07122016-orig/policy/modules/contrib/colord.te? ? ? ? 2016-08-14 21:28:11.468519205 +0200
+++ refpolicy-git-07122016/policy/modules/contrib/colord.te? ? ?2016- 12-14 02:45:54.815580399 +0100

First off, can you use git format patch and git send email because refpolicy has contrib as a submodule and the way you've sent it won't apply.?

(quoted diff) +5 -0

@@ -137,3 +137,8 @@ optional_policy(`
 ? ? ? ? udev_read_db(colord_t)
 ? ? ? ? udev_read_pid_files(colord_t)
 ?')
+
+optional_policy(`
+? ? ? ?xserver_read_xdm_lib_files(colord_t)
+? ? ? ?xserver_use_xdm_fds(colord_t)
+')

diff -pruN refpolicy-git-07122016-orig/policy/modules/contrib/dbus.te refpolicy-git-07122016/policy/modules/contrib/dbus.te
--- refpolicy-git-07122016-orig/policy/modules/contrib/dbus.te? 2016- 08-14 21:28:11.477519343 +0200
+++ refpolicy-git-07122016/policy/modules/contrib/dbus.te? ? ? ?2016- 12-14 02:24:00.796768671 +0100

policy/modules/contrib/dbus.te +5 -0

@@ -159,6 +159,11 @@ optional_policy(`
 ? ? ? ? udev_read_db(system_dbusd_t)
 ?')
 
+optional_policy(`
+? ? ? ?xserver_read_xdm_lib_files(system_dbusd_t)
+? ? ? ?xserver_use_xdm_fds(system_dbusd_t)
+')
+

?########################################
?#
?# Common session bus local policy
diff -pruN refpolicy-git-07122016-orig/policy/modules/contrib/wm.if refpolicy-git-07122016/policy/modules/contrib/wm.if
--- refpolicy-git-07122016-orig/policy/modules/contrib/wm.if? ? 2016- 12-14 02:24:53.377000472 +0100
+++ refpolicy-git-07122016/policy/modules/contrib/wm.if 2016-12-13 22:53:54.445212825 +0100

(quoted diff) +0 -0

@@ -47,6 +47,8 @@ template(`wm_role_template',`

? ? ? ? # Policy
? ? ? ? #

+? ? ? ?allow $3 $1_wm_t:fd use;
+
? ? ? ? allow $1_wm_t $3:unix_stream_socket connectto; ? ? ? ? allow $3 $1_wm_t:unix_stream_socket connectto;

(quoted diff) +0 -0

@@ -72,6 +74,7 @@ template(`wm_role_template',`
 ? ? ? ? xserver_manage_core_devices($1_wm_t)
 

? ? ? ? optional_policy(`
+? ? ? ? ? ? ? ?dbus_connect_spec_session_bus($1, $1_wm_t) ? ? ? ? ? ? ? ? dbus_spec_session_bus_client($1, $1_wm_t) ? ? ? ? ? ? ? ? dbus_system_bus_client($1_wm_t)

(quoted diff) +0 -0

@@ -81,7 +84,7 @@ template(`wm_role_template',`
 ? ? ? ? ')
 

? ? ? ? optional_policy(`
-? ? ? ? ? ? ? ?gnome_stream_connect_gkeyringd($1, $1_wm_t) +? ? ? ? ? ? ? ?gnome_stream_connect_all_gkeyringd($1_wm_t) ? ? ? ? ')

? ? ? ? optional_policy(`

(quoted diff) +38 -0

@@ -134,3 +137,41 @@ interface(`wm_dbus_chat',`
 ? ? ? ? allow $2 $1_wm_t:dbus send_msg;
 ? ? ? ? allow $1_wm_t $2:dbus send_msg;
 ?')
+
+########################################
+## <summary>
+##? ? ?Do not audit attempts to execute
+##? ? ?files in temporary directories.
+## </summary>
+## <param name="domain">
+##? ? ?<summary>
+##? ? ?Domain to not audit.
+##? ? ?</summary>
+## </param>
+#
+interface(`wm_dontaudit_exec_tmp_files',`
+? ? ? ?gen_require(`
+? ? ? ? ? ? ? ?type wm_tmp_t;
+? ? ? ?')
+
+? ? ? ?dontaudit $1 wm_tmp_t:file exec_file_perms;
+')
+
+########################################
+## <summary>
+##? ? ?Do not audit attempts to execute
+##? ? ?files in temporary filesystems.
+## </summary>
+## <param name="domain">
+##? ? ?<summary>
+##? ? ?Domain to not audit.
+##? ? ?</summary>
+## </param>
+#
+interface(`wm_dontaudit_exec_tmpfs_files',`
+? ? ? ?gen_require(`
+? ? ? ? ? ? ? ?type wm_tmpfs_t;
+? ? ? ?')
+
+? ? ? ?dontaudit $1 wm_tmpfs_t:file exec_file_perms;
+')

diff -pruN refpolicy-git-07122016-orig/policy/modules/contrib/wm.te refpolicy-git-07122016/policy/modules/contrib/wm.te
--- refpolicy-git-07122016-orig/policy/modules/contrib/wm.te? ? 2016- 12-14 02:24:53.396000918 +0100
+++ refpolicy-git-07122016/policy/modules/contrib/wm.te 2016-12-13 00:34:34.876856837 +0100

policy/modules/contrib/wm.te +12 -0

@@ -10,6 +10,18 @@ attribute wm_domain;
 ?type wm_exec_t;
 ?corecmd_executable_file(wm_exec_t)
 
+type wm_tmp_t;
+typealias wm_tmp_t alias { user_wm_tmp_t staff_wm_tmp_t
 sysadm_wm_tmp_t };
+userdom_user_tmp_file(wm_tmp_t)
+
+type wm_tmpfs_t;
+typealias wm_tmpfs_t alias { user_wm_tmpfs_t staff_wm_tmpfs_t
 sysadm_wm_tmpfs_t };
+userdom_user_tmpfs_file(wm_tmpfs_t)
+
+optional_policy(`
+? ? ? ?pulseaudio_tmpfs_content(wm_tmpfs_t)
+')
+

?########################################
?#
?# Common wm domain local policy

policy/modules/contrib/wm.te +14 -0

@@ -21,31 +33,60 @@ allow wm_domain self:netlink_kobject_uev
 ?allow wm_domain self:shm create_shm_perms;
 ?allow wm_domain self:unix_dgram_socket create_socket_perms;
 
+manage_dirs_pattern(wm_domain, wm_tmp_t, wm_tmp_t)
+manage_files_pattern(wm_domain, wm_tmp_t, wm_tmp_t)
+manage_lnk_files_pattern(wm_domain, wm_tmp_t, wm_tmp_t)
+files_tmp_filetrans(wm_domain, wm_tmp_t, { dir file lnk_file })
+
+manage_dirs_pattern(wm_domain, wm_tmpfs_t, wm_tmpfs_t)
+manage_files_pattern(wm_domain, wm_tmpfs_t, wm_tmpfs_t)
+manage_lnk_files_pattern(wm_domain, wm_tmpfs_t, wm_tmpfs_t)
+fs_tmpfs_filetrans(wm_domain, wm_tmpfs_t, { dir file lnk_file })
+
+can_exec(wm_domain, wm_exec_t)
+
 ?kernel_read_system_state(wm_domain)
 
 ?corecmd_getattr_all_executables(wm_domain)
 
+dev_read_rand(wm_domain)
 ?dev_read_sound(wm_domain)
 ?dev_read_sysfs(wm_domain)
 ?dev_read_urand(wm_domain)
+dev_rw_dri(wm_domain)
 

I'm pretty sure this is not required. This perm depends on your type of graphics card and driver. OpenGL on my machine needs it but other people I've talked to don't require it. I think I am going to add this as a Boolean to allow rw_dri(xdomain) so people with those kinds of cards can enable it everywhere instead of forcing it for people who don't need it.?

?dev_rw_wireless(wm_domain)
?dev_write_sound(wm_domain)

+files_read_etc_runtime_files(wm_domain)
?files_read_usr_files(wm_domain)

?fs_getattr_all_fs(wm_domain)

policy/modules/contrib/wm.te +4 -0

+kernel_read_fs_sysctls(wm_domain)
+kernel_read_proc_symlinks(wm_domain)
+kernel_read_sysctl(wm_domain)
+

?miscfiles_read_fonts(wm_domain)
+miscfiles_read_generic_certs(wm_domain)
?miscfiles_read_localization(wm_domain)

policy/modules/contrib/wm.te +5 -0

+udev_read_pid_files(wm_domain)
+
+# this is needed by gnome-shell
+userdom_exec_user_home_content_files(wm_domain)
+

?userdom_manage_user_tmp_sockets(wm_domain) ?userdom_tmp_filetrans_user_tmp(wm_domain, sock_file) ?userdom_user_runtime_filetrans_user_tmp(wm_domain, sock_file)

?userdom_manage_user_home_content_dirs(wm_domain) ?userdom_manage_user_home_content_files(wm_domain)
+ ?userdom_user_home_dir_filetrans_user_home_content(wm_domain, { dir file })

policy/modules/contrib/wm.te +3 -0

+wm_dontaudit_exec_tmp_files(wm_domain)
+wm_dontaudit_exec_tmpfs_files(wm_domain)
+

?optional_policy(`
? ? ? ? accountsd_dbus_chat(wm_domain)
?')

(quoted diff) +0 -0

@@ -55,10 +96,51 @@ optional_policy(`
 ?')
 

?optional_policy(`
+? ? ? ?consolekit_dbus_chat(wm_domain)
+')

(quoted diff) +2 -0

+
+optional_policy(`

? ? ? ? devicekit_dbus_chat_power(wm_domain)
?')

?optional_policy(`
+? ? ? ?evolution_domtrans(wm_domain)

policy/modules/contrib/wm.te +36 -0

+
+? ? ? ?optional_policy(`
+? ? ? ? ? ? ? ?evolution_dbus_chat(wm_domain)
+? ? ? ? ? ? ? ?evolution_alarm_dbus_chat(wm_domain)
+? ? ? ?')
+')
+
+optional_policy(`
+? ? ? ?games_domtrans(wm_domain)
+
+? ? ? ?optional_policy(`
+? ? ? ? ? ? ? ?games_dbus_chat(wm_domain)
+? ? ? ?')
+')
+
+optional_policy(`
+? ? ? ?java_domtrans(wm_domain)
+')
+
+optional_policy(`
+? ? ? ?mono_domtrans(wm_domain)
+')
+
+optional_policy(`
+? ? ? ?mozilla_domtrans(wm_domain)
+
+? ? ? ?optional_policy(`
+? ? ? ? ? ? ? ?mozilla_dbus_chat(wm_domain)
+? ? ? ?')
+')
+
+optional_policy(`
+? ? ? ?mplayer_domtrans(wm_domain)
+')
+
+optional_policy(`

? ? ? ? networkmanager_dbus_chat(wm_domain)
?')

Whoa are we going to have to add every single application to wm_domain to be able to run it? That will get annoying super fast. Isn't there an application_domain attribute we can use? If there isn't we might want to reverse this so X application types instead declare that wm can run them (something like the application_type interface)

(quoted diff) +0 -0

@@ -67,9 +149,13 @@ optional_policy(`
 ?')
 

?optional_policy(`
-? ? ? ?pulseaudio_stream_connect(wm_domain) +? ? ? ?telepathy_mission_control_dbus_chat(wm_domain) ?')

?optional_policy(`
? ? ? ? userhelper_exec_consolehelper(wm_domain)
?')

policy/modules/contrib/colord.te +4 -0

+
+optional_policy(`
+? ? ? ?xserver_dbus_chat_xdm(wm_domain)
+')

diff -pruN refpolicy-git-07122016-orig/policy/modules/roles/staff.te refpolicy-git-07122016/policy/modules/roles/staff.te
--- refpolicy-git-07122016-orig/policy/modules/roles/staff.te? ?2016- 12-14 02:24:53.397000941 +0100
+++ refpolicy-git-07122016/policy/modules/roles/staff.te? ? ? ? 2016- 12-13 22:45:02.857851229 +0100

(quoted diff) +0 -0

@@ -88,11 +88,11 @@ ifndef(`distro_redhat',`
 ? ? ? ? ? ? ? ? ')
 

? ? ? ? ? ? ? ? optional_policy(`
-? ? ? ? ? ? ? ? ? ? ? ?pulseaudio_role(staff_r, staff_t) +? ? ? ? ? ? ? ? ? ? ? ?telepathy_role_template(staff, staff_r, staff_t)
? ? ? ? ? ? ? ? ')

? ? ? ? ? ? ? ? optional_policy(`
-? ? ? ? ? ? ? ? ? ? ? ?telepathy_role_template(staff, staff_r, staff_t)
+? ? ? ? ? ? ? ? ? ? ? ?wm_role_template(staff, staff_r, staff_t) ? ? ? ? ? ? ? ? ')
? ? ? ? ')

(quoted diff) +0 -0

@@ -145,6 +145,10 @@ ifndef(`distro_redhat',`
 ? ? ? ? ')
 

? ? ? ? optional_policy(`
+? ? ? ? ? ? ? ?pulseaudio_role(staff_r, staff_t)
+? ? ? ?')
+

This has nothing to do with window managers. Pulse stuff should be in a separate patch.?

+? ? ? ?optional_policy(`
? ? ? ? ? ? ? ? pyzor_role(staff_r, staff_t)
? ? ? ? ')

diff -pruN refpolicy-git-07122016-orig/policy/modules/roles/sysadm.te refpolicy-git-07122016/policy/modules/roles/sysadm.te
--- refpolicy-git-07122016-orig/policy/modules/roles/sysadm.te? 2016- 12-14 02:24:53.397000941 +0100
+++ refpolicy-git-07122016/policy/modules/roles/sysadm.te? ? ? ?2016- 12-13 22:45:25.577422292 +0100

(quoted diff) +0 -0

@@ -1246,6 +1246,10 @@ ifndef(`distro_redhat',`

? ? ? ? ? ? ? ? optional_policy(`
? ? ? ? ? ? ? ? ? ? ? ? gnome_role_template(sysadm, sysadm_r, sysadm_t)
? ? ? ? ? ? ? ? ')
+
+? ? ? ? ? ? ? ?optional_policy(`
+? ? ? ? ? ? ? ? ? ? ? ?wm_role_template(sysadm, sysadm_r, sysadm_t) +? ? ? ? ? ? ? ?')
? ? ? ? ')

? ? ? ? optional_policy(`
diff -pruN refpolicy-git-07122016- orig/policy/modules/roles/unprivuser.te refpolicy-git- 07122016/policy/modules/roles/unprivuser.te
--- refpolicy-git-07122016-orig/policy/modules/roles/unprivuser.te? ? ? 2016-12-14 02:24:53.398000965 +0100
+++ refpolicy-git-07122016/policy/modules/roles/unprivuser.te? ?2016- 12-13 22:44:50.493540449 +0100

(quoted diff) +0 -0

@@ -57,11 +57,11 @@ ifndef(`distro_redhat',`
 ? ? ? ? ? ? ? ? ')
 

? ? ? ? ? ? ? ? optional_policy(`
-? ? ? ? ? ? ? ? ? ? ? ?pulseaudio_role(user_r, user_t)
+? ? ? ? ? ? ? ? ? ? ? ?telepathy_role_template(user, user_r, user_t) ? ? ? ? ? ? ? ? ')

? ? ? ? ? ? ? ? optional_policy(`
-? ? ? ? ? ? ? ? ? ? ? ?telepathy_role_template(user, user_r, user_t) +? ? ? ? ? ? ? ? ? ? ? ?wm_role_template(user, user_r, user_t) ? ? ? ? ? ? ? ? ')
? ? ? ? ')

(quoted diff) +0 -0

@@ -122,6 +122,10 @@ ifndef(`distro_redhat',`
 ? ? ? ? ')
 

? ? ? ? optional_policy(`
+? ? ? ? ? ? ? ?pulseaudio_role(user_r, user_t)
+? ? ? ?')
+

What's up with the random rearranging of the lines here? It makes the patch seem like it's doing more than it is.?

+? ? ? ?optional_policy(`
? ? ? ? ? ? ? ? pyzor_role(user_r, user_t)
? ? ? ? ')

Hello Jason,

you took the list off for this message, I think this is not intentional, so I am bringing the reply back on the list...

Quoted 40 lines · Jason Zaman

On 14 Dec 2016 09:54, "Guido Trentalancia via refpolicy" <refpolicy@o ss.tresys.com> wrote:
Enable the window manager role (wm contrib module) and update the module to work with gnome-shell.

This patch requires the following recently posted patch for the games module:

[PATCH v3 1/2] games: general update and improved pulseaudio integration
http://oss.tresys.com/pipermail/refpolicy/2016-December/008679.html

This patch has received some testing with the following two configurations:
- gnome-shell executing in normal mode (with display managers other than gdm, such as xdm from XOrg);
- gnome-shell executing in gdm mode (with the Gnome Display Manager).

Patches 3/5, 4/5 and 5/5 are needed when gnome-shell is used in conjunction with gdm.

Since the window managers are not limited by gnome-shell, this latter version of the patch (along with part 2/5) uses separate optional conditionals for the gnome and wm role templates.

Signed-off-by Guido Trentalancia <[email protected]>

---
 policy/modules/contrib/colord.te   |    5 ++
 policy/modules/contrib/dbus.te     |    5 ++
 policy/modules/contrib/wm.if       |   43 +++++++++++++++++-
 policy/modules/contrib/wm.te       |   88
++++++++++++++++++++++++++++++++++++-
 policy/modules/roles/staff.te      |    8 ++-
 policy/modules/roles/sysadm.te     |    4 +
 policy/modules/roles/unprivuser.te |    8 ++-
 7 files changed, 155 insertions(+), 6 deletions(-)

Quoted 10 lines

diff -pruN refpolicy-git-07122016-orig/policy/modules/contrib/wm.te refpolicy-git-07122016/policy/modules/contrib/wm.te
--- refpolicy-git-07122016-orig/policy/modules/contrib/wm.te 2016-
12-14 02:24:53.396000918 +0100
+++ refpolicy-git-07122016/policy/modules/contrib/wm.te 2016-12-13 00:34:34.876856837 +0100

policy/modules/contrib/wm.te +0 -0

@@ -10,6 +10,18 @@ attribute wm_domain;
 type wm_exec_t;
 corecmd_executable_file(wm_exec_t)
 

policy/modules/contrib/wm.te attribute wm_domain; · line 19

Quoted 9 lines

policy/modules/contrib/wm.te +7 -0

+type wm_tmp_t;
+typealias wm_tmp_t alias { user_wm_tmp_t staff_wm_tmp_t
 sysadm_wm_tmp_t };
+userdom_user_tmp_file(wm_tmp_t)
+
+type wm_tmpfs_t;
+typealias wm_tmpfs_t alias { user_wm_tmpfs_t staff_wm_tmpfs_t
 sysadm_wm_tmpfs_t };
+userdom_user_tmpfs_file(wm_tmpfs_t)

Quoted 9 lines · Guido Trentalancia via refpolicy

Hello Jason,

you took the list off for this message, I think this is not intentional, so I am bringing the reply back on the list...

Quoted 3 lines · Jason Zaman

On 14 Dec 2016 09:54, "Guido Trentalancia via refpolicy"

<refpolicy@o

Quoted 18 lines

Quoted 18 lines

ss.tresys.com> wrote:
Enable the window manager role (wm contrib module) and update the module to work with gnome-shell.

This patch requires the following recently posted patch for the games module:

[PATCH v3 1/2] games: general update and improved pulseaudio integration
http://oss.tresys.com/pipermail/refpolicy/2016-December/008679.html

This patch has received some testing with the following two configurations:
- gnome-shell executing in normal mode (with display managers other than gdm, such as xdm from XOrg);
- gnome-shell executing in gdm mode (with the Gnome Display Manager).

Quoted 4 lines

Quoted 4 lines

Patches 3/5, 4/5 and 5/5 are needed when gnome-shell is used in conjunction with gdm.

Since the window managers are not limited by gnome-shell, this

latter

Quoted 15 lines

Quoted 15 lines

version of the patch (along with part 2/5) uses separate optional conditionals for the gnome and wm role templates.

Signed-off-by Guido Trentalancia <[email protected]>

---
 policy/modules/contrib/colord.te   |    5 ++
 policy/modules/contrib/dbus.te     |    5 ++
 policy/modules/contrib/wm.if       |   43 +++++++++++++++++-
 policy/modules/contrib/wm.te       |   88
++++++++++++++++++++++++++++++++++++-
 policy/modules/roles/staff.te      |    8 ++-
 policy/modules/roles/sysadm.te     |    4 +
 policy/modules/roles/unprivuser.te |    8 ++-
 7 files changed, 155 insertions(+), 6 deletions(-)

[...]

Quoted 3 lines

Quoted 3 lines

diff -pruN refpolicy-git-07122016-orig/policy/modules/contrib/wm.te refpolicy-git-07122016/policy/modules/contrib/wm.te
--- refpolicy-git-07122016-orig/policy/modules/contrib/wm.te

2016-

Quoted 7 lines

Quoted 7 lines

12-14 02:24:53.396000918 +0100
+++ refpolicy-git-07122016/policy/modules/contrib/wm.te 2016-12-13 00:34:34.876856837 +0100

policy/modules/contrib/wm.te +0 -0

@@ -10,6 +10,18 @@ attribute wm_domain;
 type wm_exec_t;
 corecmd_executable_file(wm_exec_t)
 

Quoted 9 lines

policy/modules/contrib/wm.te attribute wm_domain; · line 19

Quoted 9 lines

policy/modules/contrib/wm.te +7 -0

+type wm_tmp_t;
+typealias wm_tmp_t alias { user_wm_tmp_t staff_wm_tmp_t
 sysadm_wm_tmp_t };
+userdom_user_tmp_file(wm_tmp_t)
+
+type wm_tmpfs_t;
+typealias wm_tmpfs_t alias { user_wm_tmpfs_t staff_wm_tmpfs_t
 sysadm_wm_tmpfs_t };
+userdom_user_tmpfs_file(wm_tmpfs_t)

Don't add aliases. The alias types never existed, so there is no compatibility to preserve.

Enable the window manager role (wm contrib module) and update the module to work with gnome-shell.

This patch requires the following recently posted patch for the games module:

[PATCH v3 1/2] games: general update and improved pulseaudio integration
http://oss.tresys.com/pipermail/refpolicy/2016-December/008679.html

This patch has received some testing with the following two configurations:
- gnome-shell executing in normal mode (with display managers other than gdm, such as xdm from XOrg);
- gnome-shell executing in gdm mode (with the Gnome Display Manager).

Patches 3/5, 4/5 and 5/5 are needed when gnome-shell is used in conjunction with gdm.

Since the window managers are not limited by gnome-shell, this latter version of the patch (along with part 2/5) uses separate optional conditionals for the gnome and wm role templates.

The new wm_application_domain() interface introduced in the sixth version of this patch is an idea of Jason Zaman.

This patch also fixes a minor bug in the way the pulseaudio_role() interface is optionally included by the role templates (pulseaudio does not depend on dbus).

Signed-off-by Guido Trentalancia <[email protected]>

---
 policy/modules/contrib/colord.te    |    5 ++
 policy/modules/contrib/dbus.te      |    5 ++
 policy/modules/contrib/evolution.te |    4 +
 policy/modules/contrib/games.te     |    4 +
 policy/modules/contrib/java.te      |    4 +
 policy/modules/contrib/mono.te      |    4 +
 policy/modules/contrib/mozilla.te   |    4 +
 policy/modules/contrib/mplayer.te   |    4 +
 policy/modules/contrib/wm.if        |   89 +++++++++++++++++++++++++++++++++++-
 policy/modules/contrib/wm.te        |   62 ++++++++++++++++++++++++-
 policy/modules/roles/staff.te       |    8 ++-
 policy/modules/roles/sysadm.te      |    4 +
 policy/modules/roles/unprivuser.te  |    8 ++-
 13 files changed, 199 insertions(+), 6 deletions(-)

diff -pru a/policy/modules/contrib/colord.te b/policy/modules/contrib/colord.te

policy/modules/contrib/colord.te +5 -0

@@ -137,3 +137,8 @@ optional_policy(`
 	udev_read_db(colord_t)
 	udev_read_pid_files(colord_t)
 ')
+
+optional_policy(`
+	xserver_read_xdm_lib_files(colord_t)
+	xserver_use_xdm_fds(colord_t)
+')

diff -pru a/policy/modules/contrib/dbus.te b/policy/modules/contrib/dbus.te

policy/modules/contrib/dbus.te +5 -0

@@ -159,6 +159,11 @@ optional_policy(`
 	udev_read_db(system_dbusd_t)
 ')
 
+optional_policy(`
+	xserver_read_xdm_lib_files(system_dbusd_t)
+	xserver_use_xdm_fds(system_dbusd_t)
+')
+
 ########################################
 #
 # Common session bus local policy

diff -pru a/policy/modules/contrib/evolution.te b/policy/modules/contrib/evolution.te

policy/modules/contrib/evolution.te +4 -0

@@ -23,6 +23,10 @@ typealias evolution_t alias { auditadm_e
 userdom_user_application_domain(evolution_t, evolution_exec_t)
 role evolution_roles types evolution_t;
 
+optional_policy(`
+	wm_application_domain(evolution_t, evolution_exec_t)
+')
+
 type evolution_alarm_t;
 type evolution_alarm_exec_t;
 typealias evolution_alarm_t alias { user_evolution_alarm_t staff_evolution_alarm_t sysadm_evolution_alarm_t };

diff -pru a/policy/modules/contrib/games.te b/policy/modules/contrib/games.te

policy/modules/contrib/games.te +4 -0

@@ -14,6 +14,10 @@ typealias games_t alias { auditadm_games
 userdom_user_application_domain(games_t, games_exec_t)
 role games_roles types games_t;
 
+optional_policy(`
+	wm_application_domain(games_t, games_exec_t)
+')
+
 type games_data_t;
 typealias games_data_t alias { user_games_data_t staff_games_data_t sysadm_games_data_t };
 typealias games_data_t alias { auditadm_games_data_t secadm_games_data_t };

diff -pru a/policy/modules/contrib/java.te b/policy/modules/contrib/java.te

policy/modules/contrib/java.te +4 -0

@@ -27,6 +27,10 @@ typealias java_t alias { staff_javaplugi
 typealias java_t alias { auditadm_javaplugin_t secadm_javaplugin_t };
 role java_roles types java_t;
 
+optional_policy(`
+	wm_application_domain(java_t, java_exec_t)
+')
+
 type java_home_t;
 userdom_user_home_content(java_home_t)
 

diff -pru a/policy/modules/contrib/mono.te b/policy/modules/contrib/mono.te

policy/modules/contrib/mono.te +4 -0

@@ -16,6 +16,10 @@ role mono_roles types mono_t;
 
 application_type(mono_t)
 
+optional_policy(`
+	wm_application_domain(mono_t, mono_exec_t)
+')
+
 ########################################
 #
 # Common local policy

diff -pru a/policy/modules/contrib/mozilla.te b/policy/modules/contrib/mozilla.te

policy/modules/contrib/mozilla.te +4 -0

@@ -24,6 +24,10 @@ typealias mozilla_t alias { auditadm_moz
 userdom_user_application_domain(mozilla_t, mozilla_exec_t)
 role mozilla_roles types mozilla_t;
 
+optional_policy(`
+	wm_application_domain(mozilla_t, mozilla_exec_t)
+')
+
 type mozilla_home_t;
 typealias mozilla_home_t alias { user_mozilla_home_t staff_mozilla_home_t sysadm_mozilla_home_t };
 typealias mozilla_home_t alias { auditadm_mozilla_home_t secadm_mozilla_home_t };

diff -pru a/policy/modules/contrib/mplayer.te b/policy/modules/contrib/mplayer.te

policy/modules/contrib/mplayer.te +4 -0

@@ -30,6 +30,10 @@ typealias mplayer_t alias { auditadm_mpl
 userdom_user_application_domain(mplayer_t, mplayer_exec_t)
 role mplayer_roles types mplayer_t;
 
+optional_policy(`
+	wm_application_domain(mplayer_t, mplayer_exec_t)
+')
+
 type mplayer_etc_t;
 files_config_file(mplayer_etc_t)
 

diff -pru a/policy/modules/contrib/wm.if b/policy/modules/contrib/wm.if

policy/modules/contrib/wm.if +88 -1

@@ -47,6 +47,8 @@ template(`wm_role_template',`
 	# Policy
 	#
 
+	allow $3 $1_wm_t:fd use;
+
 	allow $1_wm_t $3:unix_stream_socket connectto;
 	allow $3 $1_wm_t:unix_stream_socket connectto;
 

@@ -72,6 +74,7 @@ template(`wm_role_template',`
 	xserver_manage_core_devices($1_wm_t)
 
 	optional_policy(`
+		dbus_connect_spec_session_bus($1, $1_wm_t)
 		dbus_spec_session_bus_client($1, $1_wm_t)
 		dbus_system_bus_client($1_wm_t)
 

@@ -81,7 +84,7 @@ template(`wm_role_template',`
 	')
 
 	optional_policy(`
-		gnome_stream_connect_gkeyringd($1, $1_wm_t)
+		gnome_stream_connect_all_gkeyringd($1_wm_t)
 	')
 
 	optional_policy(`

@@ -134,3 +137,87 @@ interface(`wm_dbus_chat',`
 	allow $2 $1_wm_t:dbus send_msg;
 	allow $1_wm_t $2:dbus send_msg;
 ')
+
+########################################
+## <summary>
+##	Do not audit attempts to execute
+##	files in temporary directories.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain to not audit.
+##	</summary>
+## </param>
+#
+interface(`wm_dontaudit_exec_tmp_files',`
+	gen_require(`
+		type wm_tmp_t;
+	')
+
+	dontaudit $1 wm_tmp_t:file exec_file_perms;
+')
+
+########################################
+## <summary>
+##	Do not audit attempts to execute
+##	files in temporary filesystems.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain to not audit.
+##	</summary>
+## </param>
+#
+interface(`wm_dontaudit_exec_tmpfs_files',`
+	gen_require(`
+		type wm_tmpfs_t;
+	')
+
+	dontaudit $1 wm_tmpfs_t:file exec_file_perms;
+')
+
+########################################
+## <summary>
+##	Create a domain for applications
+##	that are launched by the window
+##	manager.
+## </summary>
+## <desc>
+##	<p>
+##	Create a domain for applications that are launched by the
+##	window manager (implying a domain transition).  Typically
+##	these are graphical applications that are run interactively.
+##	</p>
+##	<p>
+##	The types will be made usable as a domain and file, making
+##	calls to domain_type() and files_type() redundant.
+##	</p>
+## </desc>
+## <param name="target_domain">
+##	<summary>
+##	Type to be used in the domain transition as the application
+##	domain.
+##	</summary>
+## </param>
+## <param name="entry_point">
+##	<summary>
+##	Type of the program to be used as an entry point to this domain.
+##	</summary>
+## </param>
+## <param name="source_domain">
+##	<summary>
+##	Type to be used as the source window manager domain.
+##	</summary>
+## </param>
+## <infoflow type="none"/>
+#
+interface(`wm_application_domain',`
+	gen_require(`
+		attribute wm_domain;
+	')
+
+	application_type($1)
+	ubac_constrained($1)
+	application_executable_file($2)
+	domtrans_pattern(wm_domain, $2, $1)
+')

diff -pru a/policy/modules/contrib/wm.te b/policy/modules/contrib/wm.te

policy/modules/contrib/wm.te +61 -1

@@ -10,6 +10,16 @@ attribute wm_domain;
 type wm_exec_t;
 corecmd_executable_file(wm_exec_t)
 
+type wm_tmp_t;
+userdom_user_tmp_file(wm_tmp_t)
+
+type wm_tmpfs_t;
+userdom_user_tmpfs_file(wm_tmpfs_t)
+
+optional_policy(`
+	pulseaudio_tmpfs_content(wm_tmpfs_t)
+')
+
 ########################################
 #
 # Common wm domain local policy

@@ -21,31 +31,60 @@ allow wm_domain self:netlink_kobject_uev
 allow wm_domain self:shm create_shm_perms;
 allow wm_domain self:unix_dgram_socket create_socket_perms;
 
+manage_dirs_pattern(wm_domain, wm_tmp_t, wm_tmp_t)
+manage_files_pattern(wm_domain, wm_tmp_t, wm_tmp_t)
+manage_lnk_files_pattern(wm_domain, wm_tmp_t, wm_tmp_t)
+files_tmp_filetrans(wm_domain, wm_tmp_t, { dir file lnk_file })
+
+manage_dirs_pattern(wm_domain, wm_tmpfs_t, wm_tmpfs_t)
+manage_files_pattern(wm_domain, wm_tmpfs_t, wm_tmpfs_t)
+manage_lnk_files_pattern(wm_domain, wm_tmpfs_t, wm_tmpfs_t)
+fs_tmpfs_filetrans(wm_domain, wm_tmpfs_t, { dir file lnk_file })
+
+can_exec(wm_domain, wm_exec_t)
+
 kernel_read_system_state(wm_domain)
 
 corecmd_getattr_all_executables(wm_domain)
 
+dev_read_rand(wm_domain)
 dev_read_sound(wm_domain)
 dev_read_sysfs(wm_domain)
 dev_read_urand(wm_domain)
+dev_rw_dri(wm_domain)
 dev_rw_wireless(wm_domain)
 dev_write_sound(wm_domain)
 
+files_read_etc_runtime_files(wm_domain)
 files_read_usr_files(wm_domain)
 
 fs_getattr_all_fs(wm_domain)
 
+kernel_read_fs_sysctls(wm_domain)
+kernel_read_proc_symlinks(wm_domain)
+kernel_read_sysctl(wm_domain)
+
 miscfiles_read_fonts(wm_domain)
+miscfiles_read_generic_certs(wm_domain)
 miscfiles_read_localization(wm_domain)
 
+udev_read_pid_files(wm_domain)
+
+# this is needed by gnome-shell
+userdom_exec_user_home_content_files(wm_domain)
+
 userdom_manage_user_tmp_sockets(wm_domain)
 userdom_tmp_filetrans_user_tmp(wm_domain, sock_file)
 userdom_user_runtime_filetrans_user_tmp(wm_domain, sock_file)
 
 userdom_manage_user_home_content_dirs(wm_domain)
 userdom_manage_user_home_content_files(wm_domain)
+
 userdom_user_home_dir_filetrans_user_home_content(wm_domain, { dir file })
 
+wm_dontaudit_exec_tmp_files(wm_domain)
+wm_dontaudit_exec_tmpfs_files(wm_domain)
+
 optional_policy(`
 	accountsd_dbus_chat(wm_domain)
 ')

@@ -55,10 +94,27 @@ optional_policy(`
 ')		
 
 optional_policy(`
+	consolekit_dbus_chat(wm_domain)
+')
+
+optional_policy(`
 	devicekit_dbus_chat_power(wm_domain)
 ')
 
 optional_policy(`
+	evolution_dbus_chat(wm_domain)
+	evolution_alarm_dbus_chat(wm_domain)
+')
+
+optional_policy(`
+	games_dbus_chat(wm_domain)
+')
+
+optional_policy(`
+	mozilla_dbus_chat(wm_domain)
+')
+
+optional_policy(`
 	networkmanager_dbus_chat(wm_domain)
 ')
 

@@ -67,9 +123,13 @@ optional_policy(`
 ')
 
 optional_policy(`
-	pulseaudio_stream_connect(wm_domain)
+	telepathy_mission_control_dbus_chat(wm_domain)
 ')
 
 optional_policy(`
 	userhelper_exec_consolehelper(wm_domain)
 ')
+
+optional_policy(`
+	xserver_dbus_chat_xdm(wm_domain)
+')

diff -pru a/policy/modules/roles/staff.te b/policy/modules/roles/staff.te

policy/modules/roles/staff.te +6 -2

@@ -88,11 +88,11 @@ ifndef(`distro_redhat',`
 		')
 
 		optional_policy(`
-			pulseaudio_role(staff_r, staff_t)
+			telepathy_role_template(staff, staff_r, staff_t)
 		')
 
 		optional_policy(`
-			telepathy_role_template(staff, staff_r, staff_t)
+			wm_role_template(staff, staff_r, staff_t)
 		')
 	')
 

@@ -145,6 +145,10 @@ ifndef(`distro_redhat',`
 	')
 
 	optional_policy(`
+		pulseaudio_role(staff_r, staff_t)
+	')
+
+	optional_policy(`
 		pyzor_role(staff_r, staff_t)
 	')
 

diff -pru a/policy/modules/roles/sysadm.te b/policy/modules/roles/sysadm.te

policy/modules/roles/sysadm.te +4 -0

@@ -1246,6 +1246,10 @@ ifndef(`distro_redhat',`
 		optional_policy(`
 			gnome_role_template(sysadm, sysadm_r, sysadm_t)
 		')
+
+		optional_policy(`
+			wm_role_template(sysadm, sysadm_r, sysadm_t)
+		')
 	')
 
 	optional_policy(`

diff -pru a/policy/modules/roles/unprivuser.te b/policy/modules/roles/unprivuser.te

policy/modules/roles/unprivuser.te +6 -2

@@ -57,11 +57,11 @@ ifndef(`distro_redhat',`
 		')
 
 		optional_policy(`
-			pulseaudio_role(user_r, user_t)
+			telepathy_role_template(user, user_r, user_t)
 		')
 
 		optional_policy(`
-			telepathy_role_template(user, user_r, user_t)
+			wm_role_template(user, user_r, user_t)
 		')
 	')
 

@@ -122,6 +122,10 @@ ifndef(`distro_redhat',`
 	')
 
 	optional_policy(`
+		pulseaudio_role(user_r, user_t)
+	')
+
+	optional_policy(`
 		pyzor_role(user_r, user_t)
 	')
 

_______________________________________________
refpolicy mailing list
refpolicy at oss.tresys.com
http://oss.tresys.com/mailman/listinfo/refpolicy

Enable the window manager role (wm contrib module) and update the module to work with gnome-shell.

This patch requires the following recently posted patch for the games module:

[PATCH v3 1/2] games: general update and improved pulseaudio integration
http://oss.tresys.com/pipermail/refpolicy/2016-December/008679.html

This patch has received some testing with the following two configurations:
- gnome-shell executing in normal mode (with display managers other than gdm, such as xdm from XOrg);
- gnome-shell executing in gdm mode (with the Gnome Display Manager).

Patches 3/5, 4/5 and 5/5 are needed when gnome-shell is used in conjunction with gdm.

Since the window managers are not limited by gnome-shell, this latter version of the patch (along with part 2/5) uses separate optional conditionals for the gnome and wm role templates.

The new wm_application_domain() interface introduced in the sixth version of this patch is an idea of Jason Zaman.

This patch also fixes a minor bug in the way the pulseaudio_role() interface is optionally included by the role templates (pulseaudio does not depend on dbus).

This seventh version splits the 1/5 patch in two separate patches:
one for the base policy and one for the contrib policy.

THIS IS THE BASE POLICY PART.

Signed-off-by Guido Trentalancia <[email protected]>

---
 policy/modules/roles/staff.te      |    8 ++++++--
 policy/modules/roles/sysadm.te     |    4 ++++
 policy/modules/roles/unprivuser.te |    8 ++++++--
 3 files changed, 16 insertions(+), 4 deletions(-)

diff -pru a/policy/modules/roles/staff.te b/policy/modules/roles/staff.te

policy/modules/roles/staff.te +6 -2

@@ -88,11 +88,11 @@ ifndef(`distro_redhat',`
 		')
 
 		optional_policy(`
-			pulseaudio_role(staff_r, staff_t)
+			telepathy_role_template(staff, staff_r, staff_t)
 		')
 
 		optional_policy(`
-			telepathy_role_template(staff, staff_r, staff_t)
+			wm_role_template(staff, staff_r, staff_t)
 		')
 	')
 

@@ -145,6 +145,10 @@ ifndef(`distro_redhat',`
 	')
 
 	optional_policy(`
+		pulseaudio_role(staff_r, staff_t)
+	')
+
+	optional_policy(`
 		pyzor_role(staff_r, staff_t)
 	')
 

diff -pru a/policy/modules/roles/sysadm.te b/policy/modules/roles/sysadm.te

policy/modules/roles/sysadm.te +4 -0

@@ -1246,6 +1246,10 @@ ifndef(`distro_redhat',`
 		optional_policy(`
 			gnome_role_template(sysadm, sysadm_r, sysadm_t)
 		')
+
+		optional_policy(`
+			wm_role_template(sysadm, sysadm_r, sysadm_t)
+		')
 	')
 
 	optional_policy(`

diff -pru a/policy/modules/roles/unprivuser.te b/policy/modules/roles/unprivuser.te

policy/modules/roles/unprivuser.te +6 -2

@@ -57,11 +57,11 @@ ifndef(`distro_redhat',`
 		')
 
 		optional_policy(`
-			pulseaudio_role(user_r, user_t)
+			telepathy_role_template(user, user_r, user_t)
 		')
 
 		optional_policy(`
-			telepathy_role_template(user, user_r, user_t)
+			wm_role_template(user, user_r, user_t)
 		')
 	')
 

@@ -122,6 +122,10 @@ ifndef(`distro_redhat',`
 	')
 
 	optional_policy(`
+		pulseaudio_role(user_r, user_t)
+	')
+
+	optional_policy(`
 		pyzor_role(user_r, user_t)
 	')

Quoted 10 lines · Guido Trentalancia via refpolicy

Enable the window manager role (wm contrib module) and update the module to work with gnome-shell.

This patch requires the following recently posted patch for the games module:

[PATCH v3 1/2] games: general update and improved pulseaudio integration
http://oss.tresys.com/pipermail/refpolicy/2016-December/008679.html

I've merged this set.??However, after I applied them, I realized there?
was an invalid interface added in xserver (nonexistant xdm_domain? attribute) and a missing interface called in wm.??I've removed them.

Hello Christopher.

Quoted 11 lines · Chris PeBenito

Quoted 10 lines · Guido Trentalancia via refpolicy

Enable the window manager role (wm contrib module) and update the module to work with gnome-shell.

This patch requires the following recently posted patch for the games module:

[PATCH v3 1/2] games: general update and improved pulseaudio integration
http://oss.tresys.com/pipermail/refpolicy/2016-December/008679.html

[...]

Quoted 4 lines

I've merged this set. However, after I applied them, I realized there
was an invalid interface added in xserver (nonexistant xdm_domain attribute) and a missing interface called in wm. I've removed them.

I suppose the missing interface called in wm is games_dbus_chat(). Can you confirm ?

Such interface has been introduced by the recent games patch (see above). The patch description mentions that it depends on the games patch, which for some reason has not been applied yet.

On 14 Dec 2016 09:54, "Guido Trentalancia via refpolicy" <refpolicy@o ss.tresys.com> wrote:
Enable the window manager role (wm contrib module) and update the module to work with gnome-shell.

This patch requires the following recently posted patch for the games module:

[PATCH v3 1/2] games: general update and improved pulseaudio integration
http://oss.tresys.com/pipermail/refpolicy/2016-December/008679.html

This patch has received some testing with the following two configurations:
- gnome-shell executing in normal mode (with display managers other than gdm, such as xdm from XOrg);
- gnome-shell executing in gdm mode (with the Gnome Display Manager).

Patches 3/5, 4/5 and 5/5 are needed when gnome-shell is used in conjunction with gdm.

Since the window managers are not limited by gnome-shell, this latter version of the patch (along with part 2/5) uses separate optional conditionals for the gnome and wm role templates.

Signed-off-by Guido Trentalancia <[email protected]>

---

?policy/modules/contrib/colord.te? ?|? ? 5 ++
?policy/modules/contrib/dbus.te? ? ?|? ? 5 ++
?policy/modules/contrib/wm.if? ? ? ?|? ?43 +++++++++++++++++-
?policy/modules/contrib/wm.te? ? ? ?|? ?88
++++++++++++++++++++++++++++++++++++-
?policy/modules/roles/staff.te? ? ? |? ? 8 ++-
?policy/modules/roles/sysadm.te? ? ?|? ? 4 +
?policy/modules/roles/unprivuser.te |? ? 8 ++-

?7 files changed, 155 insertions(+), 6 deletions(-)

(quoted diff) +0 -0

@@ -55,10 +96,51 @@ optional_policy(`
 ?')
 

?optional_policy(`
+? ? ? ?consolekit_dbus_chat(wm_domain)
+')

(quoted diff) +2 -0

+
+optional_policy(`

? ? ? ? devicekit_dbus_chat_power(wm_domain)
?')

?optional_policy(`
+? ? ? ?evolution_domtrans(wm_domain)

policy/modules/contrib/wm.te +36 -0

+
+? ? ? ?optional_policy(`
+? ? ? ? ? ? ? ?evolution_dbus_chat(wm_domain)
+? ? ? ? ? ? ? ?evolution_alarm_dbus_chat(wm_domain)
+? ? ? ?')
+')
+
+optional_policy(`
+? ? ? ?games_domtrans(wm_domain)
+
+? ? ? ?optional_policy(`
+? ? ? ? ? ? ? ?games_dbus_chat(wm_domain)
+? ? ? ?')
+')
+
+optional_policy(`
+? ? ? ?java_domtrans(wm_domain)
+')
+
+optional_policy(`
+? ? ? ?mono_domtrans(wm_domain)
+')
+
+optional_policy(`
+? ? ? ?mozilla_domtrans(wm_domain)
+
+? ? ? ?optional_policy(`
+? ? ? ? ? ? ? ?mozilla_dbus_chat(wm_domain)
+? ? ? ?')
+')
+
+optional_policy(`
+? ? ? ?mplayer_domtrans(wm_domain)
+')
+
+optional_policy(`

? ? ? ? networkmanager_dbus_chat(wm_domain)
?')

Whoa are we going to have to add every single application to wm_domain to be able to run it? That will get annoying super fast. Isn't there an application_domain attribute we can use? If there isn't we might want to reverse this so X application types instead declare that wm can run them (something like the application_type interface)

Quoted 42 lines · Jason Zaman

On 14 Dec 2016 09:54, "Guido Trentalancia via refpolicy" <refpolicy @o
ss.tresys.com> wrote:
Enable the window manager role (wm contrib module) and update the module to work with gnome-shell.

This patch requires the following recently posted patch for the games module:

[PATCH v3 1/2] games: general update and improved pulseaudio integration
http://oss.tresys.com/pipermail/refpolicy/2016-December/008679.html

This patch has received some testing with the following two configurations:
- gnome-shell executing in normal mode (with display managers other than gdm, such as xdm from XOrg);
- gnome-shell executing in gdm mode (with the Gnome Display Manager).

Patches 3/5, 4/5 and 5/5 are needed when gnome-shell is used in conjunction with gdm.

Since the window managers are not limited by gnome-shell, this latter
version of the patch (along with part 2/5) uses separate optional conditionals for the gnome and wm role templates.

Signed-off-by Guido Trentalancia <[email protected]>

---

?policy/modules/contrib/colord.te? ?|? ? 5 ++
?policy/modules/contrib/dbus.te? ? ?|? ? 5 ++
?policy/modules/contrib/wm.if? ? ? ?|? ?43 +++++++++++++++++-
?policy/modules/contrib/wm.te? ? ? ?|? ?88
++++++++++++++++++++++++++++++++++++-
?policy/modules/roles/staff.te? ? ? |? ? 8 ++-
?policy/modules/roles/sysadm.te? ? ?|? ? 4 +
?policy/modules/roles/unprivuser.te |? ? 8 ++-

?7 files changed, 155 insertions(+), 6 deletions(-)

[...]

Quoted 53 lines

(quoted diff) +0 -0

@@ -55,10 +96,51 @@ optional_policy(`
 ?')
 

?optional_policy(`
+? ? ? ?consolekit_dbus_chat(wm_domain)
+')

(quoted diff) +2 -0

+
+optional_policy(`

? ? ? ? devicekit_dbus_chat_power(wm_domain)
?')

?optional_policy(`
+? ? ? ?evolution_domtrans(wm_domain)

(quoted diff) +36 -0

+
+? ? ? ?optional_policy(`
+? ? ? ? ? ? ? ?evolution_dbus_chat(wm_domain)
+? ? ? ? ? ? ? ?evolution_alarm_dbus_chat(wm_domain)
+? ? ? ?')
+')
+
+optional_policy(`
+? ? ? ?games_domtrans(wm_domain)
+
+? ? ? ?optional_policy(`
+? ? ? ? ? ? ? ?games_dbus_chat(wm_domain)
+? ? ? ?')
+')
+
+optional_policy(`
+? ? ? ?java_domtrans(wm_domain)
+')
+
+optional_policy(`
+? ? ? ?mono_domtrans(wm_domain)
+')
+
+optional_policy(`
+? ? ? ?mozilla_domtrans(wm_domain)
+
+? ? ? ?optional_policy(`
+? ? ? ? ? ? ? ?mozilla_dbus_chat(wm_domain)
+? ? ? ?')
+')
+
+optional_policy(`
+? ? ? ?mplayer_domtrans(wm_domain)
+')
+
+optional_policy(`

? ? ? ? networkmanager_dbus_chat(wm_domain)
?')

Quoted 6 lines

Whoa are we going to have to add every single application to wm_domain to be able to run it? That will get annoying super fast. Isn't there an application_domain attribute we can use? If there isn't we might want to reverse this so X application types instead declare that wm can run them (something like the application_type interface)

I am now trying to get back to you on this, provided that I understood
the meaning of what you proposed...

I suppose you are suggesting to use an interface such as wm_application() in the module of each application that needs to be run
by the window manager and avoid calling applicationname_domtrans() from
the wm module.

Even if that was possible, there would be a loss of visibility in the wm module about what applications it can actually run.

The latter is undesirable in my opinion and defeats the purpose of having a separate wm module to control what the window manager can and
cannot do, because at that point it would be each application module which decides if the application can run or not in the window manager.

Hello again.

I am back with a possible solution to the problem that you described...

Quoted 120 lines · Guido Trentalancia via refpolicy

Quoted 42 lines · Jason Zaman

On 14 Dec 2016 09:54, "Guido Trentalancia via refpolicy" <refpolicy @o
ss.tresys.com> wrote:
Enable the window manager role (wm contrib module) and update the module to work with gnome-shell.

This patch requires the following recently posted patch for the games module:

[PATCH v3 1/2] games: general update and improved pulseaudio integration
http://oss.tresys.com/pipermail/refpolicy/2016-December/008679.html

This patch has received some testing with the following two configurations:
- gnome-shell executing in normal mode (with display managers other than gdm, such as xdm from XOrg);
- gnome-shell executing in gdm mode (with the Gnome Display Manager).

Patches 3/5, 4/5 and 5/5 are needed when gnome-shell is used in conjunction with gdm.

Since the window managers are not limited by gnome-shell, this latter
version of the patch (along with part 2/5) uses separate optional conditionals for the gnome and wm role templates.

Signed-off-by Guido Trentalancia <[email protected]>

---
 policy/modules/contrib/colord.te   |    5 ++
 policy/modules/contrib/dbus.te     |    5 ++
 policy/modules/contrib/wm.if       |   43 +++++++++++++++++-
 policy/modules/contrib/wm.te       |   88
++++++++++++++++++++++++++++++++++++-
 policy/modules/roles/staff.te      |    8 ++-
 policy/modules/roles/sysadm.te     |    4 +
 policy/modules/roles/unprivuser.te |    8 ++-
 7 files changed, 155 insertions(+), 6 deletions(-)

[...]

Quoted 53 lines

(quoted diff) +41 -0

@@ -55,10 +96,51 @@ optional_policy(`
 ')
 
 optional_policy(`
+       consolekit_dbus_chat(wm_domain)
+')
+
+optional_policy(`
        devicekit_dbus_chat_power(wm_domain)
 ')
 
 optional_policy(`
+       evolution_domtrans(wm_domain)
+
+       optional_policy(`
+               evolution_dbus_chat(wm_domain)
+               evolution_alarm_dbus_chat(wm_domain)
+       ')
+')
+
+optional_policy(`
+       games_domtrans(wm_domain)
+
+       optional_policy(`
+               games_dbus_chat(wm_domain)
+       ')
+')
+
+optional_policy(`
+       java_domtrans(wm_domain)
+')
+
+optional_policy(`
+       mono_domtrans(wm_domain)
+')
+
+optional_policy(`
+       mozilla_domtrans(wm_domain)
+
+       optional_policy(`
+               mozilla_dbus_chat(wm_domain)
+       ')
+')
+
+optional_policy(`
+       mplayer_domtrans(wm_domain)
+')
+
+optional_policy(`
        networkmanager_dbus_chat(wm_domain)
 ')
 

Quoted 6 lines

Whoa are we going to have to add every single application to wm_domain to be able to run it? That will get annoying super fast. Isn't there an application_domain attribute we can use? If there isn't we might want to reverse this so X application types instead declare that wm can run them (something like the application_type interface)

I am now trying to get back to you on this, provided that I understood
the meaning of what you proposed...

I suppose you are suggesting to use an interface such as wm_application() in the module of each application that needs to be run
by the window manager and avoid calling applicationname_domtrans() from
the wm module.

Even if that was possible, there would be a loss of visibility in the wm module about what applications it can actually run.

Quoted 6 lines

The latter is undesirable in my opinion and defeats the purpose of having a separate wm module to control what the window manager can and
cannot do, because at that point it would be each application module which decides if the application can run or not in the window manager.

It is possible to achieve what you are seeking. You just need to use the following interface (in policy/modules/contrib/wm.if):

[cut]

########################################
## <summary>
## Create a domain for applications
## that are launched by the window
## manager.
## </summary>
## <desc>
## <p>
## Create a domain for applications that are launched by the
## window manager (implying a domain transition). Typically
## these are graphical applications that are run interactively.
## </p>
## <p>
## The types will be made usable as a domain and file, making
## calls to domain_type() and files_type() redundant.
## </p>
## </desc>
## <param name="target_domain">
## <summary>
## Type to be used in the domain transition as the application
## domain.
## </summary>
## </param>
## <param name="entry_point">
## <summary>
## Type of the program to be used as an entry point to this domain.
## </summary>
## </param>
## <param name="source_domain">
## <summary>
## Type to be used as the source window manager domain.
## </summary>
## </param>
## <infoflow type="none"/>
#
interface(wm_application_domain',

	gen_require(`
		attribute wm_domain;
	')

	application_type($1)
	ubac_constrained($1)
	application_executable_file($2)
	domtrans_pattern(wm_domain, $2, $1)

')

[cut]

and then, for each application that you want to enable from the window manager, you need to call the interface wm_application_domain() from the application module similarly to the way the userdom_user_application_domain() interface is currently called.

For example, for mozilla:

[cut]

policy/modules/contrib/mozilla.te +0 -0

 role mozilla_roles types mozilla_t;
 
 type mozilla_home_t;
 
[cut]

I hope this helps.

If the majority of people prefer that the policy changes in this direction, despite the side-effects that I have highlighted earlier on, I can amend the initial patch.

Quoted 195 lines · Guido Trentalancia via refpolicy

Hello again.

I am back with a possible solution to the problem that you described...

Quoted 120 lines · Guido Trentalancia via refpolicy

Quoted 42 lines · Jason Zaman

On 14 Dec 2016 09:54, "Guido Trentalancia via refpolicy" <refpolicy @o
ss.tresys.com> wrote:
Enable the window manager role (wm contrib module) and update the module to work with gnome-shell.

This patch requires the following recently posted patch for the games module:

[PATCH v3 1/2] games: general update and improved pulseaudio integration
http://oss.tresys.com/pipermail/refpolicy/2016-December/008679.html

This patch has received some testing with the following two configurations:
- gnome-shell executing in normal mode (with display managers other than gdm, such as xdm from XOrg);
- gnome-shell executing in gdm mode (with the Gnome Display Manager).

Patches 3/5, 4/5 and 5/5 are needed when gnome-shell is used in conjunction with gdm.

Since the window managers are not limited by gnome-shell, this latter
version of the patch (along with part 2/5) uses separate optional conditionals for the gnome and wm role templates.

Signed-off-by Guido Trentalancia <[email protected]>

---
 policy/modules/contrib/colord.te   |    5 ++
 policy/modules/contrib/dbus.te     |    5 ++
 policy/modules/contrib/wm.if       |   43 +++++++++++++++++-
 policy/modules/contrib/wm.te       |   88
++++++++++++++++++++++++++++++++++++-
 policy/modules/roles/staff.te      |    8 ++-
 policy/modules/roles/sysadm.te     |    4 +
 policy/modules/roles/unprivuser.te |    8 ++-
 7 files changed, 155 insertions(+), 6 deletions(-)

[...]

Quoted 53 lines

(quoted diff) +41 -0

@@ -55,10 +96,51 @@ optional_policy(`
 ')
 
 optional_policy(`
+       consolekit_dbus_chat(wm_domain)
+')
+
+optional_policy(`
        devicekit_dbus_chat_power(wm_domain)
 ')
 
 optional_policy(`
+       evolution_domtrans(wm_domain)
+
+       optional_policy(`
+               evolution_dbus_chat(wm_domain)
+               evolution_alarm_dbus_chat(wm_domain)
+       ')
+')
+
+optional_policy(`
+       games_domtrans(wm_domain)
+
+       optional_policy(`
+               games_dbus_chat(wm_domain)
+       ')
+')
+
+optional_policy(`
+       java_domtrans(wm_domain)
+')
+
+optional_policy(`
+       mono_domtrans(wm_domain)
+')
+
+optional_policy(`
+       mozilla_domtrans(wm_domain)
+
+       optional_policy(`
+               mozilla_dbus_chat(wm_domain)
+       ')
+')
+
+optional_policy(`
+       mplayer_domtrans(wm_domain)
+')
+
+optional_policy(`
        networkmanager_dbus_chat(wm_domain)
 ')
 

Quoted 6 lines

Whoa are we going to have to add every single application to wm_domain to be able to run it? That will get annoying super fast. Isn't there an application_domain attribute we can use? If there isn't we might want to reverse this so X application types instead declare that wm can run them (something like the application_type interface)

I am now trying to get back to you on this, provided that I understood
the meaning of what you proposed...

I suppose you are suggesting to use an interface such as wm_application() in the module of each application that needs to be run
by the window manager and avoid calling applicationname_domtrans() from
the wm module.

Even if that was possible, there would be a loss of visibility in the wm module about what applications it can actually run.

Quoted 6 lines

The latter is undesirable in my opinion and defeats the purpose of having a separate wm module to control what the window manager can and
cannot do, because at that point it would be each application module which decides if the application can run or not in the window manager.

It is possible to achieve what you are seeking. You just need to use the following interface (in policy/modules/contrib/wm.if):

[cut]

########################################
## <summary>
## Create a domain for applications
## that are launched by the window
## manager.
## </summary>
## <desc>
## <p>
## Create a domain for applications that are launched by the
## window manager (implying a domain transition). Typically
## these are graphical applications that are run interactively.
## </p>
## <p>
## The types will be made usable as a domain and file, making
## calls to domain_type() and files_type() redundant.
## </p>
## </desc>
## <param name="target_domain">
## <summary>
## Type to be used in the domain transition as the application
## domain.
## </summary>
## </param>
## <param name="entry_point">
## <summary>
## Type of the program to be used as an entry point to this domain.
## </summary>
## </param>
## <param name="source_domain">
## <summary>
## Type to be used as the source window manager domain.
## </summary>
## </param>
## <infoflow type="none"/>
#
interface(wm_application_domain',

	gen_require(`
		attribute wm_domain;
	')

	application_type($1)
	ubac_constrained($1)
	application_executable_file($2)
	domtrans_pattern(wm_domain, $2, $1)

')

[cut]

and then, for each application that you want to enable from the window manager, you need to call the interface wm_application_domain() from the application module similarly to the way the userdom_user_application_domain() interface is currently called.

For example, for mozilla:

[cut]

policy/modules/contrib/mozilla.te type mozilla_exec_t; · line 42

Quoted 7 lines

policy/modules/contrib/mozilla.te +1 -0

@@ -22,6 +39,7 @@ type mozilla_exec_t;
 typealias mozilla_t alias { user_mozilla_t staff_mozilla_t sysadm_mozilla_t };
 typealias mozilla_t alias { auditadm_mozilla_t secadm_mozilla_t };
 userdom_user_application_domain(mozilla_t, mozilla_exec_t)
+wm_application_domain(mozilla_t, mozilla_exec_t)

I'd tend to prefer it this way, as long as you make this call optional.

Quoted 13 lines

policy/modules/contrib/mozilla.te +0 -0

 role mozilla_roles types mozilla_t;
 
 type mozilla_home_t;
 
[cut]

I hope this helps.

If the majority of people prefer that the policy changes in this direction, despite the side-effects that I have highlighted earlier on, I can amend the initial patch.

Quoted 196 lines · Chris PeBenito via refpolicy

Quoted 195 lines · Guido Trentalancia via refpolicy

Hello again.

I am back with a possible solution to the problem that you described...

Quoted 120 lines · Guido Trentalancia via refpolicy

Quoted 42 lines · Jason Zaman

On 14 Dec 2016 09:54, "Guido Trentalancia via refpolicy" <refpolicy @o
ss.tresys.com> wrote:
Enable the window manager role (wm contrib module) and update the module to work with gnome-shell.

This patch requires the following recently posted patch for the games module:

[PATCH v3 1/2] games: general update and improved pulseaudio integration
http://oss.tresys.com/pipermail/refpolicy/2016-December/008679.html

This patch has received some testing with the following two configurations:
- gnome-shell executing in normal mode (with display managers other than gdm, such as xdm from XOrg);
- gnome-shell executing in gdm mode (with the Gnome Display Manager).

Patches 3/5, 4/5 and 5/5 are needed when gnome-shell is used in conjunction with gdm.

Since the window managers are not limited by gnome-shell, this latter
version of the patch (along with part 2/5) uses separate optional conditionals for the gnome and wm role templates.

Signed-off-by Guido Trentalancia <[email protected]>

---
 policy/modules/contrib/colord.te   |    5 ++
 policy/modules/contrib/dbus.te     |    5 ++
 policy/modules/contrib/wm.if       |   43 +++++++++++++++++-
 policy/modules/contrib/wm.te       |   88
++++++++++++++++++++++++++++++++++++-
 policy/modules/roles/staff.te      |    8 ++-
 policy/modules/roles/sysadm.te     |    4 +
 policy/modules/roles/unprivuser.te |    8 ++-
 7 files changed, 155 insertions(+), 6 deletions(-)

[...]

Quoted 53 lines

(quoted diff) +41 -0

@@ -55,10 +96,51 @@ optional_policy(`
 ')
 
 optional_policy(`
+       consolekit_dbus_chat(wm_domain)
+')
+
+optional_policy(`
        devicekit_dbus_chat_power(wm_domain)
 ')
 
 optional_policy(`
+       evolution_domtrans(wm_domain)
+
+       optional_policy(`
+               evolution_dbus_chat(wm_domain)
+               evolution_alarm_dbus_chat(wm_domain)
+       ')
+')
+
+optional_policy(`
+       games_domtrans(wm_domain)
+
+       optional_policy(`
+               games_dbus_chat(wm_domain)
+       ')
+')
+
+optional_policy(`
+       java_domtrans(wm_domain)
+')
+
+optional_policy(`
+       mono_domtrans(wm_domain)
+')
+
+optional_policy(`
+       mozilla_domtrans(wm_domain)
+
+       optional_policy(`
+               mozilla_dbus_chat(wm_domain)
+       ')
+')
+
+optional_policy(`
+       mplayer_domtrans(wm_domain)
+')
+
+optional_policy(`
        networkmanager_dbus_chat(wm_domain)
 ')
 

Quoted 6 lines

Whoa are we going to have to add every single application to wm_domain to be able to run it? That will get annoying super fast. Isn't there an application_domain attribute we can use? If there isn't we might want to reverse this so X application types instead declare that wm can run them (something like the application_type interface)

I am now trying to get back to you on this, provided that I understood
the meaning of what you proposed...

I suppose you are suggesting to use an interface such as wm_application() in the module of each application that needs to be run
by the window manager and avoid calling applicationname_domtrans() from
the wm module.

Even if that was possible, there would be a loss of visibility in the wm module about what applications it can actually run.

Quoted 6 lines

The latter is undesirable in my opinion and defeats the purpose of having a separate wm module to control what the window manager can and
cannot do, because at that point it would be each application module which decides if the application can run or not in the window manager.

It is possible to achieve what you are seeking. You just need to use the following interface (in policy/modules/contrib/wm.if):

[cut]

########################################
## <summary>
## Create a domain for applications
## that are launched by the window
## manager.
## </summary>
## <desc>
## <p>
## Create a domain for applications that are launched by the
## window manager (implying a domain transition). Typically
## these are graphical applications that are run interactively.
## </p>
## <p>
## The types will be made usable as a domain and file, making
## calls to domain_type() and files_type() redundant.
## </p>
## </desc>
## <param name="target_domain">
## <summary>
## Type to be used in the domain transition as the application
## domain.
## </summary>
## </param>
## <param name="entry_point">
## <summary>
## Type of the program to be used as an entry point to this domain.
## </summary>
## </param>
## <param name="source_domain">
## <summary>
## Type to be used as the source window manager domain.
## </summary>
## </param>
## <infoflow type="none"/>
#
interface(wm_application_domain',

	gen_require(`
		attribute wm_domain;
	')

	application_type($1)
	ubac_constrained($1)
	application_executable_file($2)
	domtrans_pattern(wm_domain, $2, $1)

')

[cut]

and then, for each application that you want to enable from the window manager, you need to call the interface wm_application_domain() from the application module similarly to the way the userdom_user_application_domain() interface is currently called.

For example, for mozilla:

[cut]

Quoted 9 lines

policy/modules/contrib/mozilla.te type mozilla_exec_t; · line 42

Quoted 7 lines

policy/modules/contrib/mozilla.te +1 -0

@@ -22,6 +39,7 @@ type mozilla_exec_t;
 typealias mozilla_t alias { user_mozilla_t staff_mozilla_t sysadm_mozilla_t };
 typealias mozilla_t alias { auditadm_mozilla_t secadm_mozilla_t };
 userdom_user_application_domain(mozilla_t, mozilla_exec_t)
+wm_application_domain(mozilla_t, mozilla_exec_t)

I'd tend to prefer it this way, as long as you make this call optional.

In the bigger picture this solution is a bit unwieldy in my view. There are various components that need to be able to run programs on behalf of the user. In this case it is gnome shell, but for example systemd --user needs the same, and there are various other instances.

The solution i have in dssp is not perfect either. But for domain transitions that apply to more than the just shell i use a type attribute.

example: mozilla_run(staff_type_attribute, role_attribute)

Then i associate the type attribute also with the programs that need to be able to run the programs on behalf of the user.

staff_type(staff_wm_t)
staff_type(staff_systemd_t)

It is not perfect either but atleast it provides a single point of failure. domain transitions apply automatically to all domains that need to be able to run programs on behalf of the user

Quoted 18 lines

Quoted 14 lines

policy/modules/contrib/mozilla.te +0 -0

 role mozilla_roles types mozilla_t;
 
 type mozilla_home_t;
 
[cut]

I hope this helps.

If the majority of people prefer that the policy changes in this direction, despite the side-effects that I have highlighted earlier on, I can amend the initial patch.

Quoted 221 lines · Dominick Grift

Quoted 196 lines · Chris PeBenito via refpolicy

Quoted 195 lines · Guido Trentalancia via refpolicy

Hello again.

I am back with a possible solution to the problem that you described...

Quoted 120 lines · Guido Trentalancia via refpolicy

Quoted 42 lines · Jason Zaman

On 14 Dec 2016 09:54, "Guido Trentalancia via refpolicy" <refpolicy @o
ss.tresys.com> wrote:
Enable the window manager role (wm contrib module) and update the module to work with gnome-shell.

This patch requires the following recently posted patch for the games module:

[PATCH v3 1/2] games: general update and improved pulseaudio integration
http://oss.tresys.com/pipermail/refpolicy/2016-December/008679.html

This patch has received some testing with the following two configurations:
- gnome-shell executing in normal mode (with display managers other than gdm, such as xdm from XOrg);
- gnome-shell executing in gdm mode (with the Gnome Display Manager).

Patches 3/5, 4/5 and 5/5 are needed when gnome-shell is used in conjunction with gdm.

Since the window managers are not limited by gnome-shell, this latter
version of the patch (along with part 2/5) uses separate optional conditionals for the gnome and wm role templates.

Signed-off-by Guido Trentalancia <[email protected]>

---
 policy/modules/contrib/colord.te   |    5 ++
 policy/modules/contrib/dbus.te     |    5 ++
 policy/modules/contrib/wm.if       |   43 +++++++++++++++++-
 policy/modules/contrib/wm.te       |   88
++++++++++++++++++++++++++++++++++++-
 policy/modules/roles/staff.te      |    8 ++-
 policy/modules/roles/sysadm.te     |    4 +
 policy/modules/roles/unprivuser.te |    8 ++-
 7 files changed, 155 insertions(+), 6 deletions(-)

[...]

Quoted 53 lines

(quoted diff) +41 -0

@@ -55,10 +96,51 @@ optional_policy(`
 ')
 
 optional_policy(`
+       consolekit_dbus_chat(wm_domain)
+')
+
+optional_policy(`
        devicekit_dbus_chat_power(wm_domain)
 ')
 
 optional_policy(`
+       evolution_domtrans(wm_domain)
+
+       optional_policy(`
+               evolution_dbus_chat(wm_domain)
+               evolution_alarm_dbus_chat(wm_domain)
+       ')
+')
+
+optional_policy(`
+       games_domtrans(wm_domain)
+
+       optional_policy(`
+               games_dbus_chat(wm_domain)
+       ')
+')
+
+optional_policy(`
+       java_domtrans(wm_domain)
+')
+
+optional_policy(`
+       mono_domtrans(wm_domain)
+')
+
+optional_policy(`
+       mozilla_domtrans(wm_domain)
+
+       optional_policy(`
+               mozilla_dbus_chat(wm_domain)
+       ')
+')
+
+optional_policy(`
+       mplayer_domtrans(wm_domain)
+')
+
+optional_policy(`
        networkmanager_dbus_chat(wm_domain)
 ')
 

Quoted 6 lines

Whoa are we going to have to add every single application to wm_domain to be able to run it? That will get annoying super fast. Isn't there an application_domain attribute we can use? If there isn't we might want to reverse this so X application types instead declare that wm can run them (something like the application_type interface)

I am now trying to get back to you on this, provided that I understood
the meaning of what you proposed...

I suppose you are suggesting to use an interface such as wm_application() in the module of each application that needs to be run
by the window manager and avoid calling applicationname_domtrans() from
the wm module.

Even if that was possible, there would be a loss of visibility in the wm module about what applications it can actually run.

Quoted 6 lines

The latter is undesirable in my opinion and defeats the purpose of having a separate wm module to control what the window manager can and
cannot do, because at that point it would be each application module which decides if the application can run or not in the window manager.

It is possible to achieve what you are seeking. You just need to use the following interface (in policy/modules/contrib/wm.if):

[cut]

########################################
## <summary>
## Create a domain for applications
## that are launched by the window
## manager.
## </summary>
## <desc>
## <p>
## Create a domain for applications that are launched by the
## window manager (implying a domain transition). Typically
## these are graphical applications that are run interactively.
## </p>
## <p>
## The types will be made usable as a domain and file, making
## calls to domain_type() and files_type() redundant.
## </p>
## </desc>
## <param name="target_domain">
## <summary>
## Type to be used in the domain transition as the application
## domain.
## </summary>
## </param>
## <param name="entry_point">
## <summary>
## Type of the program to be used as an entry point to this domain.
## </summary>
## </param>
## <param name="source_domain">
## <summary>
## Type to be used as the source window manager domain.
## </summary>
## </param>
## <infoflow type="none"/>
#
interface(wm_application_domain',

	gen_require(`
		attribute wm_domain;
	')

	application_type($1)
	ubac_constrained($1)
	application_executable_file($2)
	domtrans_pattern(wm_domain, $2, $1)

')

[cut]

and then, for each application that you want to enable from the window manager, you need to call the interface wm_application_domain() from the application module similarly to the way the userdom_user_application_domain() interface is currently called.

For example, for mozilla:

[cut]

Quoted 9 lines

policy/modules/contrib/mozilla.te type mozilla_exec_t; · line 42

Quoted 7 lines

policy/modules/contrib/mozilla.te +1 -0

@@ -22,6 +39,7 @@ type mozilla_exec_t;
 typealias mozilla_t alias { user_mozilla_t staff_mozilla_t sysadm_mozilla_t };
 typealias mozilla_t alias { auditadm_mozilla_t secadm_mozilla_t };
 userdom_user_application_domain(mozilla_t, mozilla_exec_t)
+wm_application_domain(mozilla_t, mozilla_exec_t)

I'd tend to prefer it this way, as long as you make this call optional.

In the bigger picture this solution is a bit unwieldy in my view. There are various components that need to be able to run programs on behalf of the user. In this case it is gnome shell, but for example systemd --user needs the same, and there are various other instances.

The solution i have in dssp is not perfect either. But for domain transitions that apply to more than the just shell i use a type attribute.

example: mozilla_run(staff_type_attribute, role_attribute)

Then i associate the type attribute also with the programs that need to be able to run the programs on behalf of the user.

Quoted 7 lines

staff_type(staff_wm_t)
staff_type(staff_systemd_t)

It is not perfect either but atleast it provides a single point of failure. domain transitions apply automatically to all domains that need to be able to run programs on behalf of the user

Some other examples: "torsocks firefox", "systemd-inhibit firefox".

So lets say to have 10 user apps. Then you would have to update (atleast) these four domains to allow them to run them with the same domtrans as well. It gets ugly rather quick and hard to maintain

Quoted 20 lines

Quoted 18 lines

Quoted 14 lines

policy/modules/contrib/mozilla.te +0 -0

 role mozilla_roles types mozilla_t;
 
 type mozilla_home_t;
 
[cut]

I hope this helps.

If the majority of people prefer that the policy changes in this direction, despite the side-effects that I have highlighted earlier on, I can amend the initial patch.

Quoted 230 lines · Dominick Grift

Quoted 221 lines · Dominick Grift

Quoted 196 lines · Chris PeBenito via refpolicy

Quoted 195 lines · Guido Trentalancia via refpolicy

Hello again.

I am back with a possible solution to the problem that you described...

Quoted 120 lines · Guido Trentalancia via refpolicy

Quoted 42 lines · Jason Zaman

On 14 Dec 2016 09:54, "Guido Trentalancia via refpolicy" <refpolicy @o
ss.tresys.com> wrote:
Enable the window manager role (wm contrib module) and update the module to work with gnome-shell.

This patch requires the following recently posted patch for the games module:

[PATCH v3 1/2] games: general update and improved pulseaudio integration
http://oss.tresys.com/pipermail/refpolicy/2016-December/008679.html

This patch has received some testing with the following two configurations:
- gnome-shell executing in normal mode (with display managers other than gdm, such as xdm from XOrg);
- gnome-shell executing in gdm mode (with the Gnome Display Manager).

Patches 3/5, 4/5 and 5/5 are needed when gnome-shell is used in conjunction with gdm.

Since the window managers are not limited by gnome-shell, this latter
version of the patch (along with part 2/5) uses separate optional conditionals for the gnome and wm role templates.

Signed-off-by Guido Trentalancia <[email protected]>

---
 policy/modules/contrib/colord.te   |    5 ++
 policy/modules/contrib/dbus.te     |    5 ++
 policy/modules/contrib/wm.if       |   43 +++++++++++++++++-
 policy/modules/contrib/wm.te       |   88
++++++++++++++++++++++++++++++++++++-
 policy/modules/roles/staff.te      |    8 ++-
 policy/modules/roles/sysadm.te     |    4 +
 policy/modules/roles/unprivuser.te |    8 ++-
 7 files changed, 155 insertions(+), 6 deletions(-)

[...]

Quoted 53 lines

(quoted diff) +41 -0

@@ -55,10 +96,51 @@ optional_policy(`
 ')
 
 optional_policy(`
+       consolekit_dbus_chat(wm_domain)
+')
+
+optional_policy(`
        devicekit_dbus_chat_power(wm_domain)
 ')
 
 optional_policy(`
+       evolution_domtrans(wm_domain)
+
+       optional_policy(`
+               evolution_dbus_chat(wm_domain)
+               evolution_alarm_dbus_chat(wm_domain)
+       ')
+')
+
+optional_policy(`
+       games_domtrans(wm_domain)
+
+       optional_policy(`
+               games_dbus_chat(wm_domain)
+       ')
+')
+
+optional_policy(`
+       java_domtrans(wm_domain)
+')
+
+optional_policy(`
+       mono_domtrans(wm_domain)
+')
+
+optional_policy(`
+       mozilla_domtrans(wm_domain)
+
+       optional_policy(`
+               mozilla_dbus_chat(wm_domain)
+       ')
+')
+
+optional_policy(`
+       mplayer_domtrans(wm_domain)
+')
+
+optional_policy(`
        networkmanager_dbus_chat(wm_domain)
 ')
 

Quoted 6 lines

Whoa are we going to have to add every single application to wm_domain to be able to run it? That will get annoying super fast. Isn't there an application_domain attribute we can use? If there isn't we might want to reverse this so X application types instead declare that wm can run them (something like the application_type interface)

I am now trying to get back to you on this, provided that I understood
the meaning of what you proposed...

I suppose you are suggesting to use an interface such as wm_application() in the module of each application that needs to be run
by the window manager and avoid calling applicationname_domtrans() from
the wm module.

Even if that was possible, there would be a loss of visibility in the wm module about what applications it can actually run.

Quoted 6 lines

The latter is undesirable in my opinion and defeats the purpose of having a separate wm module to control what the window manager can and
cannot do, because at that point it would be each application module which decides if the application can run or not in the window manager.

It is possible to achieve what you are seeking. You just need to use the following interface (in policy/modules/contrib/wm.if):

[cut]

########################################
## <summary>
## Create a domain for applications
## that are launched by the window
## manager.
## </summary>
## <desc>
## <p>
## Create a domain for applications that are launched by the
## window manager (implying a domain transition). Typically
## these are graphical applications that are run interactively.
## </p>
## <p>
## The types will be made usable as a domain and file, making
## calls to domain_type() and files_type() redundant.
## </p>
## </desc>
## <param name="target_domain">
## <summary>
## Type to be used in the domain transition as the application
## domain.
## </summary>
## </param>
## <param name="entry_point">
## <summary>
## Type of the program to be used as an entry point to this domain.
## </summary>
## </param>
## <param name="source_domain">
## <summary>
## Type to be used as the source window manager domain.
## </summary>
## </param>
## <infoflow type="none"/>
#
interface(wm_application_domain',

	gen_require(`
		attribute wm_domain;
	')

	application_type($1)
	ubac_constrained($1)
	application_executable_file($2)
	domtrans_pattern(wm_domain, $2, $1)

')

[cut]

and then, for each application that you want to enable from the window manager, you need to call the interface wm_application_domain() from the application module similarly to the way the userdom_user_application_domain() interface is currently called.

For example, for mozilla:

[cut]

Quoted 9 lines

policy/modules/contrib/mozilla.te type mozilla_exec_t; · line 42

Quoted 7 lines

policy/modules/contrib/mozilla.te +1 -0

@@ -22,6 +39,7 @@ type mozilla_exec_t;
 typealias mozilla_t alias { user_mozilla_t staff_mozilla_t sysadm_mozilla_t };
 typealias mozilla_t alias { auditadm_mozilla_t secadm_mozilla_t };
 userdom_user_application_domain(mozilla_t, mozilla_exec_t)
+wm_application_domain(mozilla_t, mozilla_exec_t)

I'd tend to prefer it this way, as long as you make this call optional.

In the bigger picture this solution is a bit unwieldy in my view. There are various components that need to be able to run programs on behalf of the user. In this case it is gnome shell, but for example systemd --user needs the same, and there are various other instances.

The solution i have in dssp is not perfect either. But for domain transitions that apply to more than the just shell i use a type attribute.

example: mozilla_run(staff_type_attribute, role_attribute)

Then i associate the type attribute also with the programs that need to be able to run the programs on behalf of the user.

Quoted 7 lines

staff_type(staff_wm_t)
staff_type(staff_systemd_t)

It is not perfect either but atleast it provides a single point of failure. domain transitions apply automatically to all domains that need to be able to run programs on behalf of the user

Quoted 6 lines

Some other examples: "torsocks firefox", "systemd-inhibit firefox".

So lets say to have 10 user apps. Then you would have to update (atleast) these four domains to allow them to run them with the same domtrans as well. It gets ugly rather quick and hard to maintain

But in reference policy this does not work well. due to the "_role()" templates. The role templates also provides access to content, and we do not want to allow for example staff_wm_t, staff_systemd_t, staff_inhibit_t, staff_torsocks_t access to mozilla_home_t, mozilla_tmp_t etc etc

Quoted 22 lines

Quoted 20 lines

Quoted 18 lines

Quoted 14 lines

policy/modules/contrib/mozilla.te +0 -0

 role mozilla_roles types mozilla_t;
 
 type mozilla_home_t;
 
[cut]

I hope this helps.

If the majority of people prefer that the policy changes in this direction, despite the side-effects that I have highlighted earlier on, I can amend the initial patch.

Quoted 3 lines · Dominick Grift

Quoted 2 lines · Dominick Grift

Quoted 1 line · Chris PeBenito via refpolicy

On 12/14/16 10:33, Guido Trentalancia via refpolicy wrote: