: patch set to update the git reference policy

diff -pruN -x .git refpolicy-git-18012011/policy/modules/apps/cpufreqselector.if refpolicy-git-18012011-dbus/policy/modules/apps/cpufreqselector.if

policy/modules/apps/cpufreqselector.if +41 -0

@@ -1 +1,42 @@
 ## <summary>Command-line CPU frequency settings.</summary>
+
+########################################
+## <summary>
+##      Send a dbus message to
+##      cpufreq-selector.
+## </summary>
+## <param name="domain">
+##      <summary>
+##      Domain allowed access.
+##      </summary>
+## </param>
+#
+interface(`cpufreqselector_dbus_send',`
+        gen_require(`
+                type cpufreqselector_t;
+                class dbus send_msg;
+        ')
+
+        allow $1 cpufreqselector_t:dbus send_msg;
+')
+
+########################################
+## <summary>
+##      Send and receive messages from
+##      cpufreq-selector over dbus.
+## </summary>
+## <param name="domain">
+##      <summary>
+##      Domain allowed access.
+##      </summary>
+## </param>
+#
+interface(`cpufreqselector_dbus_chat',`
+        gen_require(`
+                type cpufreqselector_t;
+                class dbus send_msg;
+        ')
+
+        allow $1 cpufreqselector_t:dbus send_msg;
+        allow cpufreqselector_t $1:dbus send_msg;
+')

diff -pruN -x .git refpolicy-git-18012011/policy/modules/apps/cpufreqselector.te refpolicy-git-18012011-dbus/policy/modules/apps/cpufreqselector.te

policy/modules/apps/cpufreqselector.te +4 -0

@@ -50,3 +50,7 @@ optional_policy(`
 	policykit_read_lib(cpufreqselector_t)
 	policykit_read_reload(cpufreqselector_t)
 ')
+
+optional_policy(`
+	xserver_xdm_dbus_send(cpufreqselector_t)
+')

diff -pruN -x .git refpolicy-git-18012011/policy/modules/services/avahi.if refpolicy-git-18012011-dbus/policy/modules/services/avahi.if

policy/modules/services/avahi.if +19 -0

@@ -75,6 +75,25 @@ interface(`avahi_signull',`
 
 ########################################
 ## <summary>
+##      Send a dbus message to avahi.
+## </summary>
+## <param name="domain">
+##      <summary>
+##      Domain allowed access.
+##      </summary>
+## </param>
+#
+interface(`avahi_dbus_send',`
+	gen_require(`
+		type avahi_t;
+		class dbus send_msg;
+	')
+
+	allow $1 avahi_t:dbus send_msg;
+')
+
+########################################
+## <summary>
 ##	Send and receive messages from
 ##	avahi over dbus.
 ## </summary>

diff -pruN -x .git refpolicy-git-18012011/policy/modules/services/avahi.te refpolicy-git-18012011-dbus/policy/modules/services/avahi.te

policy/modules/services/avahi.te +8 -0

@@ -104,9 +104,17 @@ optional_policy(`
 ')
 
 optional_policy(`
+	ntp_dbus_send(avahi_t)
+')
+
+optional_policy(`
 	seutil_sigchld_newrole(avahi_t)
 ')
 
 optional_policy(`
 	udev_read_db(avahi_t)
 ')
+
+optional_policy(`
+	xserver_xdm_dbus_send(avahi_t)
+')

diff -pruN -x .git refpolicy-git-18012011/policy/modules/services/consolekit.if refpolicy-git-18012011-dbus/policy/modules/services/consolekit.if

policy/modules/services/consolekit.if +20 -0

@@ -20,6 +20,26 @@ interface(`consolekit_domtrans',`
 
 ########################################
 ## <summary>
+##      Send a dbus message to
+##      consolekit.
+## </summary>
+## <param name="domain">
+##      <summary>
+##      Domain allowed access.
+##      </summary>
+## </param>
+#
+interface(`consolekit_dbus_send',`
+        gen_require(`
+                type consolekit_t;
+                class dbus send_msg;
+        ')
+
+        allow $1 consolekit_t:dbus send_msg;
+')
+
+########################################
+## <summary>
 ##	Send and receive messages from
 ##	consolekit over dbus.
 ## </summary>

diff -pruN -x .git refpolicy-git-18012011/policy/modules/services/dbus.te refpolicy-git-18012011-dbus/policy/modules/services/dbus.te

policy/modules/services/dbus.te +25 -0

@@ -141,6 +141,27 @@ optional_policy(`
 ')
 
 optional_policy(`
+	consolekit_dbus_send(system_dbusd_t)
+')
+
+optional_policy(`
+	cpufreqselector_dbus_send(system_dbusd_t)
+')
+
+optional_policy(`
+	devicekit_dbus_send_disk(system_dbusd_t)
+	devicekit_dbus_send_power(system_dbusd_t)
+')
+
+optional_policy(`
+	networkmanager_dbus_send(system_dbusd_t)
+')
+
+optional_policy(`
+	ntp_dbus_chat(system_dbusd_t)
+')
+
+optional_policy(`
 	policykit_dbus_chat(system_dbusd_t)
 	policykit_domtrans_auth(system_dbusd_t)
 	policykit_search_lib(system_dbusd_t)

@@ -154,6 +175,10 @@ optional_policy(`
 	udev_read_db(system_dbusd_t)
 ')
 
+optional_policy(`
+	xserver_xdm_dbus_chat(system_dbusd_t)
+')
+
 ########################################
 #
 # Unconfined access to this module

diff -pruN -x .git refpolicy-git-18012011/policy/modules/services/devicekit.if refpolicy-git-18012011-dbus/policy/modules/services/devicekit.if

policy/modules/services/devicekit.if +57 -0

@@ -39,6 +39,44 @@ interface(`devicekit_dgram_send',`
 
 ########################################
 ## <summary>
+##      Send a dbus message to devicekit.
+## </summary>
+## <param name="domain">
+##      <summary>
+##      Domain allowed access.
+##      </summary>
+## </param>
+#
+interface(`devicekit_dbus_send',`
+	gen_require(`
+		type devicekit_t;
+		class dbus send_msg;
+	')
+
+	allow $1 devicekit_t:dbus send_msg;
+')
+
+########################################
+## <summary>
+##      Send a dbus message to devicekit disk.
+## </summary>
+## <param name="domain">
+##      <summary>
+##      Domain allowed access.
+##      </summary>
+## </param>
+#
+interface(`devicekit_dbus_send_disk',`
+	gen_require(`
+		type devicekit_disk_t;
+		class dbus send_msg;
+	')
+
+	allow $1 devicekit_disk_t:dbus send_msg;
+')
+
+########################################
+## <summary>
 ##	Send and receive messages from
 ##	devicekit over dbus.
 ## </summary>

@@ -98,6 +136,25 @@ interface(`devicekit_signal_power',`
 ')
 
 ########################################
+## <summary>
+##      Send a dbus message to devicekit power.
+## </summary>
+## <param name="domain">
+##      <summary>
+##      Domain allowed access.
+##      </summary>
+## </param>
+#
+interface(`devicekit_dbus_send_power',`
+	gen_require(`
+		type devicekit_power_t;
+		class dbus send_msg;
+	')
+
+	allow $1 devicekit_power_t:dbus send_msg;
+')
+
+########################################
 ## <summary>
 ##	Send and receive messages from
 ##	devicekit power over dbus.

diff -pruN -x .git refpolicy-git-18012011/policy/modules/services/devicekit.te refpolicy-git-18012011-dbus/policy/modules/services/devicekit.te

policy/modules/services/devicekit.te +8 -0

@@ -178,6 +178,10 @@ optional_policy(`
 	virt_manage_images(devicekit_disk_t)
 ')
 
+optional_policy(`
+	xserver_xdm_dbus_send(devicekit_disk_t)
+')
+
 ########################################
 #
 # DeviceKit-Power local policy

@@ -282,3 +286,7 @@ optional_policy(`
 optional_policy(`
 	vbetool_domtrans(devicekit_power_t)
 ')
+
+optional_policy(`
+	xserver_xdm_dbus_send(devicekit_power_t)
+')

diff -pruN -x .git refpolicy-git-18012011/policy/modules/services/hal.te refpolicy-git-18012011-dbus/policy/modules/services/hal.te

policy/modules/services/hal.te +4 -0

@@ -338,6 +338,10 @@ optional_policy(`
 	virt_manage_images(hald_t)
 ')
 
+optional_policy(`
+	xserver_xdm_dbus_send(hald_t)
+')
+
 ########################################
 #
 # Hal acl local policy

diff -pruN -x .git refpolicy-git-18012011/policy/modules/services/networkmanager.if refpolicy-git-18012011-dbus/policy/modules/services/networkmanager.if

policy/modules/services/networkmanager.if +19 -0

@@ -116,6 +116,25 @@ interface(`networkmanager_initrc_domtran
 
 ########################################
 ## <summary>
+##      Send a dbus message to NetworkManager.
+## </summary>
+## <param name="domain">
+##      <summary>
+##      Domain allowed access.
+##      </summary>
+## </param>
+#
+interface(`networkmanager_dbus_send',`
+	gen_require(`
+		type NetworkManager_t;
+		class dbus send_msg;
+	')
+
+	allow $1 NetworkManager_t:dbus send_msg;
+')
+
+########################################
+## <summary>
 ##	Send and receive messages from
 ##	NetworkManager over dbus.
 ## </summary>

diff -pruN -x .git refpolicy-git-18012011/policy/modules/services/networkmanager.te refpolicy-git-18012011-dbus/policy/modules/services/networkmanager.te

policy/modules/services/networkmanager.te +4 -0

@@ -265,6 +265,10 @@ optional_policy(`
 	vpn_signull(NetworkManager_t)
 ')
 
+optional_policy(`
+	xserver_xdm_dbus_send(NetworkManager_t)
+')
+
 ########################################
 #
 # wpa_cli local policy

diff -pruN -x .git refpolicy-git-18012011/policy/modules/services/ntp.if refpolicy-git-18012011-dbus/policy/modules/services/ntp.if

policy/modules/services/ntp.if +59 -0

@@ -163,3 +163,62 @@ interface(`ntp_admin',`
 	files_list_pids($1)
 	admin_pattern($1, ntpd_var_run_t)
 ')
+
+########################################
+## <summary>
+##      Send a dbus message to ntpd.
+## </summary>
+## <param name="domain">
+##      <summary>
+##      Domain allowed access.
+##      </summary>
+## </param>
+#
+interface(`ntp_dbus_send',`
+	gen_require(`
+		type ntpd_t;
+		class dbus send_msg;
+	')
+
+	allow $1 ntpd_t:dbus send_msg;
+')
+
+########################################
+## <summary>
+##      Send and receive messages from
+##      ntpd over dbus.
+## </summary>
+## <param name="domain">
+##      <summary>
+##      Domain allowed access.
+##      </summary>
+## </param>
+#
+interface(`ntp_dbus_chat',`
+        gen_require(`
+                type ntpd_t;
+                class dbus send_msg;
+        ')
+
+        allow $1 ntpd_t:dbus send_msg;
+        allow ntpd_t $1:dbus send_msg;
+')
+
+########################################
+## <summary>
+##      Connect to dbus using a unix domain stream socket.
+## </summary>
+## <param name="domain">
+##      <summary>
+##      Domain allowed access.
+##      </summary>
+## </param>
+#
+interface(`ntp_dbus_stream_connect',`
+        gen_require(`
+                type system_dbusd_t, system_dbusd_var_run_t;
+        ')
+
+        files_search_pids($1)
+        stream_connect_pattern($1, system_dbusd_var_run_t, system_dbusd_var_run_t, system_dbusd_t)
+')

diff -pruN -x .git refpolicy-git-18012011/policy/modules/services/ntp.te refpolicy-git-18012011-dbus/policy/modules/services/ntp.te

policy/modules/services/ntp.te +8 -0

@@ -125,11 +125,19 @@ userdom_dontaudit_use_unpriv_user_fds(nt
 userdom_list_user_home_dirs(ntpd_t)
 
 optional_policy(`
+	avahi_dbus_send(ntpd_t)
+')
+
+optional_policy(`
 	# for cron jobs
 	cron_system_entry(ntpd_t, ntpdate_exec_t)
 ')
 
 optional_policy(`
+	ntp_dbus_stream_connect(ntpd_t)
+')
+
+optional_policy(`
 	gpsd_rw_shm(ntpd_t)
 ')
 

diff -pruN -x .git refpolicy-git-18012011/policy/modules/services/setroubleshoot.if refpolicy-git-18012011-dbus/policy/modules/services/setroubleshoot.if

policy/modules/services/setroubleshoot.if +41 -1

@@ -42,6 +42,26 @@ interface(`setroubleshoot_dontaudit_stre
 
 ########################################
 ## <summary>
+##      Send a dbus message to
+##      setroubleshoot.
+## </summary>
+## <param name="domain">
+##      <summary>
+##      Domain allowed access.
+##      </summary>
+## </param>
+#
+interface(`setroubleshoot_dbus_send',`
+        gen_require(`
+                type setroubleshootd_t;
+                class dbus send_msg;
+        ')
+
+        allow $1 setroubleshootd_t:dbus send_msg;
+')
+
+########################################
+## <summary>
 ##	Send and receive messages from
 ##	setroubleshoot over dbus.
 ## </summary>

@@ -84,8 +104,28 @@ interface(`setroubleshoot_dontaudit_dbus
 
 ########################################
 ## <summary>
+##      Send a dbus message to
+##      setroubleshoot fixit.
+## </summary>
+## <param name="domain">
+##      <summary>
+##      Domain allowed access.
+##      </summary>
+## </param>
+#
+interface(`setroubleshoot_dbus_send_fixit',`
+        gen_require(`
+                type setroubleshoot_fixit_t;
+                class dbus send_msg;
+        ')
+
+        allow $1 setroubleshoot_fixit_t:dbus send_msg;
+')
+
+########################################
+## <summary>
 ##	Send and receive messages from
-##	setroubleshoot over dbus.
+##	setroubleshoot fixit over dbus.
 ## </summary>
 ## <param name="domain">
 ##	<summary>

diff -pruN -x .git refpolicy-git-18012011/policy/modules/services/setroubleshoot.te refpolicy-git-18012011-dbus/policy/modules/services/setroubleshoot.te

policy/modules/services/setroubleshoot.te +8 -0

@@ -125,12 +125,20 @@ optional_policy(`
 ')
 
 optional_policy(`
+	logging_dbus_send_dispatcher(setroubleshootd_t)
+')
+
+optional_policy(`
 	rpm_signull(setroubleshootd_t)
 	rpm_read_db(setroubleshootd_t)
 	rpm_dontaudit_manage_db(setroubleshootd_t)
 	rpm_use_script_fds(setroubleshootd_t)
 ')
 
+optional_policy(`
+	xserver_xdm_dbus_send(setroubleshootd_t)
+')
+
 ########################################
 #
 # setroubleshoot_fixit local policy

diff -pruN -x .git refpolicy-git-18012011/policy/modules/services/xserver.if refpolicy-git-18012011-dbus/policy/modules/services/xserver.if

policy/modules/services/xserver.if +40 -0

@@ -1250,3 +1250,43 @@ interface(`xserver_unconfined',`
 	typeattribute $1 x_domain;
 	typeattribute $1 xserver_unconfined_type;
 ')
+
+########################################
+## <summary>
+##      Send a dbus message to xdm. 
+## </summary>
+## <param name="domain">
+##      <summary>
+##      Domain allowed access.
+##      </summary>
+## </param>
+#
+interface(`xserver_xdm_dbus_send',`
+	gen_require(`
+		type xdm_t;
+		class dbus send_msg;
+	')
+
+	allow $1 xdm_t:dbus send_msg;
+')
+
+########################################
+## <summary>
+##      Send and receive messages from
+##      xdm over dbus.
+## </summary>
+## <param name="domain">
+##      <summary>
+##      Domain allowed access.
+##      </summary>
+## </param>
+#
+interface(`xserver_xdm_dbus_chat',`
+        gen_require(`
+                type xdm_t;
+                class dbus send_msg;
+        ')
+
+        allow $1 xdm_t:dbus send_msg;
+        allow xdm_t $1:dbus send_msg;
+')

diff -pruN -x .git refpolicy-git-18012011/policy/modules/services/xserver.te refpolicy-git-18012011-dbus/policy/modules/services/xserver.te

policy/modules/services/xserver.te +25 -0

@@ -508,6 +508,10 @@ optional_policy(`
 ')
 
 optional_policy(`
+	avahi_dbus_send(xdm_t)
+')
+
+optional_policy(`
 	consolekit_dbus_chat(xdm_t)
 ')
 

@@ -516,12 +520,25 @@ optional_policy(`
 ')
 
 optional_policy(`
+	cpufreqselector_dbus_send(xdm_t)
+')
+
+optional_policy(`
+	devicekit_dbus_send_disk(xdm_t)
+	devicekit_dbus_send_power(xdm_t)
+')
+
+optional_policy(`
 	# Talk to the console mouse server.
 	gpm_stream_connect(xdm_t)
 	gpm_setattr_gpmctl(xdm_t)
 ')
 
 optional_policy(`
+	hal_dbus_send(xdm_t)
+')
+
+optional_policy(`
 	hostname_exec(xdm_t)
 ')
 

@@ -539,10 +556,18 @@ optional_policy(`
 ')
 
 optional_policy(`
+	networkmanager_dbus_send(xdm_t)
+')
+
+optional_policy(`
 	resmgr_stream_connect(xdm_t)
 ')
 
 optional_policy(`
+	setroubleshoot_dbus_send(xdm_t)
+')
+
+optional_policy(`
 	seutil_sigchld_newrole(xdm_t)
 ')
 

diff -pruN -x .git refpolicy-git-18012011/policy/modules/system/logging.if refpolicy-git-18012011-dbus/policy/modules/system/logging.if

policy/modules/system/logging.if +7 -0

@@ -337,6 +337,47 @@ interface(`logging_stream_connect_dispat
 
 ########################################
 ## <summary>
+##      Send a dbus message to the audit
+##      dispatcher.
+## </summary>
+## <param name="domain">
+##      <summary>
+##      Domain allowed access.
+##      </summary>

policy/modules/system/logging.if +23 -0

+########################################
+## <summary>
+##      Send and receive messages from
+##      the audit dispatcher over dbus.
+## </summary>
+## <param name="domain">
+##      <summary>
+##      Domain allowed access.
+##      </summary>
+## </param>
+#
+interface(`logging_dbus_chat_dispatcher',`
+	gen_require(`
+		type audisp_t;
+		class dbus send_msg;
+	')
+
+	allow $1 audisp_t:dbus send_msg;
+	allow audisp_t $1:dbus send_msg;
+')
+
+########################################
+## <summary>
 ##	Manage the auditd configuration files.
 ## </summary>
 ## <param name="domain">

diff -pruN -x .git refpolicy-git-18012011/policy/modules/system/logging.te refpolicy-git-18012011-dbus/policy/modules/system/logging.te

policy/modules/system/logging.te +1 -0

+
 ########################################
 #
 # Audit remote logger local policy

_______________________________________________
refpolicy mailing list
refpolicy at oss.tresys.com
http://oss.tresys.com/mailman/listinfo/refpolicy

On 01/24/2011 01:43 AM, Guido Trentalancia wrote:

Quoted 6 lines

diff -pruN -x .git refpolicy-git-18012011/policy/modules/apps/cpufreqselector.if refpolicy-git-18012011-dbus/policy/modules/apps/cpufreqselector.if

policy/modules/apps/cpufreqselector.if +1 -0

@@ -1 +1,42 @@
  ##<summary>Command-line CPU frequency settings.</summary>
+

Quoted 14 lines

diff -pruN -x .git refpolicy-git-18012011/policy/modules/system/logging.if refpolicy-git-18012011-dbus/policy/modules/system/logging.if

policy/modules/system/logging.if +7 -0

@@ -337,6 +337,47 @@ interface(`logging_stream_connect_dispat
 
  ########################################
  ##<summary>
+##      Send a dbus message to the audit
+##      dispatcher.
+##</summary>
+##<param name="domain">
+##<summary>
+##      Domain allowed access.
+##</summary>

policy/modules/system/logging.if interface(`logging_stream_connect_dispat · line 356

Quoted 10 lines

policy/modules/system/logging.if +10 -0

+##</param>
+#
+interface(`logging_dbus_send_dispatcher',`
+	gen_require(`
+		type audisp_t;
+		class dbus send_msg;
+	')
+
+	allow $1 audisp_t:dbus send_msg;
+')

Not required use logging_dbus_chat_audisp()

Although i doubt that audisp has dbus functionality at all in the first place. (i may well be wrong)

Quoted 33 lines

policy/modules/system/logging.if +23 -0

+########################################
+##<summary>
+##      Send and receive messages from
+##      the audit dispatcher over dbus.
+##</summary>
+##<param name="domain">
+##<summary>
+##      Domain allowed access.
+##</summary>
+##</param>
+#
+interface(`logging_dbus_chat_dispatcher',`
+	gen_require(`
+		type audisp_t;
+		class dbus send_msg;
+	')
+
+	allow $1 audisp_t:dbus send_msg;
+	allow audisp_t $1:dbus send_msg;
+')
+
+########################################
+##<summary>
  ##	Manage the auditd configuration files.
  ##</summary>
  ##<param name="domain">

diff -pruN -x .git refpolicy-git-18012011/policy/modules/system/logging.te refpolicy-git-18012011-dbus/policy/modules/system/logging.te

policy/modules/system/logging.te +0 -0

@@ -246,6 +246,10 @@ optional_policy(`
  	dbus_system_bus_client(audisp_t)
  ')
 

policy/modules/system/logging.te optional_policy(` · line 251

Quoted 3 lines

policy/modules/system/logging.te +3 -0

+optional_policy(`
+	setroubleshoot_dbus_send(audisp_t)
+')

This should take care of chatting to audisp_t so the logging interfaces above may no longer be needed.

I would have used setroubleshoot_dbus_chat() though

Quoted 1 line · Dominick Grift

On 01/24/2011 01:43 AM, Guido Trentalancia wrote:

Please include descriptions on each of your patches. The subject is definitely insufficient. I guess this is all the dbus changes you suggest? More

Quoted 6 lines

Quoted 6 lines

diff -pruN -x .git refpolicy-git-18012011/policy/modules/apps/cpufreqselector.if refpolicy-git-18012011-dbus/policy/modules/apps/cpufreqselector.if

policy/modules/apps/cpufreqselector.if +1 -0

@@ -1 +1,42 @@
  ##<summary>Command-line CPU frequency settings.</summary>
+

[cut]

Quoted 28 lines

Quoted 14 lines

diff -pruN -x .git refpolicy-git-18012011/policy/modules/system/logging.if refpolicy-git-18012011-dbus/policy/modules/system/logging.if

policy/modules/system/logging.if +7 -0

@@ -337,6 +337,47 @@ interface(`logging_stream_connect_dispat
 
  ########################################
  ##<summary>
+##      Send a dbus message to the audit
+##      dispatcher.
+##</summary>
+##<param name="domain">
+##<summary>
+##      Domain allowed access.
+##</summary>

policy/modules/system/logging.if interface(`logging_stream_connect_dispat · line 356

Quoted 10 lines

policy/modules/system/logging.if +10 -0

+##</param>
+#
+interface(`logging_dbus_send_dispatcher',`
+	gen_require(`
+		type audisp_t;
+		class dbus send_msg;
+	')
+
+	allow $1 audisp_t:dbus send_msg;
+')

Not required use logging_dbus_chat_audisp()

Quoted 2 lines

Although i doubt that audisp has dbus functionality at all in the first place. (i may well be wrong)

I believe the purpose of this dbus functionality is for auditd to send (via audisp) a message to setroubleshoot when there is a denial.

Quoted 33 lines

Quoted 33 lines

policy/modules/system/logging.if +23 -0

+########################################
+##<summary>
+##      Send and receive messages from
+##      the audit dispatcher over dbus.
+##</summary>
+##<param name="domain">
+##<summary>
+##      Domain allowed access.
+##</summary>
+##</param>
+#
+interface(`logging_dbus_chat_dispatcher',`
+	gen_require(`
+		type audisp_t;
+		class dbus send_msg;
+	')
+
+	allow $1 audisp_t:dbus send_msg;
+	allow audisp_t $1:dbus send_msg;
+')
+
+########################################
+##<summary>
  ##	Manage the auditd configuration files.
  ##</summary>
  ##<param name="domain">

diff -pruN -x .git refpolicy-git-18012011/policy/modules/system/logging.te refpolicy-git-18012011-dbus/policy/modules/system/logging.te

policy/modules/system/logging.te +0 -0

@@ -246,6 +246,10 @@ optional_policy(`
  	dbus_system_bus_client(audisp_t)
  ')
 

Quoted 8 lines

policy/modules/system/logging.te optional_policy(` · line 251

Quoted 3 lines

policy/modules/system/logging.te +3 -0

+optional_policy(`
+	setroubleshoot_dbus_send(audisp_t)
+')

This should take care of chatting to audisp_t so the logging interfaces above may no longer be needed.

I would have used setroubleshoot_dbus_chat() though

Its unclear, though I would think that send would be sufficient. I don't see a need for there to be a response to audisp.

Quoted 22 lines · Guido Trentalancia

Hello again Christopher !

Quoted 6 lines · Christopher J. PeBenito

Quoted 1 line · Dominick Grift

On 01/24/2011 01:43 AM, Guido Trentalancia wrote:

Please include descriptions on each of your patches. The subject is definitely insufficient. I guess this is all the dbus changes you suggest? More

The DBus send_msg issue is the probably the main change introduced by the set of patches that I am proposing.

The issue is very wide and needs careful approval. It's not limited to this [2/19] patch/thread at all. It is mainly a style issue, but it's an important one.

In my reply to [0/19] I have pointed out a few threads where such issue has been discussed more extensively between me and Dominick, because we kept having different point of views and none of us managed to definitely persuade the other !

Quoted 6 lines

In any case, [2/19] and [8/19] are perhaps the most relevant places where you can provide a definite direction on this (in short, can we really talk about an hypothetical DBus "chat" throughout all refpolicy and model interfaces accordingly to such assumption when on the other hand the elementary data-flow in DBus is constituted by a uni-directional message called "signal" ?).

There already is an established verb for unidirectional dbus messaging:
send. See unconfined_dbus_send() for an example. If there is unidirectional messaging, the policy should reflect that.

Quoted 40 lines · Guido Trentalancia

Hello Christopher !

Quoted 30 lines · Christopher J. PeBenito

Quoted 22 lines · Guido Trentalancia

Hello again Christopher !

Quoted 6 lines · Christopher J. PeBenito

Quoted 1 line · Dominick Grift

On 01/24/2011 01:43 AM, Guido Trentalancia wrote:

Please include descriptions on each of your patches. The subject is definitely insufficient. I guess this is all the dbus changes you suggest? More

The DBus send_msg issue is the probably the main change introduced by the set of patches that I am proposing.

The issue is very wide and needs careful approval. It's not limited to this [2/19] patch/thread at all. It is mainly a style issue, but it's an important one.

In my reply to [0/19] I have pointed out a few threads where such issue has been discussed more extensively between me and Dominick, because we kept having different point of views and none of us managed to definitely persuade the other !

Quoted 6 lines

In any case, [2/19] and [8/19] are perhaps the most relevant places where you can provide a definite direction on this (in short, can we really talk about an hypothetical DBus "chat" throughout all refpolicy and model interfaces accordingly to such assumption when on the other hand the elementary data-flow in DBus is constituted by a uni-directional message called "signal" ?).

Quoted 3 lines

There already is an established verb for unidirectional dbus messaging:
send. See unconfined_dbus_send() for an example. If there is unidirectional messaging, the policy should reflect that.

Yes, unconfined_dbus_send() can be used in the context of the unconfined domain.

Quoted 7 lines

But then there are many other circumstances where DBus messaging needs to take place. My original dbus-messaging patch ([2/19]) contains several examples of where this appears to be needed.

I prefer to grant two distinct and separate uni-directional send_msg permissions in the two relevant modules anyway (even in the case of bi-directional messaging).

I'm not sure if I understand. Are you saying that you want to break apart the chat interfaces into individual send interfaces?

eg:

networkmanager_dbus_chat(hald_t)

turns into

networkmanager_dbus_send(hald_t)
hald_dbus_send(networkmanager_t)

(of course these would be in the proper modules)

Quoted 2 lines

Therefore, I have always created new *_dbus_send() interfaces even where *_dbus_chat() interfaces were present (and could in theory be used).

I don't have a problem with this.

The DBus send_msg issue is the probably the main change introduced by the set of patches that I am proposing.

The issue is very wide and needs careful approval. It's not limited to this [2/19] patch/thread at all. It is mainly a style issue, but it's an important one.

In any case, [2/19] and [8/19] are perhaps the most relevant places where you can provide a definite direction on this (in short, can we really talk about an hypothetical DBus "chat" throughout all refpolicy and model interfaces accordingly to such assumption when on the other hand the elementary data-flow in DBus is constituted by a uni-directional message called "signal" ?).

Quoted 7 lines · Guido Trentalancia

The DBus send_msg issue is the probably the main change introduced by the set of patches that I am proposing.

The issue is very wide and needs careful approval. It's not limited to this [2/19] patch/thread at all. It is mainly a style issue, but it's an important one.

Quoted 6 lines

In any case, [2/19] and [8/19] are perhaps the most relevant places where you can provide a definite direction on this (in short, can we really talk about an hypothetical DBus "chat" throughout all refpolicy and model interfaces accordingly to such assumption when on the other hand the elementary data-flow in DBus is constituted by a uni-directional message called "signal" ?).

I think that it is often better to think about "chats". Often one process A (e.g. consolekit or setroubleshoot) provides a service which many other processes B can use by sending a DBus message to A. A only sends messages to B after getting messages from B.

In this case, I think it is likely to be more maintainable if each module B uses A_dbus_chat, instead of putting a big list of all the possible B into module A. I do not care strongly about it however.