xserver_t needs to enter dirs labeled xdm_var_run_t
PATCH 1/1 xserver_t needs to enter dirs labeled xdm_var_run_t
The LightDM application stores its xauth file in a subdirectory (/var/run/lightdm/root) which is labeled as xdm_var_run_t. As a result, X11 (xserver_t) needs search rights to this location.
With this setup, X is run as follows:
/usr/bin/X :0 -auth /var/run/lightdm/root/:0
--- policy/modules/services/xserver.te | 1 + 1 file changed, 1 insertion(+)
policy/modules/services/xserver.te +1 -0
@@ -821,6 +821,7 @@ allow xserver_t xdm_var_lib_t:file { getattr read }; dontaudit xserver_t xdm_var_lib_t:dir search; allow xserver_t xdm_var_run_t:file read_file_perms; +allow xserver_t xdm_var_run_t:dir search_dir_perms; # Label pid and temporary files with derived types. manage_files_pattern(xserver_t, xdm_tmp_t, xdm_tmp_t)
Signature · 1 line
1.8.5.5
PATCH 1/1 xserver_t needs to enter dirs labeled xdm_var_run_t
Quoted 18 lines · Sven Vermeulen
The LightDM application stores its xauth file in a subdirectory (
/var/run/lightdm/root) which is labeled asxdm_var_run_t. As a result, X11 (xserver_t) needs search rights to this location.With this setup, X is run as follows:
/usr/bin/X:0 -auth/var/run/lightdm/root/:0Signed-off-by Jason Zaman <[email protected]>Signed-off-by Sven Vermeulen <[email protected]>--- policy/modules/services/xserver.te | 1 + 1 file changed, 1 insertion(+)policy/modules/services/xserver.te +0
-0
policy/modules/services/xserver.te allow xserver_t xdm_var_lib_t:file { getattr read }; · line 827
Quoted 7 lines
policy/modules/services/xserver.te +1
-0@@ -821,6 +821,7 @@ allow xserver_t xdm_var_lib_t:file { getattr read }; dontaudit xserver_t xdm_var_lib_t:dir search; allow xserver_t xdm_var_run_t:file read_file_perms; +allow xserver_t xdm_var_run_t:dir search_dir_perms; # Label pid and temporary files with derived types. manage_files_pattern(xserver_t, xdm_tmp_t, xdm_tmp_t)
I'd prefer to change that added line and the line above it to read_files_pattern.
Signature · 3 lines
Chris PeBenito Tresys Technology, LLC www.tresys.com | oss.tresys.com