: patch to list/read consolekit pid files

This patch adds a new interface to the consolekit module so that pid files can be listed. It then uses such interface so that consolekit pid files can be listed and read by both dbus and policykit.

diff -pruN refpolicy-git-02022011-test-apply/policy/modules/services/consolekit.if refpolicy-git-02022011-test-apply2/policy/modules/services/consolekit.if

policy/modules/services/consolekit.if +18 -0

@@ -79,6 +79,24 @@ interface(`consolekit_manage_log',`
 
 ########################################
 ## <summary>
+##      List consolekit PID files.
+## </summary>
+## <param name="domain">
+##      <summary>
+##      Domain allowed access.
+##      </summary>
+## </param>
+#
+interface(`consolekit_list_pid_files',`
+	gen_require(`
+		type consolekit_var_run_t;
+	')
+
+	list_dirs_pattern($1, consolekit_var_run_t, consolekit_var_run_t)
+')
+
+########################################
+## <summary>
 ##	Read consolekit PID files.
 ## </summary>
 ## <param name="domain">

diff -pruN refpolicy-git-02022011-test-apply/policy/modules/services/dbus.te refpolicy-git-02022011-test-apply2/policy/modules/services/dbus.te

policy/modules/services/dbus.te +5 -0

@@ -141,6 +141,11 @@ optional_policy(`
 ')
 
 optional_policy(`
+	consolekit_list_pid_files(system_dbusd_t)
+	consolekit_read_pid_files(system_dbusd_t)
+')
+
+optional_policy(`
 	cpufreqselector_dbus_chat(system_dbusd_t)
 ')
 

diff -pruN refpolicy-git-02022011-test-apply/policy/modules/services/policykit.te refpolicy-git-02022011-test-apply2/policy/modules/services/policykit.te

Quoted 53 lines · Guido Trentalancia

This patch adds a new interface to the consolekit module so that pid files can be listed. It then uses such interface so that consolekit pid files can be listed and read by both dbus and policykit.

diff -pruN refpolicy-git-02022011-test-apply/policy/modules/services/consolekit.if refpolicy-git-02022011-test-apply2/policy/modules/services/consolekit.if

policy/modules/services/consolekit.if +18 -0

@@ -79,6 +79,24 @@ interface(`consolekit_manage_log',`
 
 ########################################
 ## <summary>
+##      List consolekit PID files.
+## </summary>
+## <param name="domain">
+##      <summary>
+##      Domain allowed access.
+##      </summary>
+## </param>
+#
+interface(`consolekit_list_pid_files',`
+	gen_require(`
+		type consolekit_var_run_t;
+	')
+
+	list_dirs_pattern($1, consolekit_var_run_t, consolekit_var_run_t)
+')
+
+########################################
+## <summary>
 ##	Read consolekit PID files.
 ## </summary>
 ## <param name="domain">

diff -pruN refpolicy-git-02022011-test-apply/policy/modules/services/dbus.te refpolicy-git-02022011-test-apply2/policy/modules/services/dbus.te

policy/modules/services/dbus.te +5 -0

@@ -141,6 +141,11 @@ optional_policy(`
 ')
 
 optional_policy(`
+	consolekit_list_pid_files(system_dbusd_t)
+	consolekit_read_pid_files(system_dbusd_t)
+')
+
+optional_policy(`
 	cpufreqselector_dbus_chat(system_dbusd_t)
 ')
 

diff -pruN refpolicy-git-02022011-test-apply/policy/modules/services/policykit.te refpolicy-git-02022011-test-apply2/policy/modules/services/policykit.te

policy/modules/services/policykit.te +0 -0

@@ -70,6 +70,11 @@ miscfiles_read_localization(policykit_t)
 userdom_read_all_users_state(policykit_t)
 

policy/modules/services/policykit.te miscfiles_read_localization(policykit_t) · line 79

Quoted 8 lines

policy/modules/services/policykit.te +5 -0

 optional_policy(`
+	consolekit_list_pid_files(policykit_t)
+	consolekit_read_pid_files(policykit_t)
+')
+
+optional_policy(`
 	gnome_read_config(policykit_t)
 ')

I think it would be fine just to add the list permission to the read_pid_files interface.