Re: [PATCH] refpolicy: add X object classes to unconfined_t

["Christopher J. PeBenito" <cpebenito@tresys.com>]

On Fri, 2006-09-15 at 17:19 -0400, Eamon Walsh wrote:
> On Fri, 2006-09-15 at 08:46 -0400, Joshua Brindle wrote:
> > On Thu, 2006-09-14 at 10:10 -0400, Joshua Brindle wrote:
> [snip]
> > It also seems that the XSELinuxConfig in the git repository doesn't have
> > all the necessary entries, one for root_window_context needs to be added
> > to start the X server up.
> 
> I've been using the attached config file, however, without the
> unconfined_t patch for targeted, it still won't work unless in
> permissive mode.

I'm not convinced the original patch should go in refpolicy.  What we
need to do is reestablish all the types for the X server properties,
extensions, etc.  Then the unconfined rules would use all the the above,
and then have access to all domains' windows, etc.  Its hard for me to
articulate, since I don't know how all the X object classes work.  What
I'd really like to see would be an example policy.

-- 
Chris PeBenito
Tresys Technology, LLC
(410) 290-1411 x150


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.