* [PATCH] refpolicy: experimental X policy
@ 2007-01-25 23:10 Eamon Walsh
2007-02-02 16:53 ` Ted X Toth
2007-02-13 20:26 ` Xavier Toth
0 siblings, 2 replies; 12+ messages in thread
From: Eamon Walsh @ 2007-01-25 23:10 UTC (permalink / raw)
To: selinux
This is an experimental policy for use with the X userspace object
manager. It includes both unconfined and strict policy and is
controlled by a tunable, xwindows_object_manager. The labeling conf
file in the X.org xserver git (XACE-SELINUX branch) assumes that this
policy is loaded, i.e. the types listed in that file are defined in this
policy.
The target audience for this is people experimenting with the X object
manager.
Signed-off-by: Eamon Walsh <ewalsh@tycho.nsa.gov>
---
policy/global_tunables | 7
policy/modules/services/xserver.if | 14
policy/modules/services/xwindows.fc | 13
policy/modules/services/xwindows.if | 522 ++++++++++++++++++++++++++++++++++++
policy/modules/services/xwindows.te | 65 ++++
policy/modules/system/unconfined.if | 24 +
6 files changed, 645 insertions(+)
---
Index: policy/modules/services/xwindows.te
===================================================================
--- policy/modules/services/xwindows.te (revision 0)
+++ policy/modules/services/xwindows.te (revision 0)
@@ -0,0 +1,65 @@
+
+policy_module(xwindows,1.0.0)
+
+########################################
+#
+# Declarations
+#
+
+# X Window System userspace-managed objects
+attribute xclient_type;
+attribute xwindow_type;
+attribute xproperty_type;
+attribute xextension_type;
+
+# Default type for remotely connected clients
+type remote_xclient_t, xclient_type;
+
+# X Property types and attributes
+attribute client_xproperty_type;
+attribute info_xproperty_type;
+attribute seclabel_xproperty_type;
+attribute rm_xproperty_type;
+attribute wm_xproperty_type;
+attribute clipboard_xproperty_type;
+attribute unknown_xproperty_type;
+
+type client_xproperty_t, client_xproperty_type, xproperty_type;
+type info_xproperty_t, info_xproperty_type, xproperty_type;
+type seclabel_xproperty_t, seclabel_xproperty_type, xproperty_type;
+type rm_xproperty_t, rm_xproperty_type, xproperty_type;
+type wm_xproperty_t, wm_xproperty_type, xproperty_type;
+type clipboard_xproperty_t, clipboard_xproperty_type, xproperty_type;
+type unknown_xproperty_t, unknown_xproperty_type, xproperty_type;
+
+# X Extension types
+type accelgraphics_xext_t, xextension_type;
+type debug_xext_t, xextension_type;
+type font_xext_t, xextension_type;
+type input_xext_t, xextension_type;
+type output_xext_t, xextension_type;
+type screensaver_xext_t, xextension_type;
+type security_xext_t, xextension_type;
+type shmem_xext_t, xextension_type;
+type std_xext_t, xextension_type;
+type video_xext_t, xextension_type;
+type unknown_xext_t, xextension_type;
+type windowmgr_xext_t, xextension_type;
+
+
+# X client domains
+
+# Display Manager
+# defined in services/xserver.te
+
+# Window Manager
+type xwm_exec_t;
+corecmd_executable_file(xwm_exec_t)
+
+# Resource Manager
+type xrdb_exec_t;
+corecmd_executable_file(xrdb_exec_t)
+
+# Protected test client
+type xprotected_exec_t;
+corecmd_executable_file(xprotected_exec_t)
Index: policy/modules/services/xwindows.fc
===================================================================
--- policy/modules/services/xwindows.fc (revision 0)
+++ policy/modules/services/xwindows.fc (revision 0)
@@ -0,0 +1,13 @@
+#
+# /usr
+#
+
+/usr/bin/(t|m|fv)wm -- gen_context(system_u:object_r:xwm_exec_t,s0)
+/usr/bin/metacity -- gen_context(system_u:object_r:xwm_exec_t,s0)
+/usr/bin/xrdb -- gen_context(system_u:object_r:xrdb_exec_t,s0)
+/usr/bin/xeyes -- gen_context(system_u:object_r:xprotected_exec_t,s0)
+
+/usr/X11R6/bin/(t|m|fv)wm -- gen_context(system_u:object_r:xwm_exec_t,s0)
+/usr/X11R6/bin/metacity -- gen_context(system_u:object_r:xwm_exec_t,s0)
+/usr/X11R6/bin/xrdb -- gen_context(system_u:object_r:xrdb_exec_t,s0)
+/usr/X11R6/bin/xeyes -- gen_context(system_u:object_r:xprotected_exec_t,s0)
Index: policy/modules/services/xwindows.if
===================================================================
--- policy/modules/services/xwindows.if (revision 0)
+++ policy/modules/services/xwindows.if (revision 0)
@@ -0,0 +1,522 @@
+## <summary>X Window System Userspace Object Manager</summary>
+
+#######################################
+## <summary>
+## Declares a single X property type using a user prefix
+## and base type, along with appropriate transition rules.
+## </summary>
+## <param name="prefix">
+## <summary>
+## The prefix of the domain (e.g., user
+## is the prefix for user_t).
+## </summary>
+## </param>
+## <param name="type">
+## <summary>
+## Base X property type
+## </summary>
+## </param>
+#
+template(`xwindows_property',`
+ gen_require(`
+ type $1_t;
+ type $2;
+ attribute xproperty_type;
+ attribute $1_xproperty_type;
+ attribute $2ype;
+ class property all_property_perms;
+ ')
+
+ ##############################
+ #
+ # Declarations
+ #
+
+ type $1_$2, $1_xproperty_type, $2ype, xproperty_type;
+ type_transition $1_t $2:property $1_$2;
+')
+
+#######################################
+## <summary>
+## Declares a set of X property types for use with an X
+## client domain.
+## </summary>
+## <param name="prefix">
+## <summary>
+## The prefix of the domain (e.g., user
+## is the prefix for user_t).
+## </summary>
+## </param>
+#
+template(`xwindows_property_set',`
+
+ ##############################
+ #
+ # Declarations
+ #
+
+ attribute $1_xproperty_type;
+ xwindows_property($1,client_xproperty_t)
+ xwindows_property($1,info_xproperty_t)
+ xwindows_property($1,seclabel_xproperty_t)
+ xwindows_property($1,rm_xproperty_t)
+ xwindows_property($1,wm_xproperty_t)
+ xwindows_property($1,clipboard_xproperty_t)
+ xwindows_property($1,unknown_xproperty_t)
+')
+
+#######################################
+## <summary>
+## Template to provide X object permissions on a given X server to
+## an X client domain. Provides the minimal set required by a basic
+## X client application.
+## </summary>
+## <param name="server_prefix">
+## <summary>
+## The prefix of the server domain (e.g., user
+## is the prefix for user_t).
+## </summary>
+## </param>
+## <param name="prefix">
+## <summary>
+## The prefix of the client domain (e.g., user
+## is the prefix for user_t).
+## </summary>
+## </param>
+## <param name="domain">
+## <summary>
+## Client domain allowed access.
+## </summary>
+## </param>
+## <param name="role">
+## <summary>
+## The role associated with the client domain.
+## </summary>
+## </param>
+#
+template(`xwindows_basic_client',`
+ gen_require(`
+ type $1_xserver_t;
+ type $1_root_window_t;
+ type $1_xserver_rm_xproperty_t;
+ type $2_info_xproperty_t;
+ type $1_xserver_info_xproperty_t;
+ type $1_xserver_clipboard_xproperty_t;
+ type $2_client_xproperty_t;
+ attribute $2_xproperty_type;
+ class drawable all_drawable_perms;
+ class window all_window_perms;
+ class gc all_gc_perms;
+ class font all_font_perms;
+ class colormap all_colormap_perms;
+ class property all_property_perms;
+ class cursor all_cursor_perms;
+ class xclient all_xclient_perms;
+ class xserver all_xserver_perms;
+ class xinput all_xinput_perms;
+ class xextension all_xextension_perms;
+ ')
+
+ ##############################
+ #
+ # Local Policy
+ #
+
+ tunable_policy(`xwindows_object_manager',`
+ # X Protocol Extensions
+ allow $3 xextension_type:xextension query;
+ allow $3 std_xext_t:xextension use;
+ allow $3 input_xext_t:xextension use;
+ allow $3 font_xext_t:xextension use;
+ allow $3 shmem_xext_t:xextension use;
+
+ # X Properties
+ # can read resource manager settings on the root window
+ allow $3 $1_xserver_rm_xproperty_t:property read;
+ # can read info properties
+ allow $3 $2_info_xproperty_t:property read;
+ allow $3 $1_xserver_info_xproperty_t:property read;
+ # can read and write client properties
+ allow $3 $2_client_xproperty_t:property { read write free };
+ # can read and write cut buffers on the root window
+ allow $3 $1_xserver_clipboard_xproperty_t:property { read write free };
+
+ # X Windows
+ # can get attributes of root window
+ allow $3 $1_root_window_t:window getattr;
+ # can add children to root window
+ allow $3 $1_root_window_t:window { addchild chstack };
+ # can change properties of root window
+ allow $3 $1_root_window_t:window { listprop chprop chproplist };
+
+ # can query window manager windows (GTK2 thing?)
+ # allow $3 $1_xwm_t:window { enumerate getattr };
+ # allow $3 $1_xwm_t:drawable getattr;
+
+ # X Fonts
+ allow $3 self:font { use free };
+
+ # X Input
+ # can set focus on own windows
+ allow $3 self:window setfocus;
+ allow $3 $1_xserver_t:xinput { setfocus getattr };
+ # can track mouse motions on own windows
+ allow $3 self:window mousemotion;
+ # can create and use cursors
+ allow $3 self:cursor { createglyph setattr free };
+ # can set selections on own windows
+ allow $3 self:window chselection;
+
+ # X Drawing
+ # can query root window attributes
+ allow $3 $1_root_window_t:drawable getattr;
+ allow $3 $1_xserver_t:colormap { read store };
+ allow $3 $1_xserver_t:font { load use free };
+ allow $3 self:drawable { create getattr draw copy destroy };
+ allow $3 self:gc { create setattr free };
+ allow $3 self:window { addchild chprop chproplist chstack create destroy enumerate getattr listprop map move setattr unmap };
+ ')
+')
+
+#######################################
+## <summary>
+## Template to provide X object permissions to an X window manager.
+## </summary>
+## <param name="server_prefix">
+## <summary>
+## The prefix of the server domain (e.g., user
+## is the prefix for user_t).
+## </summary>
+## </param>
+## <param name="prefix">
+## <summary>
+## The prefix of the client domain (e.g., user
+## is the prefix for user_t).
+## </summary>
+## </param>
+## <param name="domain">
+## <summary>
+## Client domain allowed access.
+## </summary>
+## </param>
+## <param name="role">
+## <summary>
+## The role associated with the client domain.
+## </summary>
+## </param>
+#
+template(`xwindows_windowmgr_client',`
+ gen_require(`
+ class xextension use;
+ ')
+
+ ##############################
+ #
+ # Declarations
+ #
+
+ xwindows_basic_client($1,$2,$3,$4)
+
+ ##############################
+ #
+ # Local Policy
+ #
+
+ tunable_policy(`xwindows_object_manager',`
+ # X Protocol Extensions
+ allow $3 windowmgr_xext_t:xextension use;
+
+ # X Properties
+ # can read all security labels
+ allow $3 seclabel_xproperty_type:property read;
+ # can read and write all wm-specific properties
+ allow $3 wm_xproperty_type:property { read write };
+ # can set properties on all windows
+ allow $3 domain:window { chprop chproplist };
+
+ # can install colormaps
+ allow $3 $1_xserver_t:colormap install;
+
+ # X Windows - extensive control over all windows
+ # can query windows for visual information
+ allow $3 domain:drawable getattr;
+ # can enumerate and change attributes of root window
+ allow $3 $1_root_window_t:window { enumerate setattr };
+ # can enumerate, set, and change attributes of all non-root windows
+ allow $3 domain:window { enumerate getattr setattr };
+ # can map and unmap all non-root windows
+ allow $3 domain:window { map unmap move ctrllife };
+ # can send various events to all non-root windows
+ allow $3 domain:window { windowchangeevent clientcomevent };
+ # can reparent all non-root windows
+ allow $3 domain:window { chparent chstack };
+ # can list properties of all non-root windows
+ allow $3 domain:window listprop;
+
+ # X Input
+ # can change input focus on all windows
+ allow $3 domain:window setfocus;
+ allow $3 $1_root_window_t:window setfocus;
+ allow $3 $1_xserver_t:xinput setfocus;
+ # can move the mouse cursor
+ allow $3 $1_xserver_t:xinput warppointer;
+ # can grab server
+ allow $3 $1_xserver_t:xserver { grab ungrab };
+ allow $3 $1_xserver_t:xinput { activegrab passivegrab ungrab };
+
+ # X Drawing
+ # can draw on the root window
+ allow $3 $1_root_window_t:drawable draw;
+ ')
+')
+
+#######################################
+## <summary>
+## Template to provide X object permissions to an X display manager.
+## </summary>
+## <param name="server_prefix">
+## <summary>
+## The prefix of the server domain (e.g., user
+## is the prefix for user_t).
+## </summary>
+## </param>
+## <param name="prefix">
+## <summary>
+## The prefix of the client domain (e.g., user
+## is the prefix for user_t).
+## </summary>
+## </param>
+## <param name="domain">
+## <summary>
+## Client domain allowed access.
+## </summary>
+## </param>
+## <param name="role">
+## <summary>
+## The role associated with the client domain.
+## </summary>
+## </param>
+#
+template(`xwindows_displaymgr_client',`
+ gen_require(`
+ class xextension use;
+ ')
+
+ ##############################
+ #
+ # Declarations
+ #
+
+ xwindows_basic_client($1,$2,$3,$4)
+
+ ##############################
+ #
+ # Local Policy
+ #
+
+ tunable_policy(`xwindows_object_manager',`
+ # X Protocol Extensions
+ allow $3 output_xext_t:xextension use;
+
+ # allow server grabs
+ allow $3 $1_xserver_t:xserver { grab ungrab };
+ allow $3 $1_xserver_t:xinput { getattr activegrab };
+
+ # can move the mouse cursor
+ allow $3 $1_xserver_t:xinput warppointer;
+
+ # can set resource manager properties
+ allow $3 $2_rm_xproperty_t:property { write free };
+
+ # can enumerate windows
+ allow $3 $1_root_window_t:window enumerate;
+ ')
+')
+
+#######################################
+## <summary>
+## Template to provide X object permissions to an X resource manager.
+## </summary>
+## <param name="server_prefix">
+## <summary>
+## The prefix of the server domain (e.g., user
+## is the prefix for user_t).
+## </summary>
+## </param>
+## <param name="prefix">
+## <summary>
+## The prefix of the client domain (e.g., user
+## is the prefix for user_t).
+## </summary>
+## </param>
+## <param name="domain">
+## <summary>
+## Client domain allowed access.
+## </summary>
+## </param>
+## <param name="role">
+## <summary>
+## The role associated with the client domain.
+## </summary>
+## </param>
+#
+template(`xwindows_resourcemgr_client',`
+ gen_require(`
+ class property all_property_perms;
+ ')
+
+ ##############################
+ #
+ # Local Policy
+ #
+
+ tunable_policy(`xwindows_object_manager',`
+ # X Properties
+ # can read and write resource manager settings
+ allow $3 $2_rm_xproperty_t:property { read write };
+ ')
+')
+
+#######################################
+## <summary>
+## Template to provide X object permissions to an X server domain.
+## </summary>
+## <param name="prefix">
+## <summary>
+## The prefix of the domain (e.g., user
+## is the prefix for user_t).
+## </summary>
+## </param>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+## <param name="role">
+## <summary>
+## The role associated with the domain.
+## </summary>
+## </param>
+#
+template(`xwindows_server',`
+ gen_require(`
+ attribute xwindow_type;
+ class window map;
+ class drawable draw;
+ ')
+
+ ##############################
+ #
+ # Declarations
+ #
+
+ # Type for the root window
+ type $1_root_window_t, xwindow_type;
+ role $3 types $1_root_window_t;
+
+ # Types for properties
+ xwindows_property_set($1_xserver)
+ role $3 types $1_xserver_xproperty_type;
+
+ ##############################
+ #
+ # Local Policy
+ #
+
+ tunable_policy(`xwindows_object_manager',`
+ # Labeling rules for root windows
+ type_transition $2 $2:window $1_root_window_t;
+ type_transition $2 $2:drawable $1_root_window_t;
+
+ # Allow server to map the root window
+ allow $2 $1_root_window_t:window map;
+ ')
+')
+
+#######################################
+## <summary>
+## The per role template for the xwindows module.
+## </summary>
+## <desc>
+## <p>
+## This template creates a derived domains which are used
+## for X userspace object manager related programs.
+## </p>
+## <p>
+## This template is invoked automatically for each user, and
+## generally does not need to be invoked directly
+## by policy writers.
+## </p>
+## </desc>
+## <param name="userdomain_prefix">
+## <summary>
+## The prefix of the user domain (e.g., user
+## is the prefix for user_t).
+## </summary>
+## </param>
+## <param name="user_domain">
+## <summary>
+## The type of the user domain.
+## </summary>
+## </param>
+## <param name="user_role">
+## <summary>
+## The role associated with the user domain.
+## </summary>
+## </param>
+#
+template(`xwindows_per_role_template',`
+
+ ##############################
+ #
+ # Declarations
+ #
+
+ # Types for window managers
+ type $1_xwm_t;
+ domain_type($1_xwm_t)
+ domain_entry_file($1_xwm_t,xwm_exec_t)
+ role $3 types $1_xwm_t;
+
+ # Types for resource managers
+ type $1_xrdb_t;
+ domain_type($1_xrdb_t)
+ domain_entry_file($1_xrdb_t,xrdb_exec_t)
+ role $3 types $1_xrdb_t;
+
+ # Protected test type
+ type $1_xprotected_t;
+ domain_type($1_xprotected_t)
+ domain_entry_file($1_xprotected_t,xprotected_exec_t)
+ role $3 types $1_xprotected_t;
+
+ # Types for properties
+ xwindows_property_set($1)
+ role $3 types $1_xproperty_type;
+ xwindows_property_set($1_xwm)
+ role $3 types $1_xwm_xproperty_type;
+ xwindows_property_set($1_xrdb)
+ role $3 types $1_xrdb_xproperty_type;
+ xwindows_property_set($1_xprotected)
+ role $3 types $1_xprotected_xproperty_type;
+
+ # Basic default client
+ xwindows_basic_client($1,$1,$1_t,$3)
+
+ # Other clients
+ xwindows_basic_client($1,$1_xprotected,$1_xprotected_t,$3)
+ xwindows_windowmgr_client($1,$1_xwm,$1_xwm_t,$3)
+ xwindows_resourcemgr_client($1,$1_xrdb,$1_xrdb_t,$3)
+
+ ##############################
+ #
+ # Local Policy
+ #
+
+ tunable_policy(`xwindows_object_manager',`
+ domain_auto_trans($2,xwm_exec_t,$1_xwm_t)
+ domain_auto_trans($2, xrdb_exec_t, $1_xrdb_t)
+ domain_auto_trans($2, xprotected_exec_t, $1_xprotected_t)
+ ')
+')
+')
Index: policy/modules/services/xserver.if
===================================================================
--- policy/modules/services/xserver.if (revision 2178)
+++ policy/modules/services/xserver.if (working copy)
@@ -90,6 +90,13 @@
kernel_read_kernel_sysctls($1_xserver_t)
kernel_write_proc_files($1_xserver_t)
+ # X server userspace object manager
+ tunable_policy(`xwindows_object_manager',`
+ allow $1_xserver_t self:netlink_audit_socket create;
+ allow $1_xserver_t self:netlink_selinux_socket { bind create read };
+ allow $1_xserver_t security_t:security { check_context compute_av compute_create };
+ ')
+
# Run helper programs in $1_xserver_t.
corecmd_search_sbin($1_xserver_t)
corecmd_exec_bin($1_xserver_t)
@@ -267,6 +274,13 @@
##############################
#
+ # $1_xserver_t X Userspace Object Manager
+ #
+
+ xwindows_server($1,$1_xserver_t,$3)
+
+ ##############################
+ #
# $1_xserver_t Local policy
#
Index: policy/modules/system/unconfined.if
===================================================================
--- policy/modules/system/unconfined.if (revision 2178)
+++ policy/modules/system/unconfined.if (working copy)
@@ -15,6 +15,17 @@
class dbus all_dbus_perms;
class nscd all_nscd_perms;
class passwd all_passwd_perms;
+ class drawable all_drawable_perms;
+ class window all_window_perms;
+ class gc all_gc_perms;
+ class font all_font_perms;
+ class colormap all_colormap_perms;
+ class property all_property_perms;
+ class cursor all_cursor_perms;
+ class xclient all_xclient_perms;
+ class xserver all_xserver_perms;
+ class xinput all_xinput_perms;
+ class xextension all_xextension_perms;
')
# Use any Linux capability.
@@ -31,6 +42,19 @@
allow $1 self:nscd *;
allow $1 self:dbus *;
allow $1 self:passwd *;
+ tunable_policy(`xwindows_object_manager',`
+ allow $1 self:drawable *;
+ allow $1 self:window *;
+ allow $1 self:gc *;
+ allow $1 self:font *;
+ allow $1 self:colormap *;
+ allow $1 self:property *;
+ allow $1 self:cursor *;
+ allow $1 self:xclient *;
+ allow $1 self:xserver *;
+ allow $1 self:xinput *;
+ allow $1 self:xextension *;
+ ')
kernel_unconfined($1)
corenet_unconfined($1)
Index: policy/global_tunables
===================================================================
--- policy/global_tunables (revision 2178)
+++ policy/global_tunables (working copy)
@@ -348,6 +348,13 @@
## </desc>
gen_tunable(use_samba_home_dirs,false)
+## <desc>
+## <p>
+## Support X userspace object manager
+## </p>
+## </desc>
+gen_tunable(xwindows_object_manager,false)
+
########################################
#
# Strict policy specific
--
Eamon Walsh <ewalsh@tycho.nsa.gov>
National Security Agency
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 12+ messages in thread* Re: [PATCH] refpolicy: experimental X policy
2007-01-25 23:10 [PATCH] refpolicy: experimental X policy Eamon Walsh
@ 2007-02-02 16:53 ` Ted X Toth
2007-02-13 20:26 ` Xavier Toth
1 sibling, 0 replies; 12+ messages in thread
From: Ted X Toth @ 2007-02-02 16:53 UTC (permalink / raw)
To: ewalsh; +Cc: selinux
When I try and start X I'm getting :
(EE) VESA(0): Cannot open /dev/mem
(EE) Screen(s) found, but none have a usable configuration.
Does the policy need to change to allow access to /dev/mem?
Ted
Eamon Walsh wrote:
> This is an experimental policy for use with the X userspace object
> manager. It includes both unconfined and strict policy and is
> controlled by a tunable, xwindows_object_manager. The labeling conf
> file in the X.org xserver git (XACE-SELINUX branch) assumes that this
> policy is loaded, i.e. the types listed in that file are defined in
> this policy.
>
> The target audience for this is people experimenting with the X object
> manager.
>
> Signed-off-by: Eamon Walsh <ewalsh@tycho.nsa.gov>
>
> ---
>
> policy/global_tunables | 7
> policy/modules/services/xserver.if | 14
> policy/modules/services/xwindows.fc | 13
> policy/modules/services/xwindows.if | 522
> ++++++++++++++++++++++++++++++++++++
> policy/modules/services/xwindows.te | 65 ++++
> policy/modules/system/unconfined.if | 24 +
> 6 files changed, 645 insertions(+)
>
> ---
> Index: policy/modules/services/xwindows.te
> ===================================================================
> --- policy/modules/services/xwindows.te (revision 0)
> +++ policy/modules/services/xwindows.te (revision 0)
> @@ -0,0 +1,65 @@
> +
> +policy_module(xwindows,1.0.0)
> +
> +########################################
> +#
> +# Declarations
> +#
> +
> +# X Window System userspace-managed objects
> +attribute xclient_type;
> +attribute xwindow_type;
> +attribute xproperty_type;
> +attribute xextension_type;
> +
> +# Default type for remotely connected clients
> +type remote_xclient_t, xclient_type;
> +
> +# X Property types and attributes
> +attribute client_xproperty_type;
> +attribute info_xproperty_type;
> +attribute seclabel_xproperty_type;
> +attribute rm_xproperty_type;
> +attribute wm_xproperty_type;
> +attribute clipboard_xproperty_type;
> +attribute unknown_xproperty_type;
> +
> +type client_xproperty_t, client_xproperty_type, xproperty_type;
> +type info_xproperty_t, info_xproperty_type, xproperty_type;
> +type seclabel_xproperty_t, seclabel_xproperty_type, xproperty_type;
> +type rm_xproperty_t, rm_xproperty_type, xproperty_type;
> +type wm_xproperty_t, wm_xproperty_type, xproperty_type;
> +type clipboard_xproperty_t, clipboard_xproperty_type, xproperty_type;
> +type unknown_xproperty_t, unknown_xproperty_type, xproperty_type;
> +
> +# X Extension types
> +type accelgraphics_xext_t, xextension_type;
> +type debug_xext_t, xextension_type;
> +type font_xext_t, xextension_type;
> +type input_xext_t, xextension_type;
> +type output_xext_t, xextension_type;
> +type screensaver_xext_t, xextension_type;
> +type security_xext_t, xextension_type;
> +type shmem_xext_t, xextension_type;
> +type std_xext_t, xextension_type;
> +type video_xext_t, xextension_type;
> +type unknown_xext_t, xextension_type;
> +type windowmgr_xext_t, xextension_type;
> +
> +
> +# X client domains
> +
> +# Display Manager
> +# defined in services/xserver.te
> +
> +# Window Manager
> +type xwm_exec_t;
> +corecmd_executable_file(xwm_exec_t)
> +
> +# Resource Manager
> +type xrdb_exec_t;
> +corecmd_executable_file(xrdb_exec_t)
> +
> +# Protected test client
> +type xprotected_exec_t;
> +corecmd_executable_file(xprotected_exec_t)
> Index: policy/modules/services/xwindows.fc
> ===================================================================
> --- policy/modules/services/xwindows.fc (revision 0)
> +++ policy/modules/services/xwindows.fc (revision 0)
> @@ -0,0 +1,13 @@
> +#
> +# /usr
> +#
> +
> +/usr/bin/(t|m|fv)wm --
> gen_context(system_u:object_r:xwm_exec_t,s0)
> +/usr/bin/metacity -- gen_context(system_u:object_r:xwm_exec_t,s0)
> +/usr/bin/xrdb -- gen_context(system_u:object_r:xrdb_exec_t,s0)
> +/usr/bin/xeyes --
> gen_context(system_u:object_r:xprotected_exec_t,s0)
> +
> +/usr/X11R6/bin/(t|m|fv)wm --
> gen_context(system_u:object_r:xwm_exec_t,s0)
> +/usr/X11R6/bin/metacity --
> gen_context(system_u:object_r:xwm_exec_t,s0)
> +/usr/X11R6/bin/xrdb --
> gen_context(system_u:object_r:xrdb_exec_t,s0)
> +/usr/X11R6/bin/xeyes --
> gen_context(system_u:object_r:xprotected_exec_t,s0)
> Index: policy/modules/services/xwindows.if
> ===================================================================
> --- policy/modules/services/xwindows.if (revision 0)
> +++ policy/modules/services/xwindows.if (revision 0)
> @@ -0,0 +1,522 @@
> +## <summary>X Window System Userspace Object Manager</summary>
> +
> +#######################################
> +## <summary>
> +## Declares a single X property type using a user prefix
> +## and base type, along with appropriate transition rules.
> +## </summary>
> +## <param name="prefix">
> +## <summary>
> +## The prefix of the domain (e.g., user
> +## is the prefix for user_t).
> +## </summary>
> +## </param>
> +## <param name="type">
> +## <summary>
> +## Base X property type
> +## </summary>
> +## </param>
> +#
> +template(`xwindows_property',`
> + gen_require(`
> + type $1_t;
> + type $2;
> + attribute xproperty_type;
> + attribute $1_xproperty_type;
> + attribute $2ype;
> + class property all_property_perms;
> + ')
> +
> + ##############################
> + #
> + # Declarations
> + #
> +
> + type $1_$2, $1_xproperty_type, $2ype, xproperty_type;
> + type_transition $1_t $2:property $1_$2;
> +')
> +
> +#######################################
> +## <summary>
> +## Declares a set of X property types for use with an X
> +## client domain.
> +## </summary>
> +## <param name="prefix">
> +## <summary>
> +## The prefix of the domain (e.g., user
> +## is the prefix for user_t).
> +## </summary>
> +## </param>
> +#
> +template(`xwindows_property_set',`
> +
> + ##############################
> + #
> + # Declarations
> + #
> +
> + attribute $1_xproperty_type;
> + xwindows_property($1,client_xproperty_t)
> + xwindows_property($1,info_xproperty_t)
> + xwindows_property($1,seclabel_xproperty_t)
> + xwindows_property($1,rm_xproperty_t)
> + xwindows_property($1,wm_xproperty_t)
> + xwindows_property($1,clipboard_xproperty_t)
> + xwindows_property($1,unknown_xproperty_t)
> +')
> +
> +#######################################
> +## <summary>
> +## Template to provide X object permissions on a given X server to
> +## an X client domain. Provides the minimal set required by a basic
> +## X client application.
> +## </summary>
> +## <param name="server_prefix">
> +## <summary>
> +## The prefix of the server domain (e.g., user
> +## is the prefix for user_t).
> +## </summary>
> +## </param>
> +## <param name="prefix">
> +## <summary>
> +## The prefix of the client domain (e.g., user
> +## is the prefix for user_t).
> +## </summary>
> +## </param>
> +## <param name="domain">
> +## <summary>
> +## Client domain allowed access.
> +## </summary>
> +## </param>
> +## <param name="role">
> +## <summary>
> +## The role associated with the client domain.
> +## </summary>
> +## </param>
> +#
> +template(`xwindows_basic_client',`
> + gen_require(`
> + type $1_xserver_t;
> + type $1_root_window_t;
> + type $1_xserver_rm_xproperty_t;
> + type $2_info_xproperty_t;
> + type $1_xserver_info_xproperty_t;
> + type $1_xserver_clipboard_xproperty_t;
> + type $2_client_xproperty_t;
> + attribute $2_xproperty_type;
> + class drawable all_drawable_perms;
> + class window all_window_perms;
> + class gc all_gc_perms;
> + class font all_font_perms;
> + class colormap all_colormap_perms;
> + class property all_property_perms;
> + class cursor all_cursor_perms;
> + class xclient all_xclient_perms;
> + class xserver all_xserver_perms;
> + class xinput all_xinput_perms;
> + class xextension all_xextension_perms;
> + ')
> +
> + ##############################
> + #
> + # Local Policy
> + #
> +
> + tunable_policy(`xwindows_object_manager',`
> + # X Protocol Extensions
> + allow $3 xextension_type:xextension query;
> + allow $3 std_xext_t:xextension use;
> + allow $3 input_xext_t:xextension use;
> + allow $3 font_xext_t:xextension use;
> + allow $3 shmem_xext_t:xextension use;
> +
> + # X Properties
> + # can read resource manager settings on the root window
> + allow $3 $1_xserver_rm_xproperty_t:property read;
> + # can read info properties
> + allow $3 $2_info_xproperty_t:property read;
> + allow $3 $1_xserver_info_xproperty_t:property read;
> + # can read and write client properties
> + allow $3 $2_client_xproperty_t:property { read write free };
> + # can read and write cut buffers on the root window
> + allow $3 $1_xserver_clipboard_xproperty_t:property { read
> write free };
> +
> + # X Windows
> + # can get attributes of root window
> + allow $3 $1_root_window_t:window getattr;
> + # can add children to root window
> + allow $3 $1_root_window_t:window { addchild chstack };
> + # can change properties of root window
> + allow $3 $1_root_window_t:window { listprop chprop chproplist };
> +
> + # can query window manager windows (GTK2 thing?)
> + # allow $3 $1_xwm_t:window { enumerate getattr };
> + # allow $3 $1_xwm_t:drawable getattr;
> +
> + # X Fonts
> + allow $3 self:font { use free };
> +
> + # X Input
> + # can set focus on own windows
> + allow $3 self:window setfocus;
> + allow $3 $1_xserver_t:xinput { setfocus getattr };
> + # can track mouse motions on own windows
> + allow $3 self:window mousemotion;
> + # can create and use cursors
> + allow $3 self:cursor { createglyph setattr free };
> + # can set selections on own windows
> + allow $3 self:window chselection;
> +
> + # X Drawing
> + # can query root window attributes
> + allow $3 $1_root_window_t:drawable getattr;
> + allow $3 $1_xserver_t:colormap { read store };
> + allow $3 $1_xserver_t:font { load use free };
> + allow $3 self:drawable { create getattr draw copy destroy };
> + allow $3 self:gc { create setattr free };
> + allow $3 self:window { addchild chprop chproplist chstack
> create destroy enumerate getattr listprop map move setattr unmap };
> + ')
> +')
> +
> +#######################################
> +## <summary>
> +## Template to provide X object permissions to an X window manager.
> +## </summary>
> +## <param name="server_prefix">
> +## <summary>
> +## The prefix of the server domain (e.g., user
> +## is the prefix for user_t).
> +## </summary>
> +## </param>
> +## <param name="prefix">
> +## <summary>
> +## The prefix of the client domain (e.g., user
> +## is the prefix for user_t).
> +## </summary>
> +## </param>
> +## <param name="domain">
> +## <summary>
> +## Client domain allowed access.
> +## </summary>
> +## </param>
> +## <param name="role">
> +## <summary>
> +## The role associated with the client domain.
> +## </summary>
> +## </param>
> +#
> +template(`xwindows_windowmgr_client',`
> + gen_require(`
> + class xextension use;
> + ')
> +
> + ##############################
> + #
> + # Declarations
> + #
> +
> + xwindows_basic_client($1,$2,$3,$4)
> +
> + ##############################
> + #
> + # Local Policy
> + #
> +
> + tunable_policy(`xwindows_object_manager',`
> + # X Protocol Extensions
> + allow $3 windowmgr_xext_t:xextension use;
> +
> + # X Properties
> + # can read all security labels
> + allow $3 seclabel_xproperty_type:property read;
> + # can read and write all wm-specific properties
> + allow $3 wm_xproperty_type:property { read write };
> + # can set properties on all windows
> + allow $3 domain:window { chprop chproplist };
> +
> + # can install colormaps
> + allow $3 $1_xserver_t:colormap install;
> +
> + # X Windows - extensive control over all windows
> + # can query windows for visual information
> + allow $3 domain:drawable getattr;
> + # can enumerate and change attributes of root window
> + allow $3 $1_root_window_t:window { enumerate setattr };
> + # can enumerate, set, and change attributes of all non-root
> windows
> + allow $3 domain:window { enumerate getattr setattr };
> + # can map and unmap all non-root windows
> + allow $3 domain:window { map unmap move ctrllife };
> + # can send various events to all non-root windows
> + allow $3 domain:window { windowchangeevent clientcomevent };
> + # can reparent all non-root windows
> + allow $3 domain:window { chparent chstack };
> + # can list properties of all non-root windows
> + allow $3 domain:window listprop;
> +
> + # X Input
> + # can change input focus on all windows
> + allow $3 domain:window setfocus;
> + allow $3 $1_root_window_t:window setfocus;
> + allow $3 $1_xserver_t:xinput setfocus;
> + # can move the mouse cursor
> + allow $3 $1_xserver_t:xinput warppointer;
> + # can grab server
> + allow $3 $1_xserver_t:xserver { grab ungrab };
> + allow $3 $1_xserver_t:xinput { activegrab passivegrab ungrab };
> +
> + # X Drawing
> + # can draw on the root window
> + allow $3 $1_root_window_t:drawable draw;
> + ')
> +')
> +
> +#######################################
> +## <summary>
> +## Template to provide X object permissions to an X display manager.
> +## </summary>
> +## <param name="server_prefix">
> +## <summary>
> +## The prefix of the server domain (e.g., user
> +## is the prefix for user_t).
> +## </summary>
> +## </param>
> +## <param name="prefix">
> +## <summary>
> +## The prefix of the client domain (e.g., user
> +## is the prefix for user_t).
> +## </summary>
> +## </param>
> +## <param name="domain">
> +## <summary>
> +## Client domain allowed access.
> +## </summary>
> +## </param>
> +## <param name="role">
> +## <summary>
> +## The role associated with the client domain.
> +## </summary>
> +## </param>
> +#
> +template(`xwindows_displaymgr_client',`
> + gen_require(`
> + class xextension use;
> + ')
> +
> + ##############################
> + #
> + # Declarations
> + #
> +
> + xwindows_basic_client($1,$2,$3,$4)
> +
> + ##############################
> + #
> + # Local Policy
> + #
> +
> + tunable_policy(`xwindows_object_manager',`
> + # X Protocol Extensions
> + allow $3 output_xext_t:xextension use;
> +
> + # allow server grabs
> + allow $3 $1_xserver_t:xserver { grab ungrab };
> + allow $3 $1_xserver_t:xinput { getattr activegrab };
> +
> + # can move the mouse cursor
> + allow $3 $1_xserver_t:xinput warppointer;
> +
> + # can set resource manager properties
> + allow $3 $2_rm_xproperty_t:property { write free };
> +
> + # can enumerate windows
> + allow $3 $1_root_window_t:window enumerate;
> + ')
> +')
> +
> +#######################################
> +## <summary>
> +## Template to provide X object permissions to an X resource manager.
> +## </summary>
> +## <param name="server_prefix">
> +## <summary>
> +## The prefix of the server domain (e.g., user
> +## is the prefix for user_t).
> +## </summary>
> +## </param>
> +## <param name="prefix">
> +## <summary>
> +## The prefix of the client domain (e.g., user
> +## is the prefix for user_t).
> +## </summary>
> +## </param>
> +## <param name="domain">
> +## <summary>
> +## Client domain allowed access.
> +## </summary>
> +## </param>
> +## <param name="role">
> +## <summary>
> +## The role associated with the client domain.
> +## </summary>
> +## </param>
> +#
> +template(`xwindows_resourcemgr_client',`
> + gen_require(`
> + class property all_property_perms;
> + ')
> +
> + ##############################
> + #
> + # Local Policy
> + #
> +
> + tunable_policy(`xwindows_object_manager',`
> + # X Properties
> + # can read and write resource manager settings
> + allow $3 $2_rm_xproperty_t:property { read write };
> + ')
> +')
> +
> +#######################################
> +## <summary>
> +## Template to provide X object permissions to an X server domain.
> +## </summary>
> +## <param name="prefix">
> +## <summary>
> +## The prefix of the domain (e.g., user
> +## is the prefix for user_t).
> +## </summary>
> +## </param>
> +## <param name="domain">
> +## <summary>
> +## Domain allowed access.
> +## </summary>
> +## </param>
> +## <param name="role">
> +## <summary>
> +## The role associated with the domain.
> +## </summary>
> +## </param>
> +#
> +template(`xwindows_server',`
> + gen_require(`
> + attribute xwindow_type;
> + class window map;
> + class drawable draw;
> + ')
> +
> + ##############################
> + #
> + # Declarations
> + #
> +
> + # Type for the root window
> + type $1_root_window_t, xwindow_type;
> + role $3 types $1_root_window_t;
> +
> + # Types for properties
> + xwindows_property_set($1_xserver)
> + role $3 types $1_xserver_xproperty_type;
> +
> + ##############################
> + #
> + # Local Policy
> + #
> +
> + tunable_policy(`xwindows_object_manager',`
> + # Labeling rules for root windows
> + type_transition $2 $2:window $1_root_window_t;
> + type_transition $2 $2:drawable $1_root_window_t;
> +
> + # Allow server to map the root window
> + allow $2 $1_root_window_t:window map;
> + ')
> +')
> +
> +#######################################
> +## <summary>
> +## The per role template for the xwindows module.
> +## </summary>
> +## <desc>
> +## <p>
> +## This template creates a derived domains which are used
> +## for X userspace object manager related programs.
> +## </p>
> +## <p>
> +## This template is invoked automatically for each user, and
> +## generally does not need to be invoked directly
> +## by policy writers.
> +## </p>
> +## </desc>
> +## <param name="userdomain_prefix">
> +## <summary>
> +## The prefix of the user domain (e.g., user
> +## is the prefix for user_t).
> +## </summary>
> +## </param>
> +## <param name="user_domain">
> +## <summary>
> +## The type of the user domain.
> +## </summary>
> +## </param>
> +## <param name="user_role">
> +## <summary>
> +## The role associated with the user domain.
> +## </summary>
> +## </param>
> +#
> +template(`xwindows_per_role_template',`
> +
> + ##############################
> + #
> + # Declarations
> + #
> +
> + # Types for window managers
> + type $1_xwm_t;
> + domain_type($1_xwm_t)
> + domain_entry_file($1_xwm_t,xwm_exec_t)
> + role $3 types $1_xwm_t;
> +
> + # Types for resource managers
> + type $1_xrdb_t;
> + domain_type($1_xrdb_t)
> + domain_entry_file($1_xrdb_t,xrdb_exec_t)
> + role $3 types $1_xrdb_t;
> +
> + # Protected test type
> + type $1_xprotected_t;
> + domain_type($1_xprotected_t)
> + domain_entry_file($1_xprotected_t,xprotected_exec_t)
> + role $3 types $1_xprotected_t;
> +
> + # Types for properties
> + xwindows_property_set($1)
> + role $3 types $1_xproperty_type;
> + xwindows_property_set($1_xwm)
> + role $3 types $1_xwm_xproperty_type;
> + xwindows_property_set($1_xrdb)
> + role $3 types $1_xrdb_xproperty_type;
> + xwindows_property_set($1_xprotected)
> + role $3 types $1_xprotected_xproperty_type;
> +
> + # Basic default client
> + xwindows_basic_client($1,$1,$1_t,$3)
> +
> + # Other clients
> + xwindows_basic_client($1,$1_xprotected,$1_xprotected_t,$3)
> + xwindows_windowmgr_client($1,$1_xwm,$1_xwm_t,$3)
> + xwindows_resourcemgr_client($1,$1_xrdb,$1_xrdb_t,$3)
> +
> + ##############################
> + #
> + # Local Policy
> + #
> +
> + tunable_policy(`xwindows_object_manager',`
> + domain_auto_trans($2,xwm_exec_t,$1_xwm_t)
> + domain_auto_trans($2, xrdb_exec_t, $1_xrdb_t)
> + domain_auto_trans($2, xprotected_exec_t, $1_xprotected_t)
> + ')
> +')
> +')
> Index: policy/modules/services/xserver.if
> ===================================================================
> --- policy/modules/services/xserver.if (revision 2178)
> +++ policy/modules/services/xserver.if (working copy)
> @@ -90,6 +90,13 @@
> kernel_read_kernel_sysctls($1_xserver_t)
> kernel_write_proc_files($1_xserver_t)
>
> + # X server userspace object manager
> + tunable_policy(`xwindows_object_manager',`
> + allow $1_xserver_t self:netlink_audit_socket create;
> + allow $1_xserver_t self:netlink_selinux_socket { bind create
> read };
> + allow $1_xserver_t security_t:security { check_context
> compute_av compute_create };
> + ')
> +
> # Run helper programs in $1_xserver_t.
> corecmd_search_sbin($1_xserver_t)
> corecmd_exec_bin($1_xserver_t)
> @@ -267,6 +274,13 @@
>
> ##############################
> #
> + # $1_xserver_t X Userspace Object Manager
> + #
> +
> + xwindows_server($1,$1_xserver_t,$3)
> +
> + ##############################
> + #
> # $1_xserver_t Local policy
> #
>
> Index: policy/modules/system/unconfined.if
> ===================================================================
> --- policy/modules/system/unconfined.if (revision 2178)
> +++ policy/modules/system/unconfined.if (working copy)
> @@ -15,6 +15,17 @@
> class dbus all_dbus_perms;
> class nscd all_nscd_perms;
> class passwd all_passwd_perms;
> + class drawable all_drawable_perms;
> + class window all_window_perms;
> + class gc all_gc_perms;
> + class font all_font_perms;
> + class colormap all_colormap_perms;
> + class property all_property_perms;
> + class cursor all_cursor_perms;
> + class xclient all_xclient_perms;
> + class xserver all_xserver_perms;
> + class xinput all_xinput_perms;
> + class xextension all_xextension_perms;
> ')
>
> # Use any Linux capability.
> @@ -31,6 +42,19 @@
> allow $1 self:nscd *;
> allow $1 self:dbus *;
> allow $1 self:passwd *;
> + tunable_policy(`xwindows_object_manager',`
> + allow $1 self:drawable *;
> + allow $1 self:window *;
> + allow $1 self:gc *;
> + allow $1 self:font *;
> + allow $1 self:colormap *;
> + allow $1 self:property *;
> + allow $1 self:cursor *;
> + allow $1 self:xclient *;
> + allow $1 self:xserver *;
> + allow $1 self:xinput *;
> + allow $1 self:xextension *;
> + ')
>
> kernel_unconfined($1)
> corenet_unconfined($1)
> Index: policy/global_tunables
> ===================================================================
> --- policy/global_tunables (revision 2178)
> +++ policy/global_tunables (working copy)
> @@ -348,6 +348,13 @@
> ## </desc>
> gen_tunable(use_samba_home_dirs,false)
>
> +## <desc>
> +## <p>
> +## Support X userspace object manager
> +## </p>
> +## </desc>
> +gen_tunable(xwindows_object_manager,false)
> +
> ########################################
> #
> # Strict policy specific
>
>
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 12+ messages in thread* Re: [PATCH] refpolicy: experimental X policy
2007-01-25 23:10 [PATCH] refpolicy: experimental X policy Eamon Walsh
2007-02-02 16:53 ` Ted X Toth
@ 2007-02-13 20:26 ` Xavier Toth
2007-02-13 23:28 ` [PATCH] refpolicy: experimental X policy -v2 Eamon Walsh
1 sibling, 1 reply; 12+ messages in thread
From: Xavier Toth @ 2007-02-13 20:26 UTC (permalink / raw)
To: ewalsh; +Cc: selinux
I think there is an extra ') at the end of the xwindows.fc patch.
On 1/25/07, Eamon Walsh <ewalsh@tycho.nsa.gov> wrote:
> This is an experimental policy for use with the X userspace object
> manager. It includes both unconfined and strict policy and is
> controlled by a tunable, xwindows_object_manager. The labeling conf
> file in the X.org xserver git (XACE-SELINUX branch) assumes that this
> policy is loaded, i.e. the types listed in that file are defined in this
> policy.
>
> The target audience for this is people experimenting with the X object
> manager.
>
> Signed-off-by: Eamon Walsh <ewalsh@tycho.nsa.gov>
>
> ---
>
> policy/global_tunables | 7
> policy/modules/services/xserver.if | 14
> policy/modules/services/xwindows.fc | 13
> policy/modules/services/xwindows.if | 522 ++++++++++++++++++++++++++++++++++++
> policy/modules/services/xwindows.te | 65 ++++
> policy/modules/system/unconfined.if | 24 +
> 6 files changed, 645 insertions(+)
>
> ---
> Index: policy/modules/services/xwindows.te
> ===================================================================
> --- policy/modules/services/xwindows.te (revision 0)
> +++ policy/modules/services/xwindows.te (revision 0)
> @@ -0,0 +1,65 @@
> +
> +policy_module(xwindows,1.0.0)
> +
> +########################################
> +#
> +# Declarations
> +#
> +
> +# X Window System userspace-managed objects
> +attribute xclient_type;
> +attribute xwindow_type;
> +attribute xproperty_type;
> +attribute xextension_type;
> +
> +# Default type for remotely connected clients
> +type remote_xclient_t, xclient_type;
> +
> +# X Property types and attributes
> +attribute client_xproperty_type;
> +attribute info_xproperty_type;
> +attribute seclabel_xproperty_type;
> +attribute rm_xproperty_type;
> +attribute wm_xproperty_type;
> +attribute clipboard_xproperty_type;
> +attribute unknown_xproperty_type;
> +
> +type client_xproperty_t, client_xproperty_type, xproperty_type;
> +type info_xproperty_t, info_xproperty_type, xproperty_type;
> +type seclabel_xproperty_t, seclabel_xproperty_type, xproperty_type;
> +type rm_xproperty_t, rm_xproperty_type, xproperty_type;
> +type wm_xproperty_t, wm_xproperty_type, xproperty_type;
> +type clipboard_xproperty_t, clipboard_xproperty_type, xproperty_type;
> +type unknown_xproperty_t, unknown_xproperty_type, xproperty_type;
> +
> +# X Extension types
> +type accelgraphics_xext_t, xextension_type;
> +type debug_xext_t, xextension_type;
> +type font_xext_t, xextension_type;
> +type input_xext_t, xextension_type;
> +type output_xext_t, xextension_type;
> +type screensaver_xext_t, xextension_type;
> +type security_xext_t, xextension_type;
> +type shmem_xext_t, xextension_type;
> +type std_xext_t, xextension_type;
> +type video_xext_t, xextension_type;
> +type unknown_xext_t, xextension_type;
> +type windowmgr_xext_t, xextension_type;
> +
> +
> +# X client domains
> +
> +# Display Manager
> +# defined in services/xserver.te
> +
> +# Window Manager
> +type xwm_exec_t;
> +corecmd_executable_file(xwm_exec_t)
> +
> +# Resource Manager
> +type xrdb_exec_t;
> +corecmd_executable_file(xrdb_exec_t)
> +
> +# Protected test client
> +type xprotected_exec_t;
> +corecmd_executable_file(xprotected_exec_t)
> Index: policy/modules/services/xwindows.fc
> ===================================================================
> --- policy/modules/services/xwindows.fc (revision 0)
> +++ policy/modules/services/xwindows.fc (revision 0)
> @@ -0,0 +1,13 @@
> +#
> +# /usr
> +#
> +
> +/usr/bin/(t|m|fv)wm -- gen_context(system_u:object_r:xwm_exec_t,s0)
> +/usr/bin/metacity -- gen_context(system_u:object_r:xwm_exec_t,s0)
> +/usr/bin/xrdb -- gen_context(system_u:object_r:xrdb_exec_t,s0)
> +/usr/bin/xeyes -- gen_context(system_u:object_r:xprotected_exec_t,s0)
> +
> +/usr/X11R6/bin/(t|m|fv)wm -- gen_context(system_u:object_r:xwm_exec_t,s0)
> +/usr/X11R6/bin/metacity -- gen_context(system_u:object_r:xwm_exec_t,s0)
> +/usr/X11R6/bin/xrdb -- gen_context(system_u:object_r:xrdb_exec_t,s0)
> +/usr/X11R6/bin/xeyes -- gen_context(system_u:object_r:xprotected_exec_t,s0)
> Index: policy/modules/services/xwindows.if
> ===================================================================
> --- policy/modules/services/xwindows.if (revision 0)
> +++ policy/modules/services/xwindows.if (revision 0)
> @@ -0,0 +1,522 @@
> +## <summary>X Window System Userspace Object Manager</summary>
> +
> +#######################################
> +## <summary>
> +## Declares a single X property type using a user prefix
> +## and base type, along with appropriate transition rules.
> +## </summary>
> +## <param name="prefix">
> +## <summary>
> +## The prefix of the domain (e.g., user
> +## is the prefix for user_t).
> +## </summary>
> +## </param>
> +## <param name="type">
> +## <summary>
> +## Base X property type
> +## </summary>
> +## </param>
> +#
> +template(`xwindows_property',`
> + gen_require(`
> + type $1_t;
> + type $2;
> + attribute xproperty_type;
> + attribute $1_xproperty_type;
> + attribute $2ype;
> + class property all_property_perms;
> + ')
> +
> + ##############################
> + #
> + # Declarations
> + #
> +
> + type $1_$2, $1_xproperty_type, $2ype, xproperty_type;
> + type_transition $1_t $2:property $1_$2;
> +')
> +
> +#######################################
> +## <summary>
> +## Declares a set of X property types for use with an X
> +## client domain.
> +## </summary>
> +## <param name="prefix">
> +## <summary>
> +## The prefix of the domain (e.g., user
> +## is the prefix for user_t).
> +## </summary>
> +## </param>
> +#
> +template(`xwindows_property_set',`
> +
> + ##############################
> + #
> + # Declarations
> + #
> +
> + attribute $1_xproperty_type;
> + xwindows_property($1,client_xproperty_t)
> + xwindows_property($1,info_xproperty_t)
> + xwindows_property($1,seclabel_xproperty_t)
> + xwindows_property($1,rm_xproperty_t)
> + xwindows_property($1,wm_xproperty_t)
> + xwindows_property($1,clipboard_xproperty_t)
> + xwindows_property($1,unknown_xproperty_t)
> +')
> +
> +#######################################
> +## <summary>
> +## Template to provide X object permissions on a given X server to
> +## an X client domain. Provides the minimal set required by a basic
> +## X client application.
> +## </summary>
> +## <param name="server_prefix">
> +## <summary>
> +## The prefix of the server domain (e.g., user
> +## is the prefix for user_t).
> +## </summary>
> +## </param>
> +## <param name="prefix">
> +## <summary>
> +## The prefix of the client domain (e.g., user
> +## is the prefix for user_t).
> +## </summary>
> +## </param>
> +## <param name="domain">
> +## <summary>
> +## Client domain allowed access.
> +## </summary>
> +## </param>
> +## <param name="role">
> +## <summary>
> +## The role associated with the client domain.
> +## </summary>
> +## </param>
> +#
> +template(`xwindows_basic_client',`
> + gen_require(`
> + type $1_xserver_t;
> + type $1_root_window_t;
> + type $1_xserver_rm_xproperty_t;
> + type $2_info_xproperty_t;
> + type $1_xserver_info_xproperty_t;
> + type $1_xserver_clipboard_xproperty_t;
> + type $2_client_xproperty_t;
> + attribute $2_xproperty_type;
> + class drawable all_drawable_perms;
> + class window all_window_perms;
> + class gc all_gc_perms;
> + class font all_font_perms;
> + class colormap all_colormap_perms;
> + class property all_property_perms;
> + class cursor all_cursor_perms;
> + class xclient all_xclient_perms;
> + class xserver all_xserver_perms;
> + class xinput all_xinput_perms;
> + class xextension all_xextension_perms;
> + ')
> +
> + ##############################
> + #
> + # Local Policy
> + #
> +
> + tunable_policy(`xwindows_object_manager',`
> + # X Protocol Extensions
> + allow $3 xextension_type:xextension query;
> + allow $3 std_xext_t:xextension use;
> + allow $3 input_xext_t:xextension use;
> + allow $3 font_xext_t:xextension use;
> + allow $3 shmem_xext_t:xextension use;
> +
> + # X Properties
> + # can read resource manager settings on the root window
> + allow $3 $1_xserver_rm_xproperty_t:property read;
> + # can read info properties
> + allow $3 $2_info_xproperty_t:property read;
> + allow $3 $1_xserver_info_xproperty_t:property read;
> + # can read and write client properties
> + allow $3 $2_client_xproperty_t:property { read write free };
> + # can read and write cut buffers on the root window
> + allow $3 $1_xserver_clipboard_xproperty_t:property { read write free };
> +
> + # X Windows
> + # can get attributes of root window
> + allow $3 $1_root_window_t:window getattr;
> + # can add children to root window
> + allow $3 $1_root_window_t:window { addchild chstack };
> + # can change properties of root window
> + allow $3 $1_root_window_t:window { listprop chprop chproplist };
> +
> + # can query window manager windows (GTK2 thing?)
> + # allow $3 $1_xwm_t:window { enumerate getattr };
> + # allow $3 $1_xwm_t:drawable getattr;
> +
> + # X Fonts
> + allow $3 self:font { use free };
> +
> + # X Input
> + # can set focus on own windows
> + allow $3 self:window setfocus;
> + allow $3 $1_xserver_t:xinput { setfocus getattr };
> + # can track mouse motions on own windows
> + allow $3 self:window mousemotion;
> + # can create and use cursors
> + allow $3 self:cursor { createglyph setattr free };
> + # can set selections on own windows
> + allow $3 self:window chselection;
> +
> + # X Drawing
> + # can query root window attributes
> + allow $3 $1_root_window_t:drawable getattr;
> + allow $3 $1_xserver_t:colormap { read store };
> + allow $3 $1_xserver_t:font { load use free };
> + allow $3 self:drawable { create getattr draw copy destroy };
> + allow $3 self:gc { create setattr free };
> + allow $3 self:window { addchild chprop chproplist chstack create destroy enumerate getattr listprop map move setattr unmap };
> + ')
> +')
> +
> +#######################################
> +## <summary>
> +## Template to provide X object permissions to an X window manager.
> +## </summary>
> +## <param name="server_prefix">
> +## <summary>
> +## The prefix of the server domain (e.g., user
> +## is the prefix for user_t).
> +## </summary>
> +## </param>
> +## <param name="prefix">
> +## <summary>
> +## The prefix of the client domain (e.g., user
> +## is the prefix for user_t).
> +## </summary>
> +## </param>
> +## <param name="domain">
> +## <summary>
> +## Client domain allowed access.
> +## </summary>
> +## </param>
> +## <param name="role">
> +## <summary>
> +## The role associated with the client domain.
> +## </summary>
> +## </param>
> +#
> +template(`xwindows_windowmgr_client',`
> + gen_require(`
> + class xextension use;
> + ')
> +
> + ##############################
> + #
> + # Declarations
> + #
> +
> + xwindows_basic_client($1,$2,$3,$4)
> +
> + ##############################
> + #
> + # Local Policy
> + #
> +
> + tunable_policy(`xwindows_object_manager',`
> + # X Protocol Extensions
> + allow $3 windowmgr_xext_t:xextension use;
> +
> + # X Properties
> + # can read all security labels
> + allow $3 seclabel_xproperty_type:property read;
> + # can read and write all wm-specific properties
> + allow $3 wm_xproperty_type:property { read write };
> + # can set properties on all windows
> + allow $3 domain:window { chprop chproplist };
> +
> + # can install colormaps
> + allow $3 $1_xserver_t:colormap install;
> +
> + # X Windows - extensive control over all windows
> + # can query windows for visual information
> + allow $3 domain:drawable getattr;
> + # can enumerate and change attributes of root window
> + allow $3 $1_root_window_t:window { enumerate setattr };
> + # can enumerate, set, and change attributes of all non-root windows
> + allow $3 domain:window { enumerate getattr setattr };
> + # can map and unmap all non-root windows
> + allow $3 domain:window { map unmap move ctrllife };
> + # can send various events to all non-root windows
> + allow $3 domain:window { windowchangeevent clientcomevent };
> + # can reparent all non-root windows
> + allow $3 domain:window { chparent chstack };
> + # can list properties of all non-root windows
> + allow $3 domain:window listprop;
> +
> + # X Input
> + # can change input focus on all windows
> + allow $3 domain:window setfocus;
> + allow $3 $1_root_window_t:window setfocus;
> + allow $3 $1_xserver_t:xinput setfocus;
> + # can move the mouse cursor
> + allow $3 $1_xserver_t:xinput warppointer;
> + # can grab server
> + allow $3 $1_xserver_t:xserver { grab ungrab };
> + allow $3 $1_xserver_t:xinput { activegrab passivegrab ungrab };
> +
> + # X Drawing
> + # can draw on the root window
> + allow $3 $1_root_window_t:drawable draw;
> + ')
> +')
> +
> +#######################################
> +## <summary>
> +## Template to provide X object permissions to an X display manager.
> +## </summary>
> +## <param name="server_prefix">
> +## <summary>
> +## The prefix of the server domain (e.g., user
> +## is the prefix for user_t).
> +## </summary>
> +## </param>
> +## <param name="prefix">
> +## <summary>
> +## The prefix of the client domain (e.g., user
> +## is the prefix for user_t).
> +## </summary>
> +## </param>
> +## <param name="domain">
> +## <summary>
> +## Client domain allowed access.
> +## </summary>
> +## </param>
> +## <param name="role">
> +## <summary>
> +## The role associated with the client domain.
> +## </summary>
> +## </param>
> +#
> +template(`xwindows_displaymgr_client',`
> + gen_require(`
> + class xextension use;
> + ')
> +
> + ##############################
> + #
> + # Declarations
> + #
> +
> + xwindows_basic_client($1,$2,$3,$4)
> +
> + ##############################
> + #
> + # Local Policy
> + #
> +
> + tunable_policy(`xwindows_object_manager',`
> + # X Protocol Extensions
> + allow $3 output_xext_t:xextension use;
> +
> + # allow server grabs
> + allow $3 $1_xserver_t:xserver { grab ungrab };
> + allow $3 $1_xserver_t:xinput { getattr activegrab };
> +
> + # can move the mouse cursor
> + allow $3 $1_xserver_t:xinput warppointer;
> +
> + # can set resource manager properties
> + allow $3 $2_rm_xproperty_t:property { write free };
> +
> + # can enumerate windows
> + allow $3 $1_root_window_t:window enumerate;
> + ')
> +')
> +
> +#######################################
> +## <summary>
> +## Template to provide X object permissions to an X resource manager.
> +## </summary>
> +## <param name="server_prefix">
> +## <summary>
> +## The prefix of the server domain (e.g., user
> +## is the prefix for user_t).
> +## </summary>
> +## </param>
> +## <param name="prefix">
> +## <summary>
> +## The prefix of the client domain (e.g., user
> +## is the prefix for user_t).
> +## </summary>
> +## </param>
> +## <param name="domain">
> +## <summary>
> +## Client domain allowed access.
> +## </summary>
> +## </param>
> +## <param name="role">
> +## <summary>
> +## The role associated with the client domain.
> +## </summary>
> +## </param>
> +#
> +template(`xwindows_resourcemgr_client',`
> + gen_require(`
> + class property all_property_perms;
> + ')
> +
> + ##############################
> + #
> + # Local Policy
> + #
> +
> + tunable_policy(`xwindows_object_manager',`
> + # X Properties
> + # can read and write resource manager settings
> + allow $3 $2_rm_xproperty_t:property { read write };
> + ')
> +')
> +
> +#######################################
> +## <summary>
> +## Template to provide X object permissions to an X server domain.
> +## </summary>
> +## <param name="prefix">
> +## <summary>
> +## The prefix of the domain (e.g., user
> +## is the prefix for user_t).
> +## </summary>
> +## </param>
> +## <param name="domain">
> +## <summary>
> +## Domain allowed access.
> +## </summary>
> +## </param>
> +## <param name="role">
> +## <summary>
> +## The role associated with the domain.
> +## </summary>
> +## </param>
> +#
> +template(`xwindows_server',`
> + gen_require(`
> + attribute xwindow_type;
> + class window map;
> + class drawable draw;
> + ')
> +
> + ##############################
> + #
> + # Declarations
> + #
> +
> + # Type for the root window
> + type $1_root_window_t, xwindow_type;
> + role $3 types $1_root_window_t;
> +
> + # Types for properties
> + xwindows_property_set($1_xserver)
> + role $3 types $1_xserver_xproperty_type;
> +
> + ##############################
> + #
> + # Local Policy
> + #
> +
> + tunable_policy(`xwindows_object_manager',`
> + # Labeling rules for root windows
> + type_transition $2 $2:window $1_root_window_t;
> + type_transition $2 $2:drawable $1_root_window_t;
> +
> + # Allow server to map the root window
> + allow $2 $1_root_window_t:window map;
> + ')
> +')
> +
> +#######################################
> +## <summary>
> +## The per role template for the xwindows module.
> +## </summary>
> +## <desc>
> +## <p>
> +## This template creates a derived domains which are used
> +## for X userspace object manager related programs.
> +## </p>
> +## <p>
> +## This template is invoked automatically for each user, and
> +## generally does not need to be invoked directly
> +## by policy writers.
> +## </p>
> +## </desc>
> +## <param name="userdomain_prefix">
> +## <summary>
> +## The prefix of the user domain (e.g., user
> +## is the prefix for user_t).
> +## </summary>
> +## </param>
> +## <param name="user_domain">
> +## <summary>
> +## The type of the user domain.
> +## </summary>
> +## </param>
> +## <param name="user_role">
> +## <summary>
> +## The role associated with the user domain.
> +## </summary>
> +## </param>
> +#
> +template(`xwindows_per_role_template',`
> +
> + ##############################
> + #
> + # Declarations
> + #
> +
> + # Types for window managers
> + type $1_xwm_t;
> + domain_type($1_xwm_t)
> + domain_entry_file($1_xwm_t,xwm_exec_t)
> + role $3 types $1_xwm_t;
> +
> + # Types for resource managers
> + type $1_xrdb_t;
> + domain_type($1_xrdb_t)
> + domain_entry_file($1_xrdb_t,xrdb_exec_t)
> + role $3 types $1_xrdb_t;
> +
> + # Protected test type
> + type $1_xprotected_t;
> + domain_type($1_xprotected_t)
> + domain_entry_file($1_xprotected_t,xprotected_exec_t)
> + role $3 types $1_xprotected_t;
> +
> + # Types for properties
> + xwindows_property_set($1)
> + role $3 types $1_xproperty_type;
> + xwindows_property_set($1_xwm)
> + role $3 types $1_xwm_xproperty_type;
> + xwindows_property_set($1_xrdb)
> + role $3 types $1_xrdb_xproperty_type;
> + xwindows_property_set($1_xprotected)
> + role $3 types $1_xprotected_xproperty_type;
> +
> + # Basic default client
> + xwindows_basic_client($1,$1,$1_t,$3)
> +
> + # Other clients
> + xwindows_basic_client($1,$1_xprotected,$1_xprotected_t,$3)
> + xwindows_windowmgr_client($1,$1_xwm,$1_xwm_t,$3)
> + xwindows_resourcemgr_client($1,$1_xrdb,$1_xrdb_t,$3)
> +
> + ##############################
> + #
> + # Local Policy
> + #
> +
> + tunable_policy(`xwindows_object_manager',`
> + domain_auto_trans($2,xwm_exec_t,$1_xwm_t)
> + domain_auto_trans($2, xrdb_exec_t, $1_xrdb_t)
> + domain_auto_trans($2, xprotected_exec_t, $1_xprotected_t)
> + ')
> +')
> +')
> Index: policy/modules/services/xserver.if
> ===================================================================
> --- policy/modules/services/xserver.if (revision 2178)
> +++ policy/modules/services/xserver.if (working copy)
> @@ -90,6 +90,13 @@
> kernel_read_kernel_sysctls($1_xserver_t)
> kernel_write_proc_files($1_xserver_t)
>
> + # X server userspace object manager
> + tunable_policy(`xwindows_object_manager',`
> + allow $1_xserver_t self:netlink_audit_socket create;
> + allow $1_xserver_t self:netlink_selinux_socket { bind create read };
> + allow $1_xserver_t security_t:security { check_context compute_av compute_create };
> + ')
> +
> # Run helper programs in $1_xserver_t.
> corecmd_search_sbin($1_xserver_t)
> corecmd_exec_bin($1_xserver_t)
> @@ -267,6 +274,13 @@
>
> ##############################
> #
> + # $1_xserver_t X Userspace Object Manager
> + #
> +
> + xwindows_server($1,$1_xserver_t,$3)
> +
> + ##############################
> + #
> # $1_xserver_t Local policy
> #
>
> Index: policy/modules/system/unconfined.if
> ===================================================================
> --- policy/modules/system/unconfined.if (revision 2178)
> +++ policy/modules/system/unconfined.if (working copy)
> @@ -15,6 +15,17 @@
> class dbus all_dbus_perms;
> class nscd all_nscd_perms;
> class passwd all_passwd_perms;
> + class drawable all_drawable_perms;
> + class window all_window_perms;
> + class gc all_gc_perms;
> + class font all_font_perms;
> + class colormap all_colormap_perms;
> + class property all_property_perms;
> + class cursor all_cursor_perms;
> + class xclient all_xclient_perms;
> + class xserver all_xserver_perms;
> + class xinput all_xinput_perms;
> + class xextension all_xextension_perms;
> ')
>
> # Use any Linux capability.
> @@ -31,6 +42,19 @@
> allow $1 self:nscd *;
> allow $1 self:dbus *;
> allow $1 self:passwd *;
> + tunable_policy(`xwindows_object_manager',`
> + allow $1 self:drawable *;
> + allow $1 self:window *;
> + allow $1 self:gc *;
> + allow $1 self:font *;
> + allow $1 self:colormap *;
> + allow $1 self:property *;
> + allow $1 self:cursor *;
> + allow $1 self:xclient *;
> + allow $1 self:xserver *;
> + allow $1 self:xinput *;
> + allow $1 self:xextension *;
> + ')
>
> kernel_unconfined($1)
> corenet_unconfined($1)
> Index: policy/global_tunables
> ===================================================================
> --- policy/global_tunables (revision 2178)
> +++ policy/global_tunables (working copy)
> @@ -348,6 +348,13 @@
> ## </desc>
> gen_tunable(use_samba_home_dirs,false)
>
> +## <desc>
> +## <p>
> +## Support X userspace object manager
> +## </p>
> +## </desc>
> +gen_tunable(xwindows_object_manager,false)
> +
> ########################################
> #
> # Strict policy specific
>
>
> --
> Eamon Walsh <ewalsh@tycho.nsa.gov>
> National Security Agency
>
>
> --
> This message was distributed to subscribers of the selinux mailing list.
> If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
> the words "unsubscribe selinux" without quotes as the message.
>
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 12+ messages in thread* [PATCH] refpolicy: experimental X policy -v2
2007-02-13 20:26 ` Xavier Toth
@ 2007-02-13 23:28 ` Eamon Walsh
2007-02-27 18:53 ` Christopher J. PeBenito
0 siblings, 1 reply; 12+ messages in thread
From: Eamon Walsh @ 2007-02-13 23:28 UTC (permalink / raw)
To: selinux
Repost with extra paren removed (didn't affect compilation for some
reason) and missing optional_policy declaration pointed out by Jim Carter.
This is an experimental policy for use with the X userspace object
manager. It includes both unconfined and strict policy and is
controlled by a tunable, xwindows_object_manager. The labeling conf
file in the X.org xserver git (XACE-SELINUX branch) assumes that this
policy is loaded, i.e. the types listed in that file are defined in this
policy.
The target audience for this is people experimenting with the X object
manager.
Signed-off-by: Eamon Walsh <ewalsh@tycho.nsa.gov>
---
global_tunables | 7
modules/services/xserver.if | 15 +
modules/services/xwindows.fc | 13 +
modules/services/xwindows.if | 521 +++++++++++++++++++++++++++++++++++++++++++
modules/services/xwindows.te | 65 +++++
modules/system/unconfined.if | 24 +
6 files changed, 645 insertions(+)
---
Index: policy/modules/services/xwindows.te
===================================================================
--- policy/modules/services/xwindows.te (revision 0)
+++ policy/modules/services/xwindows.te (revision 0)
@@ -0,0 +1,65 @@
+
+policy_module(xwindows,1.0.0)
+
+########################################
+#
+# Declarations
+#
+
+# X Window System userspace-managed objects
+attribute xclient_type;
+attribute xwindow_type;
+attribute xproperty_type;
+attribute xextension_type;
+
+# Default type for remotely connected clients
+type remote_xclient_t, xclient_type;
+
+# X Property types and attributes
+attribute client_xproperty_type;
+attribute info_xproperty_type;
+attribute seclabel_xproperty_type;
+attribute rm_xproperty_type;
+attribute wm_xproperty_type;
+attribute clipboard_xproperty_type;
+attribute unknown_xproperty_type;
+
+type client_xproperty_t, client_xproperty_type, xproperty_type;
+type info_xproperty_t, info_xproperty_type, xproperty_type;
+type seclabel_xproperty_t, seclabel_xproperty_type, xproperty_type;
+type rm_xproperty_t, rm_xproperty_type, xproperty_type;
+type wm_xproperty_t, wm_xproperty_type, xproperty_type;
+type clipboard_xproperty_t, clipboard_xproperty_type, xproperty_type;
+type unknown_xproperty_t, unknown_xproperty_type, xproperty_type;
+
+# X Extension types
+type accelgraphics_xext_t, xextension_type;
+type debug_xext_t, xextension_type;
+type font_xext_t, xextension_type;
+type input_xext_t, xextension_type;
+type output_xext_t, xextension_type;
+type screensaver_xext_t, xextension_type;
+type security_xext_t, xextension_type;
+type shmem_xext_t, xextension_type;
+type std_xext_t, xextension_type;
+type video_xext_t, xextension_type;
+type unknown_xext_t, xextension_type;
+type windowmgr_xext_t, xextension_type;
+
+
+# X client domains
+
+# Display Manager
+# defined in services/xserver.te
+
+# Window Manager
+type xwm_exec_t;
+corecmd_executable_file(xwm_exec_t)
+
+# Resource Manager
+type xrdb_exec_t;
+corecmd_executable_file(xrdb_exec_t)
+
+# Protected test client
+type xprotected_exec_t;
+corecmd_executable_file(xprotected_exec_t)
Index: policy/modules/services/xwindows.fc
===================================================================
--- policy/modules/services/xwindows.fc (revision 0)
+++ policy/modules/services/xwindows.fc (revision 0)
@@ -0,0 +1,13 @@
+#
+# /usr
+#
+
+/usr/bin/(t|m|fv)wm -- gen_context(system_u:object_r:xwm_exec_t,s0)
+/usr/bin/metacity -- gen_context(system_u:object_r:xwm_exec_t,s0)
+/usr/bin/xrdb -- gen_context(system_u:object_r:xrdb_exec_t,s0)
+/usr/bin/xeyes -- gen_context(system_u:object_r:xprotected_exec_t,s0)
+
+/usr/X11R6/bin/(t|m|fv)wm -- gen_context(system_u:object_r:xwm_exec_t,s0)
+/usr/X11R6/bin/metacity -- gen_context(system_u:object_r:xwm_exec_t,s0)
+/usr/X11R6/bin/xrdb -- gen_context(system_u:object_r:xrdb_exec_t,s0)
+/usr/X11R6/bin/xeyes -- gen_context(system_u:object_r:xprotected_exec_t,s0)
Index: policy/modules/services/xwindows.if
===================================================================
--- policy/modules/services/xwindows.if (revision 0)
+++ policy/modules/services/xwindows.if (revision 0)
@@ -0,0 +1,521 @@
+## <summary>X Window System Userspace Object Manager</summary>
+
+#######################################
+## <summary>
+## Declares a single X property type using a user prefix
+## and base type, along with appropriate transition rules.
+## </summary>
+## <param name="prefix">
+## <summary>
+## The prefix of the domain (e.g., user
+## is the prefix for user_t).
+## </summary>
+## </param>
+## <param name="type">
+## <summary>
+## Base X property type
+## </summary>
+## </param>
+#
+template(`xwindows_property',`
+ gen_require(`
+ type $1_t;
+ type $2;
+ attribute xproperty_type;
+ attribute $1_xproperty_type;
+ attribute $2ype;
+ class property all_property_perms;
+ ')
+
+ ##############################
+ #
+ # Declarations
+ #
+
+ type $1_$2, $1_xproperty_type, $2ype, xproperty_type;
+ type_transition $1_t $2:property $1_$2;
+')
+
+#######################################
+## <summary>
+## Declares a set of X property types for use with an X
+## client domain.
+## </summary>
+## <param name="prefix">
+## <summary>
+## The prefix of the domain (e.g., user
+## is the prefix for user_t).
+## </summary>
+## </param>
+#
+template(`xwindows_property_set',`
+
+ ##############################
+ #
+ # Declarations
+ #
+
+ attribute $1_xproperty_type;
+ xwindows_property($1,client_xproperty_t)
+ xwindows_property($1,info_xproperty_t)
+ xwindows_property($1,seclabel_xproperty_t)
+ xwindows_property($1,rm_xproperty_t)
+ xwindows_property($1,wm_xproperty_t)
+ xwindows_property($1,clipboard_xproperty_t)
+ xwindows_property($1,unknown_xproperty_t)
+')
+
+#######################################
+## <summary>
+## Template to provide X object permissions on a given X server to
+## an X client domain. Provides the minimal set required by a basic
+## X client application.
+## </summary>
+## <param name="server_prefix">
+## <summary>
+## The prefix of the server domain (e.g., user
+## is the prefix for user_t).
+## </summary>
+## </param>
+## <param name="prefix">
+## <summary>
+## The prefix of the client domain (e.g., user
+## is the prefix for user_t).
+## </summary>
+## </param>
+## <param name="domain">
+## <summary>
+## Client domain allowed access.
+## </summary>
+## </param>
+## <param name="role">
+## <summary>
+## The role associated with the client domain.
+## </summary>
+## </param>
+#
+template(`xwindows_basic_client',`
+ gen_require(`
+ type $1_xserver_t;
+ type $1_root_window_t;
+ type $1_xserver_rm_xproperty_t;
+ type $2_info_xproperty_t;
+ type $1_xserver_info_xproperty_t;
+ type $1_xserver_clipboard_xproperty_t;
+ type $2_client_xproperty_t;
+ attribute $2_xproperty_type;
+ class drawable all_drawable_perms;
+ class window all_window_perms;
+ class gc all_gc_perms;
+ class font all_font_perms;
+ class colormap all_colormap_perms;
+ class property all_property_perms;
+ class cursor all_cursor_perms;
+ class xclient all_xclient_perms;
+ class xserver all_xserver_perms;
+ class xinput all_xinput_perms;
+ class xextension all_xextension_perms;
+ ')
+
+ ##############################
+ #
+ # Local Policy
+ #
+
+ tunable_policy(`xwindows_object_manager',`
+ # X Protocol Extensions
+ allow $3 xextension_type:xextension query;
+ allow $3 std_xext_t:xextension use;
+ allow $3 input_xext_t:xextension use;
+ allow $3 font_xext_t:xextension use;
+ allow $3 shmem_xext_t:xextension use;
+
+ # X Properties
+ # can read resource manager settings on the root window
+ allow $3 $1_xserver_rm_xproperty_t:property read;
+ # can read info properties
+ allow $3 $2_info_xproperty_t:property read;
+ allow $3 $1_xserver_info_xproperty_t:property read;
+ # can read and write client properties
+ allow $3 $2_client_xproperty_t:property { read write free };
+ # can read and write cut buffers on the root window
+ allow $3 $1_xserver_clipboard_xproperty_t:property { read write free };
+
+ # X Windows
+ # can get attributes of root window
+ allow $3 $1_root_window_t:window getattr;
+ # can add children to root window
+ allow $3 $1_root_window_t:window { addchild chstack };
+ # can change properties of root window
+ allow $3 $1_root_window_t:window { listprop chprop chproplist };
+
+ # can query window manager windows (GTK2 thing?)
+ # allow $3 $1_xwm_t:window { enumerate getattr };
+ # allow $3 $1_xwm_t:drawable getattr;
+
+ # X Fonts
+ allow $3 self:font { use free };
+
+ # X Input
+ # can set focus on own windows
+ allow $3 self:window setfocus;
+ allow $3 $1_xserver_t:xinput { setfocus getattr };
+ # can track mouse motions on own windows
+ allow $3 self:window mousemotion;
+ # can create and use cursors
+ allow $3 self:cursor { createglyph setattr free };
+ # can set selections on own windows
+ allow $3 self:window chselection;
+
+ # X Drawing
+ # can query root window attributes
+ allow $3 $1_root_window_t:drawable getattr;
+ allow $3 $1_xserver_t:colormap { read store };
+ allow $3 $1_xserver_t:font { load use free };
+ allow $3 self:drawable { create getattr draw copy destroy };
+ allow $3 self:gc { create setattr free };
+ allow $3 self:window { addchild chprop chproplist chstack create destroy enumerate getattr listprop map move setattr unmap };
+ ')
+')
+
+#######################################
+## <summary>
+## Template to provide X object permissions to an X window manager.
+## </summary>
+## <param name="server_prefix">
+## <summary>
+## The prefix of the server domain (e.g., user
+## is the prefix for user_t).
+## </summary>
+## </param>
+## <param name="prefix">
+## <summary>
+## The prefix of the client domain (e.g., user
+## is the prefix for user_t).
+## </summary>
+## </param>
+## <param name="domain">
+## <summary>
+## Client domain allowed access.
+## </summary>
+## </param>
+## <param name="role">
+## <summary>
+## The role associated with the client domain.
+## </summary>
+## </param>
+#
+template(`xwindows_windowmgr_client',`
+ gen_require(`
+ class xextension use;
+ ')
+
+ ##############################
+ #
+ # Declarations
+ #
+
+ xwindows_basic_client($1,$2,$3,$4)
+
+ ##############################
+ #
+ # Local Policy
+ #
+
+ tunable_policy(`xwindows_object_manager',`
+ # X Protocol Extensions
+ allow $3 windowmgr_xext_t:xextension use;
+
+ # X Properties
+ # can read all security labels
+ allow $3 seclabel_xproperty_type:property read;
+ # can read and write all wm-specific properties
+ allow $3 wm_xproperty_type:property { read write };
+ # can set properties on all windows
+ allow $3 domain:window { chprop chproplist };
+
+ # can install colormaps
+ allow $3 $1_xserver_t:colormap install;
+
+ # X Windows - extensive control over all windows
+ # can query windows for visual information
+ allow $3 domain:drawable getattr;
+ # can enumerate and change attributes of root window
+ allow $3 $1_root_window_t:window { enumerate setattr };
+ # can enumerate, set, and change attributes of all non-root windows
+ allow $3 domain:window { enumerate getattr setattr };
+ # can map and unmap all non-root windows
+ allow $3 domain:window { map unmap move ctrllife };
+ # can send various events to all non-root windows
+ allow $3 domain:window { windowchangeevent clientcomevent };
+ # can reparent all non-root windows
+ allow $3 domain:window { chparent chstack };
+ # can list properties of all non-root windows
+ allow $3 domain:window listprop;
+
+ # X Input
+ # can change input focus on all windows
+ allow $3 domain:window setfocus;
+ allow $3 $1_root_window_t:window setfocus;
+ allow $3 $1_xserver_t:xinput setfocus;
+ # can move the mouse cursor
+ allow $3 $1_xserver_t:xinput warppointer;
+ # can grab server
+ allow $3 $1_xserver_t:xserver { grab ungrab };
+ allow $3 $1_xserver_t:xinput { activegrab passivegrab ungrab };
+
+ # X Drawing
+ # can draw on the root window
+ allow $3 $1_root_window_t:drawable draw;
+ ')
+')
+
+#######################################
+## <summary>
+## Template to provide X object permissions to an X display manager.
+## </summary>
+## <param name="server_prefix">
+## <summary>
+## The prefix of the server domain (e.g., user
+## is the prefix for user_t).
+## </summary>
+## </param>
+## <param name="prefix">
+## <summary>
+## The prefix of the client domain (e.g., user
+## is the prefix for user_t).
+## </summary>
+## </param>
+## <param name="domain">
+## <summary>
+## Client domain allowed access.
+## </summary>
+## </param>
+## <param name="role">
+## <summary>
+## The role associated with the client domain.
+## </summary>
+## </param>
+#
+template(`xwindows_displaymgr_client',`
+ gen_require(`
+ class xextension use;
+ ')
+
+ ##############################
+ #
+ # Declarations
+ #
+
+ xwindows_basic_client($1,$2,$3,$4)
+
+ ##############################
+ #
+ # Local Policy
+ #
+
+ tunable_policy(`xwindows_object_manager',`
+ # X Protocol Extensions
+ allow $3 output_xext_t:xextension use;
+
+ # allow server grabs
+ allow $3 $1_xserver_t:xserver { grab ungrab };
+ allow $3 $1_xserver_t:xinput { getattr activegrab };
+
+ # can move the mouse cursor
+ allow $3 $1_xserver_t:xinput warppointer;
+
+ # can set resource manager properties
+ allow $3 $2_rm_xproperty_t:property { write free };
+
+ # can enumerate windows
+ allow $3 $1_root_window_t:window enumerate;
+ ')
+')
+
+#######################################
+## <summary>
+## Template to provide X object permissions to an X resource manager.
+## </summary>
+## <param name="server_prefix">
+## <summary>
+## The prefix of the server domain (e.g., user
+## is the prefix for user_t).
+## </summary>
+## </param>
+## <param name="prefix">
+## <summary>
+## The prefix of the client domain (e.g., user
+## is the prefix for user_t).
+## </summary>
+## </param>
+## <param name="domain">
+## <summary>
+## Client domain allowed access.
+## </summary>
+## </param>
+## <param name="role">
+## <summary>
+## The role associated with the client domain.
+## </summary>
+## </param>
+#
+template(`xwindows_resourcemgr_client',`
+ gen_require(`
+ class property all_property_perms;
+ ')
+
+ ##############################
+ #
+ # Local Policy
+ #
+
+ tunable_policy(`xwindows_object_manager',`
+ # X Properties
+ # can read and write resource manager settings
+ allow $3 $2_rm_xproperty_t:property { read write };
+ ')
+')
+
+#######################################
+## <summary>
+## Template to provide X object permissions to an X server domain.
+## </summary>
+## <param name="prefix">
+## <summary>
+## The prefix of the domain (e.g., user
+## is the prefix for user_t).
+## </summary>
+## </param>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+## <param name="role">
+## <summary>
+## The role associated with the domain.
+## </summary>
+## </param>
+#
+template(`xwindows_server',`
+ gen_require(`
+ attribute xwindow_type;
+ class window map;
+ class drawable draw;
+ ')
+
+ ##############################
+ #
+ # Declarations
+ #
+
+ # Type for the root window
+ type $1_root_window_t, xwindow_type;
+ role $3 types $1_root_window_t;
+
+ # Types for properties
+ xwindows_property_set($1_xserver)
+ role $3 types $1_xserver_xproperty_type;
+
+ ##############################
+ #
+ # Local Policy
+ #
+
+ tunable_policy(`xwindows_object_manager',`
+ # Labeling rules for root windows
+ type_transition $2 $2:window $1_root_window_t;
+ type_transition $2 $2:drawable $1_root_window_t;
+
+ # Allow server to map the root window
+ allow $2 $1_root_window_t:window map;
+ ')
+')
+
+#######################################
+## <summary>
+## The per role template for the xwindows module.
+## </summary>
+## <desc>
+## <p>
+## This template creates a derived domains which are used
+## for X userspace object manager related programs.
+## </p>
+## <p>
+## This template is invoked automatically for each user, and
+## generally does not need to be invoked directly
+## by policy writers.
+## </p>
+## </desc>
+## <param name="userdomain_prefix">
+## <summary>
+## The prefix of the user domain (e.g., user
+## is the prefix for user_t).
+## </summary>
+## </param>
+## <param name="user_domain">
+## <summary>
+## The type of the user domain.
+## </summary>
+## </param>
+## <param name="user_role">
+## <summary>
+## The role associated with the user domain.
+## </summary>
+## </param>
+#
+template(`xwindows_per_role_template',`
+
+ ##############################
+ #
+ # Declarations
+ #
+
+ # Types for window managers
+ type $1_xwm_t;
+ domain_type($1_xwm_t)
+ domain_entry_file($1_xwm_t,xwm_exec_t)
+ role $3 types $1_xwm_t;
+
+ # Types for resource managers
+ type $1_xrdb_t;
+ domain_type($1_xrdb_t)
+ domain_entry_file($1_xrdb_t,xrdb_exec_t)
+ role $3 types $1_xrdb_t;
+
+ # Protected test type
+ type $1_xprotected_t;
+ domain_type($1_xprotected_t)
+ domain_entry_file($1_xprotected_t,xprotected_exec_t)
+ role $3 types $1_xprotected_t;
+
+ # Types for properties
+ xwindows_property_set($1)
+ role $3 types $1_xproperty_type;
+ xwindows_property_set($1_xwm)
+ role $3 types $1_xwm_xproperty_type;
+ xwindows_property_set($1_xrdb)
+ role $3 types $1_xrdb_xproperty_type;
+ xwindows_property_set($1_xprotected)
+ role $3 types $1_xprotected_xproperty_type;
+
+ # Basic default client
+ xwindows_basic_client($1,$1,$1_t,$3)
+
+ # Other clients
+ xwindows_basic_client($1,$1_xprotected,$1_xprotected_t,$3)
+ xwindows_windowmgr_client($1,$1_xwm,$1_xwm_t,$3)
+ xwindows_resourcemgr_client($1,$1_xrdb,$1_xrdb_t,$3)
+
+ ##############################
+ #
+ # Local Policy
+ #
+
+ tunable_policy(`xwindows_object_manager',`
+ domain_auto_trans($2,xwm_exec_t,$1_xwm_t)
+ domain_auto_trans($2, xrdb_exec_t, $1_xrdb_t)
+ domain_auto_trans($2, xprotected_exec_t, $1_xprotected_t)
+ ')
+')
Index: policy/modules/services/xserver.if
===================================================================
--- policy/modules/services/xserver.if (revision 2180)
+++ policy/modules/services/xserver.if (working copy)
@@ -90,6 +90,13 @@
kernel_read_kernel_sysctls($1_xserver_t)
kernel_write_proc_files($1_xserver_t)
+ # X server userspace object manager
+ tunable_policy(`xwindows_object_manager',`
+ allow $1_xserver_t self:netlink_audit_socket create;
+ allow $1_xserver_t self:netlink_selinux_socket { bind create read };
+ allow $1_xserver_t security_t:security { check_context compute_av compute_create };
+ ')
+
# Run helper programs in $1_xserver_t.
corecmd_search_sbin($1_xserver_t)
corecmd_exec_bin($1_xserver_t)
@@ -267,6 +274,14 @@
##############################
#
+ # $1_xserver_t X Userspace Object Manager
+ #
+ optional_policy(`
+ xwindows_server($1,$1_xserver_t,$3)
+ ')
+
+ ##############################
+ #
# $1_xserver_t Local policy
#
Index: policy/modules/system/unconfined.if
===================================================================
--- policy/modules/system/unconfined.if (revision 2180)
+++ policy/modules/system/unconfined.if (working copy)
@@ -15,6 +15,17 @@
class dbus all_dbus_perms;
class nscd all_nscd_perms;
class passwd all_passwd_perms;
+ class drawable all_drawable_perms;
+ class window all_window_perms;
+ class gc all_gc_perms;
+ class font all_font_perms;
+ class colormap all_colormap_perms;
+ class property all_property_perms;
+ class cursor all_cursor_perms;
+ class xclient all_xclient_perms;
+ class xserver all_xserver_perms;
+ class xinput all_xinput_perms;
+ class xextension all_xextension_perms;
')
# Use any Linux capability.
@@ -31,6 +42,19 @@
allow $1 self:nscd *;
allow $1 self:dbus *;
allow $1 self:passwd *;
+ tunable_policy(`xwindows_object_manager',`
+ allow $1 self:drawable *;
+ allow $1 self:window *;
+ allow $1 self:gc *;
+ allow $1 self:font *;
+ allow $1 self:colormap *;
+ allow $1 self:property *;
+ allow $1 self:cursor *;
+ allow $1 self:xclient *;
+ allow $1 self:xserver *;
+ allow $1 self:xinput *;
+ allow $1 self:xextension *;
+ ')
kernel_unconfined($1)
corenet_unconfined($1)
Index: policy/global_tunables
===================================================================
--- policy/global_tunables (revision 2180)
+++ policy/global_tunables (working copy)
@@ -348,6 +348,13 @@
## </desc>
gen_tunable(use_samba_home_dirs,false)
+## <desc>
+## <p>
+## Support X userspace object manager
+## </p>
+## </desc>
+gen_tunable(xwindows_object_manager,false)
+
########################################
#
# Strict policy specific
--
Eamon Walsh <ewalsh@tycho.nsa.gov>
National Security Agency
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 12+ messages in thread* Re: [PATCH] refpolicy: experimental X policy -v2
2007-02-13 23:28 ` [PATCH] refpolicy: experimental X policy -v2 Eamon Walsh
@ 2007-02-27 18:53 ` Christopher J. PeBenito
2007-03-20 22:27 ` Eamon Walsh
0 siblings, 1 reply; 12+ messages in thread
From: Christopher J. PeBenito @ 2007-02-27 18:53 UTC (permalink / raw)
To: Eamon Walsh; +Cc: selinux
On Tue, 2007-02-13 at 18:28 -0500, Eamon Walsh wrote:
> This is an experimental policy for use with the X userspace object
> manager. It includes both unconfined and strict policy and is
> controlled by a tunable, xwindows_object_manager. The labeling conf
> file in the X.org xserver git (XACE-SELINUX branch) assumes that this
> policy is loaded, i.e. the types listed in that file are defined in this
> policy.
Unfortunately I didn't get a chance to look at this until today. It'll
take some time to fully understand all this, but I have some notes from
my initial review inline:
> modules/services/xwindows.fc | 13 +
> modules/services/xwindows.if | 521 +++++++++++++++++++++++++++++++++++++++++++
> modules/services/xwindows.te | 65 +++++
Eventually this should probably be merged into the xserver module.
Potentially in a tunable, when that support becomes available. However,
for the purposes of vetting the design, a separate module is fine.
> Index: policy/modules/services/xwindows.if
> ===================================================================
> --- policy/modules/services/xwindows.if (revision 0)
> +++ policy/modules/services/xwindows.if (revision 0)
> @@ -0,0 +1,521 @@
> +template(`xwindows_property',`
> + gen_require(`
> + type $1_t;
> + type $2;
> + attribute xproperty_type;
> + attribute $1_xproperty_type;
> + attribute $2ype;
> + class property all_property_perms;
> + ')
> +
> + type $1_$2, $1_xproperty_type, $2ype, xproperty_type;
> + type_transition $1_t $2:property $1_$2;
> +')
> +template(`xwindows_property_set',`
> +
> + attribute $1_xproperty_type;
> + xwindows_property($1,client_xproperty_t)
> + xwindows_property($1,info_xproperty_t)
> + xwindows_property($1,seclabel_xproperty_t)
> + xwindows_property($1,rm_xproperty_t)
> + xwindows_property($1,wm_xproperty_t)
> + xwindows_property($1,clipboard_xproperty_t)
> + xwindows_property($1,unknown_xproperty_t)
> +')
Is there be a situation where one wouldn't want a full set of
properties? If not, I'd rather eliminate xwindows_property(), because
the name mangling being done with the base property type names (e.g.,
$2ype) is a little ugly.
> +template(`xwindows_windowmgr_client',`
[cut]
> + # can set properties on all windows
> + allow $3 domain:window { chprop chproplist };
> + # X Windows - extensive control over all windows
> + # can query windows for visual information
> + allow $3 domain:drawable getattr;
> + # can enumerate and change attributes of root window
> + allow $3 $1_root_window_t:window { enumerate setattr };
> + # can enumerate, set, and change attributes of all non-root windows
> + allow $3 domain:window { enumerate getattr setattr };
> + # can map and unmap all non-root windows
> + allow $3 domain:window { map unmap move ctrllife };
> + # can send various events to all non-root windows
> + allow $3 domain:window { windowchangeevent clientcomevent };
> + # can reparent all non-root windows
> + allow $3 domain:window { chparent chstack };
> + # can list properties of all non-root windows
> + allow $3 domain:window listprop;
> + # X Input
> + # can change input focus on all windows
> + allow $3 domain:window setfocus;
domain attribute can't be used here, since its not owned by this module.
Its overly broad too. One thing to investigate would be adding an
attribute, something like xserver_xclient_type for all X clients, and
then use that here. Then that attribute would be added to a domain,
perhaps via xserver_user_client_template().
> +template(`xwindows_displaymgr_client',`
> + gen_require(`
> + class xextension use;
> + ')
> + xwindows_basic_client($1,$2,$3,$4)
> + tunable_policy(`xwindows_object_manager',`
> + # X Protocol Extensions
> + allow $3 output_xext_t:xextension use;
> +
> + # allow server grabs
> + allow $3 $1_xserver_t:xserver { grab ungrab };
> + allow $3 $1_xserver_t:xinput { getattr activegrab };
> +
> + # can move the mouse cursor
> + allow $3 $1_xserver_t:xinput warppointer;
> +
> + # can set resource manager properties
> + allow $3 $2_rm_xproperty_t:property { write free };
> +
> + # can enumerate windows
> + allow $3 $1_root_window_t:window enumerate;
> + ')
> +')
I suspect this might work as part of xserver_user_client_template(), but
the derived type for the property is going to be a problem.
> +template(`xwindows_resourcemgr_client',`
> + gen_require(`
> + class property all_property_perms;
> + ')
> + tunable_policy(`xwindows_object_manager',`
> + # X Properties
> + # can read and write resource manager settings
> + allow $3 $2_rm_xproperty_t:property { read write };
> + ')
> +')
Not sure why there is no $1. Do you anticipate this being used outside
of the one use in the patch? If not, the rule might as well go in the
caller.
> Index: policy/modules/services/xserver.if
> ===================================================================
> --- policy/modules/services/xserver.if (revision 2180)
> +++ policy/modules/services/xserver.if (working copy)
> @@ -90,6 +90,13 @@
> kernel_read_kernel_sysctls($1_xserver_t)
> kernel_write_proc_files($1_xserver_t)
>
> + # X server userspace object manager
> + tunable_policy(`xwindows_object_manager',`
> + allow $1_xserver_t self:netlink_audit_socket create;
> + allow $1_xserver_t self:netlink_selinux_socket { bind create read };
> + allow $1_xserver_t security_t:security { check_context compute_av compute_create };
This should be:
send_audit_msgs_pattern($1_xserver_t)
selinux_validate_context($1_xserver_t)
selinux_compute_access_vector($1_xserver_t)
selinux_compute_create_context($1_xserver_t)
> Index: policy/modules/system/unconfined.if
> ===================================================================
> --- policy/modules/system/unconfined.if (revision 2180)
> +++ policy/modules/system/unconfined.if (working copy)
> @@ -31,6 +42,19 @@
> allow $1 self:nscd *;
> allow $1 self:dbus *;
> allow $1 self:passwd *;
> + tunable_policy(`xwindows_object_manager',`
> + allow $1 self:drawable *;
> + allow $1 self:window *;
> + allow $1 self:gc *;
> + allow $1 self:font *;
> + allow $1 self:colormap *;
> + allow $1 self:property *;
> + allow $1 self:cursor *;
> + allow $1 self:xclient *;
> + allow $1 self:xserver *;
> + allow $1 self:xinput *;
> + allow $1 self:xextension *;
> + ')
I don't think this needs to be tunable. It probably should go in an
xserver_unconfined() too (as should the classes for the other userland
object managers for that matter).
--
Chris PeBenito
Tresys Technology, LLC
(410) 290-1411 x150
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 12+ messages in thread* Re: [PATCH] refpolicy: experimental X policy -v2
2007-02-27 18:53 ` Christopher J. PeBenito
@ 2007-03-20 22:27 ` Eamon Walsh
2007-03-20 22:58 ` Xavier Toth
2007-03-21 16:54 ` Christopher J. PeBenito
0 siblings, 2 replies; 12+ messages in thread
From: Eamon Walsh @ 2007-03-20 22:27 UTC (permalink / raw)
To: Christopher J. PeBenito; +Cc: selinux
Christopher J. PeBenito wrote:
> On Tue, 2007-02-13 at 18:28 -0500, Eamon Walsh wrote:
>> This is an experimental policy for use with the X userspace object
>> manager. It includes both unconfined and strict policy and is
>> controlled by a tunable, xwindows_object_manager. The labeling conf
>> file in the X.org xserver git (XACE-SELINUX branch) assumes that this
>> policy is loaded, i.e. the types listed in that file are defined in this
>> policy.
>
> Unfortunately I didn't get a chance to look at this until today. It'll
> take some time to fully understand all this, but I have some notes from
> my initial review inline:
>
>> modules/services/xwindows.fc | 13 +
>> modules/services/xwindows.if | 521 +++++++++++++++++++++++++++++++++++++++++++
>> modules/services/xwindows.te | 65 +++++
>
> Eventually this should probably be merged into the xserver module.
> Potentially in a tunable, when that support becomes available. However,
> for the purposes of vetting the design, a separate module is fine.
I think it's important to distinguish between the policy that governs
the operation of the X server itself and the policy that governs X
applications. Putting everything into xserver may blur that distinction.
>
>> Index: policy/modules/services/xwindows.if
>> ===================================================================
>> --- policy/modules/services/xwindows.if (revision 0)
>> +++ policy/modules/services/xwindows.if (revision 0)
>> @@ -0,0 +1,521 @@
>
>> +template(`xwindows_property',`
>> + gen_require(`
>> + type $1_t;
>> + type $2;
>> + attribute xproperty_type;
>> + attribute $1_xproperty_type;
>> + attribute $2ype;
>> + class property all_property_perms;
>> + ')
>> +
>> + type $1_$2, $1_xproperty_type, $2ype, xproperty_type;
>> + type_transition $1_t $2:property $1_$2;
>> +')
>
>> +template(`xwindows_property_set',`
>> +
>
>> + attribute $1_xproperty_type;
>> + xwindows_property($1,client_xproperty_t)
>> + xwindows_property($1,info_xproperty_t)
>> + xwindows_property($1,seclabel_xproperty_t)
>> + xwindows_property($1,rm_xproperty_t)
>> + xwindows_property($1,wm_xproperty_t)
>> + xwindows_property($1,clipboard_xproperty_t)
>> + xwindows_property($1,unknown_xproperty_t)
>> +')
>
> Is there be a situation where one wouldn't want a full set of
> properties? If not, I'd rather eliminate xwindows_property(), because
> the name mangling being done with the base property type names (e.g.,
> $2ype) is a little ugly.
Yeah I'll work on cleaning this up. You're right, the full property set
should be OK in all cases.
>
>
>> +template(`xwindows_windowmgr_client',`
> [cut]
>> + # can set properties on all windows
>> + allow $3 domain:window { chprop chproplist };
>
>> + # X Windows - extensive control over all windows
>> + # can query windows for visual information
>> + allow $3 domain:drawable getattr;
>> + # can enumerate and change attributes of root window
>> + allow $3 $1_root_window_t:window { enumerate setattr };
>> + # can enumerate, set, and change attributes of all non-root windows
>> + allow $3 domain:window { enumerate getattr setattr };
>> + # can map and unmap all non-root windows
>> + allow $3 domain:window { map unmap move ctrllife };
>> + # can send various events to all non-root windows
>> + allow $3 domain:window { windowchangeevent clientcomevent };
>> + # can reparent all non-root windows
>> + allow $3 domain:window { chparent chstack };
>> + # can list properties of all non-root windows
>> + allow $3 domain:window listprop;
>
>> + # X Input
>> + # can change input focus on all windows
>> + allow $3 domain:window setfocus;
>
> domain attribute can't be used here, since its not owned by this module.
> Its overly broad too. One thing to investigate would be adding an
> attribute, something like xserver_xclient_type for all X clients, and
> then use that here. Then that attribute would be added to a domain,
> perhaps via xserver_user_client_template().
Yes, that's fine.
>
>
>> +template(`xwindows_displaymgr_client',`
>> + gen_require(`
>> + class xextension use;
>> + ')
>
>> + xwindows_basic_client($1,$2,$3,$4)
>
>> + tunable_policy(`xwindows_object_manager',`
>> + # X Protocol Extensions
>> + allow $3 output_xext_t:xextension use;
>> +
>> + # allow server grabs
>> + allow $3 $1_xserver_t:xserver { grab ungrab };
>> + allow $3 $1_xserver_t:xinput { getattr activegrab };
>> +
>> + # can move the mouse cursor
>> + allow $3 $1_xserver_t:xinput warppointer;
>> +
>> + # can set resource manager properties
>> + allow $3 $2_rm_xproperty_t:property { write free };
>> +
>> + # can enumerate windows
>> + allow $3 $1_root_window_t:window enumerate;
>> + ')
>> +')
>
> I suspect this might work as part of xserver_user_client_template(), but
> the derived type for the property is going to be a problem.
Why is that? The derived property types should all be defined in the
same module.
In this particular case though it's probably safe to say that $1 and $2
will both be "xdm".
I think a deeper question somewhat related to this is what the prefix on
the X server's domain should be. In the policy as written I'm assuming
that the user domain prefix $2 and X server domain prefix $1 are
independent. This is because 1) the xserver runs as xdm_xserver_t when
started from gdm but user_xserver_t when started by user with startx,
and 2) because you might want to allow things like sysadm_xdomain_t
programs to work on user_xserver_t X servers.
It would be useful to standardize on either always running the X server
under a single domain, or always running it with the user prefixed domain.
>
>
>> +template(`xwindows_resourcemgr_client',`
>> + gen_require(`
>> + class property all_property_perms;
>> + ')
>
>> + tunable_policy(`xwindows_object_manager',`
>> + # X Properties
>> + # can read and write resource manager settings
>> + allow $3 $2_rm_xproperty_t:property { read write };
>> + ')
>> +')
>
> Not sure why there is no $1. Do you anticipate this being used outside
> of the one use in the patch? If not, the rule might as well go in the
> caller.
>
>
>> Index: policy/modules/services/xserver.if
>> ===================================================================
>> --- policy/modules/services/xserver.if (revision 2180)
>> +++ policy/modules/services/xserver.if (working copy)
>> @@ -90,6 +90,13 @@
>> kernel_read_kernel_sysctls($1_xserver_t)
>> kernel_write_proc_files($1_xserver_t)
>>
>> + # X server userspace object manager
>> + tunable_policy(`xwindows_object_manager',`
>> + allow $1_xserver_t self:netlink_audit_socket create;
>> + allow $1_xserver_t self:netlink_selinux_socket { bind create read };
>> + allow $1_xserver_t security_t:security { check_context compute_av compute_create };
>
> This should be:
>
> send_audit_msgs_pattern($1_xserver_t)
> selinux_validate_context($1_xserver_t)
> selinux_compute_access_vector($1_xserver_t)
> selinux_compute_create_context($1_xserver_t)
Thx, used audit2allow and forgot to go back and look up interfaces.
>
>> Index: policy/modules/system/unconfined.if
>> ===================================================================
>> --- policy/modules/system/unconfined.if (revision 2180)
>> +++ policy/modules/system/unconfined.if (working copy)
>> @@ -31,6 +42,19 @@
>> allow $1 self:nscd *;
>> allow $1 self:dbus *;
>> allow $1 self:passwd *;
>> + tunable_policy(`xwindows_object_manager',`
>> + allow $1 self:drawable *;
>> + allow $1 self:window *;
>> + allow $1 self:gc *;
>> + allow $1 self:font *;
>> + allow $1 self:colormap *;
>> + allow $1 self:property *;
>> + allow $1 self:cursor *;
>> + allow $1 self:xclient *;
>> + allow $1 self:xserver *;
>> + allow $1 self:xinput *;
>> + allow $1 self:xextension *;
>> + ')
>
> I don't think this needs to be tunable. It probably should go in an
> xserver_unconfined() too (as should the classes for the other userland
> object managers for that matter).
>
OK. Will repost.
--
Eamon Walsh <ewalsh@tycho.nsa.gov>
National Security Agency
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 12+ messages in thread* Re: [PATCH] refpolicy: experimental X policy -v2
2007-03-20 22:27 ` Eamon Walsh
@ 2007-03-20 22:58 ` Xavier Toth
2007-03-21 16:54 ` Christopher J. PeBenito
1 sibling, 0 replies; 12+ messages in thread
From: Xavier Toth @ 2007-03-20 22:58 UTC (permalink / raw)
To: Eamon Walsh; +Cc: Christopher J. PeBenito, selinux
Also I had tried to run in enforcing and gotten avcs related to
/dev/mem access. And I'm way out of my league here but maybe we need
something like:
dev_rx_raw_memory(xdm_xserver_t)
dev_wx_raw_memory(xdm_xserver_t)
in xserver.te
Ted
On 3/20/07, Eamon Walsh <ewalsh@tycho.nsa.gov> wrote:
> Christopher J. PeBenito wrote:
> > On Tue, 2007-02-13 at 18:28 -0500, Eamon Walsh wrote:
> >> This is an experimental policy for use with the X userspace object
> >> manager. It includes both unconfined and strict policy and is
> >> controlled by a tunable, xwindows_object_manager. The labeling conf
> >> file in the X.org xserver git (XACE-SELINUX branch) assumes that this
> >> policy is loaded, i.e. the types listed in that file are defined in this
> >> policy.
> >
> > Unfortunately I didn't get a chance to look at this until today. It'll
> > take some time to fully understand all this, but I have some notes from
> > my initial review inline:
> >
> >> modules/services/xwindows.fc | 13 +
> >> modules/services/xwindows.if | 521 +++++++++++++++++++++++++++++++++++++++++++
> >> modules/services/xwindows.te | 65 +++++
> >
> > Eventually this should probably be merged into the xserver module.
> > Potentially in a tunable, when that support becomes available. However,
> > for the purposes of vetting the design, a separate module is fine.
>
> I think it's important to distinguish between the policy that governs
> the operation of the X server itself and the policy that governs X
> applications. Putting everything into xserver may blur that distinction.
>
> >
> >> Index: policy/modules/services/xwindows.if
> >> ===================================================================
> >> --- policy/modules/services/xwindows.if (revision 0)
> >> +++ policy/modules/services/xwindows.if (revision 0)
> >> @@ -0,0 +1,521 @@
> >
> >> +template(`xwindows_property',`
> >> + gen_require(`
> >> + type $1_t;
> >> + type $2;
> >> + attribute xproperty_type;
> >> + attribute $1_xproperty_type;
> >> + attribute $2ype;
> >> + class property all_property_perms;
> >> + ')
> >> +
> >> + type $1_$2, $1_xproperty_type, $2ype, xproperty_type;
> >> + type_transition $1_t $2:property $1_$2;
> >> +')
> >
> >> +template(`xwindows_property_set',`
> >> +
> >
> >> + attribute $1_xproperty_type;
> >> + xwindows_property($1,client_xproperty_t)
> >> + xwindows_property($1,info_xproperty_t)
> >> + xwindows_property($1,seclabel_xproperty_t)
> >> + xwindows_property($1,rm_xproperty_t)
> >> + xwindows_property($1,wm_xproperty_t)
> >> + xwindows_property($1,clipboard_xproperty_t)
> >> + xwindows_property($1,unknown_xproperty_t)
> >> +')
> >
> > Is there be a situation where one wouldn't want a full set of
> > properties? If not, I'd rather eliminate xwindows_property(), because
> > the name mangling being done with the base property type names (e.g.,
> > $2ype) is a little ugly.
>
> Yeah I'll work on cleaning this up. You're right, the full property set
> should be OK in all cases.
>
> >
> >
> >> +template(`xwindows_windowmgr_client',`
> > [cut]
> >> + # can set properties on all windows
> >> + allow $3 domain:window { chprop chproplist };
> >
> >> + # X Windows - extensive control over all windows
> >> + # can query windows for visual information
> >> + allow $3 domain:drawable getattr;
> >> + # can enumerate and change attributes of root window
> >> + allow $3 $1_root_window_t:window { enumerate setattr };
> >> + # can enumerate, set, and change attributes of all non-root windows
> >> + allow $3 domain:window { enumerate getattr setattr };
> >> + # can map and unmap all non-root windows
> >> + allow $3 domain:window { map unmap move ctrllife };
> >> + # can send various events to all non-root windows
> >> + allow $3 domain:window { windowchangeevent clientcomevent };
> >> + # can reparent all non-root windows
> >> + allow $3 domain:window { chparent chstack };
> >> + # can list properties of all non-root windows
> >> + allow $3 domain:window listprop;
> >
> >> + # X Input
> >> + # can change input focus on all windows
> >> + allow $3 domain:window setfocus;
> >
> > domain attribute can't be used here, since its not owned by this module.
> > Its overly broad too. One thing to investigate would be adding an
> > attribute, something like xserver_xclient_type for all X clients, and
> > then use that here. Then that attribute would be added to a domain,
> > perhaps via xserver_user_client_template().
>
> Yes, that's fine.
>
> >
> >
> >> +template(`xwindows_displaymgr_client',`
> >> + gen_require(`
> >> + class xextension use;
> >> + ')
> >
> >> + xwindows_basic_client($1,$2,$3,$4)
> >
> >> + tunable_policy(`xwindows_object_manager',`
> >> + # X Protocol Extensions
> >> + allow $3 output_xext_t:xextension use;
> >> +
> >> + # allow server grabs
> >> + allow $3 $1_xserver_t:xserver { grab ungrab };
> >> + allow $3 $1_xserver_t:xinput { getattr activegrab };
> >> +
> >> + # can move the mouse cursor
> >> + allow $3 $1_xserver_t:xinput warppointer;
> >> +
> >> + # can set resource manager properties
> >> + allow $3 $2_rm_xproperty_t:property { write free };
> >> +
> >> + # can enumerate windows
> >> + allow $3 $1_root_window_t:window enumerate;
> >> + ')
> >> +')
> >
> > I suspect this might work as part of xserver_user_client_template(), but
> > the derived type for the property is going to be a problem.
>
> Why is that? The derived property types should all be defined in the
> same module.
>
> In this particular case though it's probably safe to say that $1 and $2
> will both be "xdm".
>
> I think a deeper question somewhat related to this is what the prefix on
> the X server's domain should be. In the policy as written I'm assuming
> that the user domain prefix $2 and X server domain prefix $1 are
> independent. This is because 1) the xserver runs as xdm_xserver_t when
> started from gdm but user_xserver_t when started by user with startx,
> and 2) because you might want to allow things like sysadm_xdomain_t
> programs to work on user_xserver_t X servers.
>
> It would be useful to standardize on either always running the X server
> under a single domain, or always running it with the user prefixed domain.
>
> >
> >
> >> +template(`xwindows_resourcemgr_client',`
> >> + gen_require(`
> >> + class property all_property_perms;
> >> + ')
> >
> >> + tunable_policy(`xwindows_object_manager',`
> >> + # X Properties
> >> + # can read and write resource manager settings
> >> + allow $3 $2_rm_xproperty_t:property { read write };
> >> + ')
> >> +')
> >
> > Not sure why there is no $1. Do you anticipate this being used outside
> > of the one use in the patch? If not, the rule might as well go in the
> > caller.
> >
> >
> >> Index: policy/modules/services/xserver.if
> >> ===================================================================
> >> --- policy/modules/services/xserver.if (revision 2180)
> >> +++ policy/modules/services/xserver.if (working copy)
> >> @@ -90,6 +90,13 @@
> >> kernel_read_kernel_sysctls($1_xserver_t)
> >> kernel_write_proc_files($1_xserver_t)
> >>
> >> + # X server userspace object manager
> >> + tunable_policy(`xwindows_object_manager',`
> >> + allow $1_xserver_t self:netlink_audit_socket create;
> >> + allow $1_xserver_t self:netlink_selinux_socket { bind create read };
> >> + allow $1_xserver_t security_t:security { check_context compute_av compute_create };
> >
> > This should be:
> >
> > send_audit_msgs_pattern($1_xserver_t)
> > selinux_validate_context($1_xserver_t)
> > selinux_compute_access_vector($1_xserver_t)
> > selinux_compute_create_context($1_xserver_t)
>
> Thx, used audit2allow and forgot to go back and look up interfaces.
>
> >
> >> Index: policy/modules/system/unconfined.if
> >> ===================================================================
> >> --- policy/modules/system/unconfined.if (revision 2180)
> >> +++ policy/modules/system/unconfined.if (working copy)
> >> @@ -31,6 +42,19 @@
> >> allow $1 self:nscd *;
> >> allow $1 self:dbus *;
> >> allow $1 self:passwd *;
> >> + tunable_policy(`xwindows_object_manager',`
> >> + allow $1 self:drawable *;
> >> + allow $1 self:window *;
> >> + allow $1 self:gc *;
> >> + allow $1 self:font *;
> >> + allow $1 self:colormap *;
> >> + allow $1 self:property *;
> >> + allow $1 self:cursor *;
> >> + allow $1 self:xclient *;
> >> + allow $1 self:xserver *;
> >> + allow $1 self:xinput *;
> >> + allow $1 self:xextension *;
> >> + ')
> >
> > I don't think this needs to be tunable. It probably should go in an
> > xserver_unconfined() too (as should the classes for the other userland
> > object managers for that matter).
> >
>
> OK. Will repost.
>
> --
> Eamon Walsh <ewalsh@tycho.nsa.gov>
> National Security Agency
>
> --
> This message was distributed to subscribers of the selinux mailing list.
> If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
> the words "unsubscribe selinux" without quotes as the message.
>
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 12+ messages in thread* Re: [PATCH] refpolicy: experimental X policy -v2
2007-03-20 22:27 ` Eamon Walsh
2007-03-20 22:58 ` Xavier Toth
@ 2007-03-21 16:54 ` Christopher J. PeBenito
2007-03-21 19:58 ` Eamon Walsh
1 sibling, 1 reply; 12+ messages in thread
From: Christopher J. PeBenito @ 2007-03-21 16:54 UTC (permalink / raw)
To: Eamon Walsh; +Cc: selinux
On Tue, 2007-03-20 at 18:27 -0400, Eamon Walsh wrote:
> Christopher J. PeBenito wrote:
> > On Tue, 2007-02-13 at 18:28 -0500, Eamon Walsh wrote:
> >> This is an experimental policy for use with the X userspace object
> >> manager. It includes both unconfined and strict policy and is
> >> controlled by a tunable, xwindows_object_manager. The labeling conf
> >> file in the X.org xserver git (XACE-SELINUX branch) assumes that this
> >> policy is loaded, i.e. the types listed in that file are defined in this
> >> policy.
> >
> > Unfortunately I didn't get a chance to look at this until today. It'll
> > take some time to fully understand all this, but I have some notes from
> > my initial review inline:
> >
> >> modules/services/xwindows.fc | 13 +
> >> modules/services/xwindows.if | 521 +++++++++++++++++++++++++++++++++++++++++++
> >> modules/services/xwindows.te | 65 +++++
> >
> > Eventually this should probably be merged into the xserver module.
> > Potentially in a tunable, when that support becomes available. However,
> > for the purposes of vetting the design, a separate module is fine.
>
> I think it's important to distinguish between the policy that governs
> the operation of the X server itself and the policy that governs X
> applications. Putting everything into xserver may blur that distinction.
These are common rules among X client programs that are tied to how the
enforcement of the X server works, which is why I think it belongs in
the xserver module.
> >> +template(`xwindows_displaymgr_client',`
> >> + gen_require(`
> >> + class xextension use;
> >> + ')
> >
> >> + xwindows_basic_client($1,$2,$3,$4)
> >
> >> + tunable_policy(`xwindows_object_manager',`
> >> + # X Protocol Extensions
> >> + allow $3 output_xext_t:xextension use;
> >> +
> >> + # allow server grabs
> >> + allow $3 $1_xserver_t:xserver { grab ungrab };
> >> + allow $3 $1_xserver_t:xinput { getattr activegrab };
> >> +
> >> + # can move the mouse cursor
> >> + allow $3 $1_xserver_t:xinput warppointer;
> >> +
> >> + # can set resource manager properties
> >> + allow $3 $2_rm_xproperty_t:property { write free };
> >> +
> >> + # can enumerate windows
> >> + allow $3 $1_root_window_t:window enumerate;
> >> + ')
> >> +')
> >
> > I suspect this might work as part of xserver_user_client_template(), but
> > the derived type for the property is going to be a problem.
>
> Why is that? The derived property types should all be defined in the
> same module.
>
> In this particular case though it's probably safe to say that $1 and $2
> will both be "xdm".
Ok, we'll leave it for now, though I'm not yet 100% convinced.
> I think a deeper question somewhat related to this is what the prefix on
> the X server's domain should be. In the policy as written I'm assuming
> that the user domain prefix $2 and X server domain prefix $1 are
> independent. This is because 1) the xserver runs as xdm_xserver_t when
> started from gdm but user_xserver_t when started by user with startx,
> and
Well thats because with startx the user itself is starting up the
xserver, whereas with a display manager, you don't know the user until
after the xserver is already running.
> 2) because you might want to allow things like sysadm_xdomain_t
> programs to work on user_xserver_t X servers. It would be useful to
> standardize on either always running the X server under a single
> domain, or always running it with the user prefixed domain.
> >> +template(`xwindows_resourcemgr_client',`
> >> + gen_require(`
> >> + class property all_property_perms;
> >> + ')
> >
> >> + tunable_policy(`xwindows_object_manager',`
> >> + # X Properties
> >> + # can read and write resource manager settings
> >> + allow $3 $2_rm_xproperty_t:property { read write };
> >> + ')
> >> +')
> >
> > Not sure why there is no $1. Do you anticipate this being used outside
> > of the one use in the patch? If not, the rule might as well go in the
> > caller.
You missed responding on this.
--
Chris PeBenito
Tresys Technology, LLC
(410) 290-1411 x150
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 12+ messages in thread* Re: [PATCH] refpolicy: experimental X policy -v2
2007-03-21 16:54 ` Christopher J. PeBenito
@ 2007-03-21 19:58 ` Eamon Walsh
2007-03-21 20:53 ` Christopher J. PeBenito
0 siblings, 1 reply; 12+ messages in thread
From: Eamon Walsh @ 2007-03-21 19:58 UTC (permalink / raw)
To: Christopher J. PeBenito; +Cc: selinux
Christopher J. PeBenito wrote:
> On Tue, 2007-03-20 at 18:27 -0400, Eamon Walsh wrote:
>> Christopher J. PeBenito wrote:
>>> On Tue, 2007-02-13 at 18:28 -0500, Eamon Walsh wrote:
>>>> This is an experimental policy for use with the X userspace object
>>>> manager. It includes both unconfined and strict policy and is
>>>> controlled by a tunable, xwindows_object_manager. The labeling conf
>>>> file in the X.org xserver git (XACE-SELINUX branch) assumes that this
>>>> policy is loaded, i.e. the types listed in that file are defined in this
>>>> policy.
>>> Unfortunately I didn't get a chance to look at this until today. It'll
>>> take some time to fully understand all this, but I have some notes from
>>> my initial review inline:
>>>
>>>> modules/services/xwindows.fc | 13 +
>>>> modules/services/xwindows.if | 521 +++++++++++++++++++++++++++++++++++++++++++
>>>> modules/services/xwindows.te | 65 +++++
>>> Eventually this should probably be merged into the xserver module.
>>> Potentially in a tunable, when that support becomes available. However,
>>> for the purposes of vetting the design, a separate module is fine.
>> I think it's important to distinguish between the policy that governs
>> the operation of the X server itself and the policy that governs X
>> applications. Putting everything into xserver may blur that distinction.
>
> These are common rules among X client programs that are tied to how the
> enforcement of the X server works, which is why I think it belongs in
> the xserver module.
Look at the example of the /dev/mem access denial. This issue was
reported to me even though it's an X server issue, not an X application
issue. If I were in charge of managing X application policy on some
installation, I wouldn't want the kernel policy for the X server jumbled
in with it.
Just like how we're separating userspace object manager Flask
definitions from the kernel ones. In fact, I had originally created an
entire separate directory "userspace" to use instead of services/.
Reconsidered that, but still like the idea of separate modules.
>
>>>> +template(`xwindows_displaymgr_client',`
>>>> + gen_require(`
>>>> + class xextension use;
>>>> + ')
>>>> + xwindows_basic_client($1,$2,$3,$4)
>>>> + tunable_policy(`xwindows_object_manager',`
>>>> + # X Protocol Extensions
>>>> + allow $3 output_xext_t:xextension use;
>>>> +
>>>> + # allow server grabs
>>>> + allow $3 $1_xserver_t:xserver { grab ungrab };
>>>> + allow $3 $1_xserver_t:xinput { getattr activegrab };
>>>> +
>>>> + # can move the mouse cursor
>>>> + allow $3 $1_xserver_t:xinput warppointer;
>>>> +
>>>> + # can set resource manager properties
>>>> + allow $3 $2_rm_xproperty_t:property { write free };
>>>> +
>>>> + # can enumerate windows
>>>> + allow $3 $1_root_window_t:window enumerate;
>>>> + ')
>>>> +')
>>> I suspect this might work as part of xserver_user_client_template(), but
>>> the derived type for the property is going to be a problem.
>> Why is that? The derived property types should all be defined in the
>> same module.
>>
>> In this particular case though it's probably safe to say that $1 and $2
>> will both be "xdm".
>
> Ok, we'll leave it for now, though I'm not yet 100% convinced.
>
>> I think a deeper question somewhat related to this is what the prefix on
>> the X server's domain should be. In the policy as written I'm assuming
>> that the user domain prefix $2 and X server domain prefix $1 are
>> independent. This is because 1) the xserver runs as xdm_xserver_t when
>> started from gdm but user_xserver_t when started by user with startx,
>> and
>
> Well thats because with startx the user itself is starting up the
> xserver, whereas with a display manager, you don't know the user until
> after the xserver is already running.
Maybe gdm should restart the X server after the user has logged in, or
the xserver should change its own context. Both programs already have
SELinux patches, adding this functionality could be done.
>
>> 2) because you might want to allow things like sysadm_xdomain_t
>> programs to work on user_xserver_t X servers. It would be useful to
>> standardize on either always running the X server under a single
>> domain, or always running it with the user prefixed domain.
>
>
>>>> +template(`xwindows_resourcemgr_client',`
>>>> + gen_require(`
>>>> + class property all_property_perms;
>>>> + ')
>>>> + tunable_policy(`xwindows_object_manager',`
>>>> + # X Properties
>>>> + # can read and write resource manager settings
>>>> + allow $3 $2_rm_xproperty_t:property { read write };
>>>> + ')
>>>> +')
>>> Not sure why there is no $1. Do you anticipate this being used outside
>>> of the one use in the patch? If not, the rule might as well go in the
>>> caller.
>
> You missed responding on this.
>
I guess this one could be inlined in the per_user template for now.
But as far as outside callers, there will be external modules that need
to call at a minimum the basic X client interface in the future to
authorize their types for X access.
--
Eamon Walsh <ewalsh@tycho.nsa.gov>
National Security Agency
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 12+ messages in thread* Re: [PATCH] refpolicy: experimental X policy -v2
2007-03-21 19:58 ` Eamon Walsh
@ 2007-03-21 20:53 ` Christopher J. PeBenito
2007-03-22 0:29 ` Eamon Walsh
0 siblings, 1 reply; 12+ messages in thread
From: Christopher J. PeBenito @ 2007-03-21 20:53 UTC (permalink / raw)
To: Eamon Walsh; +Cc: selinux
On Wed, 2007-03-21 at 15:58 -0400, Eamon Walsh wrote:
> Christopher J. PeBenito wrote:
> > On Tue, 2007-03-20 at 18:27 -0400, Eamon Walsh wrote:
> >> Christopher J. PeBenito wrote:
> >>> On Tue, 2007-02-13 at 18:28 -0500, Eamon Walsh wrote:
> >>>> This is an experimental policy for use with the X userspace object
> >>>> manager. It includes both unconfined and strict policy and is
> >>>> controlled by a tunable, xwindows_object_manager. The labeling conf
> >>>> file in the X.org xserver git (XACE-SELINUX branch) assumes that this
> >>>> policy is loaded, i.e. the types listed in that file are defined in this
> >>>> policy.
> >>> Unfortunately I didn't get a chance to look at this until today. It'll
> >>> take some time to fully understand all this, but I have some notes from
> >>> my initial review inline:
> >>>
> >>>> modules/services/xwindows.fc | 13 +
> >>>> modules/services/xwindows.if | 521 +++++++++++++++++++++++++++++++++++++++++++
> >>>> modules/services/xwindows.te | 65 +++++
> >>> Eventually this should probably be merged into the xserver module.
> >>> Potentially in a tunable, when that support becomes available. However,
> >>> for the purposes of vetting the design, a separate module is fine.
> >> I think it's important to distinguish between the policy that governs
> >> the operation of the X server itself and the policy that governs X
> >> applications. Putting everything into xserver may blur that distinction.
> >
> > These are common rules among X client programs that are tied to how the
> > enforcement of the X server works, which is why I think it belongs in
> > the xserver module.
>
> Look at the example of the /dev/mem access denial. This issue was
> reported to me even though it's an X server issue, not an X application
> issue. If I were in charge of managing X application policy on some
> installation, I wouldn't want the kernel policy for the X server jumbled
> in with it.
>
> Just like how we're separating userspace object manager Flask
> definitions from the kernel ones. In fact, I had originally created an
> entire separate directory "userspace" to use instead of services/.
> Reconsidered that, but still like the idea of separate modules.
I'm not saying that all the X object class rules are supposed to go in
xserver, just the common ones. Consider dbus, it has a template that
other modules use for being client to a dbus, but the rules for sending
dbus messages to other domains follows the same refpolicy conventions as
kernel object classes, and thus are put in the relevant interface, eg
hal_dbus_send(). I think the distinction between server and
applications here is clear, and also I think its an analogue to the X
server (there is a system dbus and also user dbuses).
> >> I think a deeper question somewhat related to this is what the prefix on
> >> the X server's domain should be. In the policy as written I'm assuming
> >> that the user domain prefix $2 and X server domain prefix $1 are
> >> independent. This is because 1) the xserver runs as xdm_xserver_t when
> >> started from gdm but user_xserver_t when started by user with startx,
> >> and
> >
> > Well thats because with startx the user itself is starting up the
> > xserver, whereas with a display manager, you don't know the user until
> > after the xserver is already running.
>
> Maybe gdm should restart the X server after the user has logged in, or
> the xserver should change its own context. Both programs already have
> SELinux patches, adding this functionality could be done.
Yes, though I don't know the pros and cons, other than the latter option
would be a dyntransition.
--
Chris PeBenito
Tresys Technology, LLC
(410) 290-1411 x150
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 12+ messages in thread
* Re: [PATCH] refpolicy: experimental X policy -v2
2007-03-21 20:53 ` Christopher J. PeBenito
@ 2007-03-22 0:29 ` Eamon Walsh
2007-03-22 10:53 ` Russell Coker
0 siblings, 1 reply; 12+ messages in thread
From: Eamon Walsh @ 2007-03-22 0:29 UTC (permalink / raw)
To: Christopher J. PeBenito; +Cc: selinux
Christopher J. PeBenito wrote:
> On Wed, 2007-03-21 at 15:58 -0400, Eamon Walsh wrote:
>> Look at the example of the /dev/mem access denial. This issue was
>> reported to me even though it's an X server issue, not an X application
>> issue. If I were in charge of managing X application policy on some
>> installation, I wouldn't want the kernel policy for the X server jumbled
>> in with it.
>>
>> Just like how we're separating userspace object manager Flask
>> definitions from the kernel ones. In fact, I had originally created an
>> entire separate directory "userspace" to use instead of services/.
>> Reconsidered that, but still like the idea of separate modules.
>
> I'm not saying that all the X object class rules are supposed to go in
> xserver, just the common ones. Consider dbus, it has a template that
> other modules use for being client to a dbus, but the rules for sending
> dbus messages to other domains follows the same refpolicy conventions as
> kernel object classes, and thus are put in the relevant interface, eg
> hal_dbus_send(). I think the distinction between server and
> applications here is clear, and also I think its an analogue to the X
> server (there is a system dbus and also user dbuses).
OK, this makes sense.
>> Maybe gdm should restart the X server after the user has logged in, or
>> the xserver should change its own context. Both programs already have
>> SELinux patches, adding this functionality could be done.
>
> Yes, though I don't know the pros and cons, other than the latter option
> would be a dyntransition.
The fast user switching support in rawhide runs multiple xservers on
virtual consoles; having them all be xdm_xserver_t is problematic.
Other ideas: have the display manager always running on the first
virtual console, and launch the user servers on other consoles. Or
maybe we should go back to a text-based login only running X through startx.
--
Eamon Walsh <ewalsh@tycho.nsa.gov>
National Security Agency
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 12+ messages in thread
* Re: [PATCH] refpolicy: experimental X policy -v2
2007-03-22 0:29 ` Eamon Walsh
@ 2007-03-22 10:53 ` Russell Coker
0 siblings, 0 replies; 12+ messages in thread
From: Russell Coker @ 2007-03-22 10:53 UTC (permalink / raw)
To: Eamon Walsh; +Cc: Christopher J. PeBenito, selinux
On Thursday 22 March 2007 11:29, Eamon Walsh <ewalsh@tycho.nsa.gov> wrote:
> The fast user switching support in rawhide runs multiple xservers on
> virtual consoles; having them all be xdm_xserver_t is problematic.
Why is it more of a problem when multiple xservers run at the same time?
I agree that the current situation is far from ideal, but don't understand how
fast user switching has made it any worse.
> Other ideas: have the display manager always running on the first
> virtual console, and launch the user servers on other consoles.
In that case why not have multiple XDM programs running, one per VC. Then the
login process could be to graphically ask the user for their user-name and
password, then kill the X server and start a new one for the user's context.
> Or
> maybe we should go back to a text-based login only running X through
> startx.
No. But I think that it would be viable to have a modified text-mode login
program start X automatically on the same VC.
--
russell@coker.com.au
http://etbe.blogspot.com/ My Blog
http://www.coker.com.au/sponsorship.html Sponsoring Free Software development
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 12+ messages in thread
end of thread, other threads:[~2007-03-22 10:53 UTC | newest]
Thread overview: 12+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2007-01-25 23:10 [PATCH] refpolicy: experimental X policy Eamon Walsh
2007-02-02 16:53 ` Ted X Toth
2007-02-13 20:26 ` Xavier Toth
2007-02-13 23:28 ` [PATCH] refpolicy: experimental X policy -v2 Eamon Walsh
2007-02-27 18:53 ` Christopher J. PeBenito
2007-03-20 22:27 ` Eamon Walsh
2007-03-20 22:58 ` Xavier Toth
2007-03-21 16:54 ` Christopher J. PeBenito
2007-03-21 19:58 ` Eamon Walsh
2007-03-21 20:53 ` Christopher J. PeBenito
2007-03-22 0:29 ` Eamon Walsh
2007-03-22 10:53 ` Russell Coker
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.