[refpolicy] [PATCH] For restricted_xwindows_user, the gnome_role_template depends on the wm_role_template, which depends on the dbus_role_template

[dominick.grift@gmail.com (Dominick Grift)]

On Fri, 2013-09-20 at 09:49 +0200, Dominick Grift wrote:
> Signed-off-by: Dominick Grift <dominick.grift@gmail.com>

This is kind of nasty but this is basically needed for restricted
xwindows users (Fedora probably only targeted to xguest) in an MLS
environment.

The problem here is that we, and fedora, currently run gnome-shell in
the window manager domain for restricted xwindows users (xguest).

To be honest, i don't believe this is sufficient anyways. Although it
might just be enough for xguest

We should probably have thought about this much earlier

> diff --git a/policy/modules/system/userdomain.if b/policy/modules/system/userdomain.if
> index b4a691d..8cd6269 100644
> --- a/policy/modules/system/userdomain.if
> +++ b/policy/modules/system/userdomain.if
> @@ -942,11 +942,11 @@
>  		')
>  
>  		optional_policy(`
> -			gnome_role_template($1, $1_r, $1_t)
> -		')
> -
> -		optional_policy(`
>  			wm_role_template($1, $1_r, $1_t)
> +
> +			optional_policy(`
> +				gnome_role_template($1, $1_r, $1_t)
> +			')
>  		')
>  	')
>