xserver policy

[Russell Coker <russell@coker.com.au>]

type_transition user_t xserver_exec_t:process xserver_t;
type_transition user_wm_t mono_exec_t:process mono_t;
type_transition user_wm_t wine_exec_t:process wine_t;
type_transition user_wm_t xserver_exec_t:process xserver_t;

Currently in the Debian SE Linux policy (which I believe to be identical to 
upstream refpolicy in this regard) the above are the possible transitions from 
user_t to unconfined domains.

The mono and wine modules can be removed for essentially identical 
functionality if you happen to not use mono or wine.

Both GNOME and KDE are dropping support for X11.  If we don't drop policy 
support for X11 I think we should at least separate xdm and xserver into 
separate modules so you can have XDM for Wayland without having an unconfined 
X server policy.  As an aside the current situation is that if you remove the 
unconfined module it will be impossible to login with any XDM program.

There is also an issue of xdm_t being unconfined, I'm working on a patch to 
fix that, I have a test machine with confined xdm_t working well.


Below is the list of unconfined domains:

$ seinfo -a unconfined_domain_type -x

Type Attributes: 1
   attribute unconfined_domain_type;
	apt_t
	dpkg_script_t
	dpkg_t
	httpd_unconfined_script_t
	inetd_child_t
	init_t
	initrc_t
	kernel_t
	ldconfig_t
	mono_t
	nagios_unconfined_plugin_t
	prelink_t
	puppet_t
	samba_unconfined_script_t
	spc_t
	spc_user_t
	unconfined_execmem_t
	unconfined_java_t
	unconfined_mount_t
	unconfined_munin_plugin_t
	unconfined_qemu_t
	unconfined_sendmail_t
	unconfined_t
	wine_t
	xdm_t
	xserver_t

-- 
My Main Blog         http://etbe.coker.com.au/
My Documents Blog    http://doc.coker.com.au/