From mboxrd@z Thu Jan 1 00:00:00 1970
Return-Path: <gentoo-commits+bounces-722695-garchives=archives.gentoo.org@lists.gentoo.org>
Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80])
by finch.gentoo.org (Postfix) with ESMTP id F01D6138A2F
for <garchives@archives.gentoo.org>; Wed, 13 Aug 2014 20:02:08 +0000 (UTC)
Received: from pigeon.gentoo.org (localhost [127.0.0.1])
by pigeon.gentoo.org (Postfix) with SMTP id 6DC91E0C31;
Wed, 13 Aug 2014 20:02:08 +0000 (UTC)
Received: from smtp.gentoo.org (smtp.gentoo.org [140.211.166.183])
(using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits))
(No client certificate requested)
by pigeon.gentoo.org (Postfix) with ESMTPS id EC4F7E0C39
for <gentoo-commits@lists.gentoo.org>; Wed, 13 Aug 2014 20:02:07 +0000 (UTC)
Received: from spoonbill.gentoo.org (spoonbill.gentoo.org [81.93.255.5])
(using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits))
(No client certificate requested)
by smtp.gentoo.org (Postfix) with ESMTPS id 23F66340580
for <gentoo-commits@lists.gentoo.org>; Wed, 13 Aug 2014 20:02:07 +0000 (UTC)
Received: from localhost.localdomain (localhost [127.0.0.1])
by spoonbill.gentoo.org (Postfix) with ESMTP id BB2AB1881B
for <gentoo-commits@lists.gentoo.org>; Wed, 13 Aug 2014 20:02:05 +0000 (UTC)
From: "Sven Vermeulen" <swift@gentoo.org>
To: gentoo-commits@lists.gentoo.org
Content-Transfer-Encoding: 8bit
Content-type: text/plain; charset=UTF-8
Reply-To: gentoo-dev@lists.gentoo.org, "Sven Vermeulen" <swift@gentoo.org>
Message-ID: <1407959836.715c4095e06198adb8aaaafe11cf332292d8e7ea.swift@gentoo>
Subject: [gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/services/
X-VCS-Repository: proj/hardened-refpolicy
X-VCS-Files: policy/modules/services/xserver.te
X-VCS-Directories: policy/modules/services/
X-VCS-Committer: swift
X-VCS-Committer-Name: Sven Vermeulen
X-VCS-Revision: 715c4095e06198adb8aaaafe11cf332292d8e7ea
X-VCS-Branch: master
Date: Wed, 13 Aug 2014 20:02:05 +0000 (UTC)
Precedence: bulk
List-Post: <mailto:gentoo-commits@lists.gentoo.org>
List-Help: <mailto:gentoo-commits+help@lists.gentoo.org>
List-Unsubscribe: <mailto:gentoo-commits+unsubscribe@lists.gentoo.org>
List-Subscribe: <mailto:gentoo-commits+subscribe@lists.gentoo.org>
List-Id: Gentoo Linux mail <gentoo-commits.gentoo.org>
X-BeenThere: gentoo-commits@lists.gentoo.org
X-Archives-Salt: 5779b447-a194-4a19-b627-12ff37931a8b
X-Archives-Hash: ff9148739e07c2561660b463540d2bd4
commit: 715c4095e06198adb8aaaafe11cf332292d8e7ea
Author: Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
AuthorDate: Wed Aug 13 19:57:16 2014 +0000
Commit: Sven Vermeulen <swift <AT> gentoo <DOT> org>
CommitDate: Wed Aug 13 19:57:16 2014 +0000
URL: http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=715c4095
Moving Gentoo specifics downward
---
policy/modules/services/xserver.te | 22 ++++++++++++++++++----
1 file changed, 18 insertions(+), 4 deletions(-)
diff --git a/policy/modules/services/xserver.te b/policy/modules/services/xserver.te
index f2cc9b3..7119319 100644
--- a/policy/modules/services/xserver.te
+++ b/policy/modules/services/xserver.te
@@ -230,14 +230,11 @@ userdom_user_home_dir_filetrans(iceauth_t, iceauth_home_t, file)
allow xdm_t iceauth_home_t:file read_file_perms;
-files_search_tmp(iceauth_t)
fs_search_auto_mountpoints(iceauth_t)
userdom_use_user_terminals(iceauth_t)
userdom_read_user_tmp_files(iceauth_t)
-getty_use_fds(iceauth_t)
-
tunable_policy(`use_nfs_home_dirs',`
fs_manage_nfs_files(iceauth_t)
')
@@ -281,7 +278,6 @@ auth_use_nsswitch(xauth_t)
userdom_use_user_terminals(xauth_t)
userdom_read_user_tmp_files(xauth_t)
-userdom_read_user_tmp_files(xserver_t)
xserver_rw_xdm_tmp_files(xauth_t)
@@ -1014,3 +1010,21 @@ allow xserver_unconfined_type { x_domain xserver_t }:x_keyboard *;
allow xserver_unconfined_type xextension_type:x_extension *;
allow xserver_unconfined_type { x_domain xserver_t }:x_resource *;
allow xserver_unconfined_type xevent_type:{ x_event x_synthetic_event } *;
+
+ifdef(`distro_gentoo',`
+ ########################################
+ #
+ # iceauth_t policy
+ #
+
+ files_search_tmp(iceauth_t)
+
+ getty_use_fds(iceauth_t)
+
+ ########################################
+ #
+ # xserver_t policy
+ #
+
+ userdom_read_user_tmp_files(xserver_t)
+')