[refpolicy] [PATCH 1/5] wm: update the window manager (wm) module and enable its role template (v4)

[guido@trentalancia.net (Guido Trentalancia)]

Enable the window manager role (wm contrib module) and update
the module to work with gnome-shell.

This patch requires the following recently posted patch for the
games module:

[PATCH v3 1/2] games: general update and improved pulseaudio integration
http://oss.tresys.com/pipermail/refpolicy/2016-December/008679.html

This patch needs some more testing (it has only been minimally
tested with gnome-shell running in normal mode, i.e. not in gdm
mode). In particular, it might break the current functioning of
systems employing gnome-shell and gdm.

Patches 3/5, 4/5 and 5/5 might be needed when gnome-shell is used
in conjunction with gdm (untested, might require further permissions).

Since the window managers are not limited by gnome-shell, this latter
version of the patch (along with part 2/5) uses separate optional
conditionals for the gnome and wm role templates.

Signed-off-by: Guido Trentalancia <guido@trentalancia.net>
---
 policy/modules/contrib/wm.if       |   43 +++++++++++++++++-
 policy/modules/contrib/wm.te       |   88 ++++++++++++++++++++++++++++++++++++-
 policy/modules/roles/staff.te      |    8 ++-
 policy/modules/roles/sysadm.te     |    4 +
 policy/modules/roles/unprivuser.te |    8 ++-
 5 files changed, 145 insertions(+), 6 deletions(-)

diff -pruN refpolicy-git-07122016-orig/policy/modules/contrib/wm.if refpolicy-git-07122016/policy/modules/contrib/wm.if
--- refpolicy-git-07122016-orig/policy/modules/contrib/wm.if	2016-08-14 21:28:11.597521187 +0200
+++ refpolicy-git-07122016/policy/modules/contrib/wm.if	2016-12-13 22:53:54.445212825 +0100
@@ -47,6 +47,8 @@ template(`wm_role_template',`
 	# Policy
 	#
 
+	allow $3 $1_wm_t:fd use;
+
 	allow $1_wm_t $3:unix_stream_socket connectto;
 	allow $3 $1_wm_t:unix_stream_socket connectto;
 
@@ -72,6 +74,7 @@ template(`wm_role_template',`
 	xserver_manage_core_devices($1_wm_t)
 
 	optional_policy(`
+		dbus_connect_spec_session_bus($1, $1_wm_t)
 		dbus_spec_session_bus_client($1, $1_wm_t)
 		dbus_system_bus_client($1_wm_t)
 
@@ -81,7 +84,7 @@ template(`wm_role_template',`
 	')
 
 	optional_policy(`
-		gnome_stream_connect_gkeyringd($1, $1_wm_t)
+		gnome_stream_connect_all_gkeyringd($1_wm_t)
 	')
 
 	optional_policy(`
@@ -134,3 +137,41 @@ interface(`wm_dbus_chat',`
 	allow $2 $1_wm_t:dbus send_msg;
 	allow $1_wm_t $2:dbus send_msg;
 ')
+
+########################################
+## <summary>
+##	Do not audit attempts to execute
+##	files in temporary directories.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain to not audit.
+##	</summary>
+## </param>
+#
+interface(`wm_dontaudit_exec_tmp_files',`
+	gen_require(`
+		type wm_tmp_t;
+	')
+
+	dontaudit $1 wm_tmp_t:file exec_file_perms;
+')
+
+########################################
+## <summary>
+##	Do not audit attempts to execute
+##	files in temporary filesystems.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain to not audit.
+##	</summary>
+## </param>
+#
+interface(`wm_dontaudit_exec_tmpfs_files',`
+	gen_require(`
+		type wm_tmpfs_t;
+	')
+
+	dontaudit $1 wm_tmpfs_t:file exec_file_perms;
+')
diff -pruN refpolicy-git-07122016-orig/policy/modules/contrib/wm.te refpolicy-git-07122016/policy/modules/contrib/wm.te
--- refpolicy-git-07122016-orig/policy/modules/contrib/wm.te	2016-10-29 16:29:19.762328008 +0200
+++ refpolicy-git-07122016/policy/modules/contrib/wm.te	2016-12-13 00:34:34.876856837 +0100
@@ -10,6 +10,18 @@ attribute wm_domain;
 type wm_exec_t;
 corecmd_executable_file(wm_exec_t)
 
+type wm_tmp_t;
+typealias wm_tmp_t alias { user_wm_tmp_t staff_wm_tmp_t sysadm_wm_tmp_t };
+userdom_user_tmp_file(wm_tmp_t)
+
+type wm_tmpfs_t;
+typealias wm_tmpfs_t alias { user_wm_tmpfs_t staff_wm_tmpfs_t sysadm_wm_tmpfs_t };
+userdom_user_tmpfs_file(wm_tmpfs_t)
+
+optional_policy(`
+	pulseaudio_tmpfs_content(wm_tmpfs_t)
+')
+
 ########################################
 #
 # Common wm domain local policy
@@ -21,31 +33,60 @@ allow wm_domain self:netlink_kobject_uev
 allow wm_domain self:shm create_shm_perms;
 allow wm_domain self:unix_dgram_socket create_socket_perms;
 
+manage_dirs_pattern(wm_domain, wm_tmp_t, wm_tmp_t)
+manage_files_pattern(wm_domain, wm_tmp_t, wm_tmp_t)
+manage_lnk_files_pattern(wm_domain, wm_tmp_t, wm_tmp_t)
+files_tmp_filetrans(wm_domain, wm_tmp_t, { dir file lnk_file })
+
+manage_dirs_pattern(wm_domain, wm_tmpfs_t, wm_tmpfs_t)
+manage_files_pattern(wm_domain, wm_tmpfs_t, wm_tmpfs_t)
+manage_lnk_files_pattern(wm_domain, wm_tmpfs_t, wm_tmpfs_t)
+fs_tmpfs_filetrans(wm_domain, wm_tmpfs_t, { dir file lnk_file })
+
+can_exec(wm_domain, wm_exec_t)
+
 kernel_read_system_state(wm_domain)
 
 corecmd_getattr_all_executables(wm_domain)
 
+dev_read_rand(wm_domain)
 dev_read_sound(wm_domain)
 dev_read_sysfs(wm_domain)
 dev_read_urand(wm_domain)
+dev_rw_dri(wm_domain)
 dev_rw_wireless(wm_domain)
 dev_write_sound(wm_domain)
 
+files_read_etc_runtime_files(wm_domain)
 files_read_usr_files(wm_domain)
 
 fs_getattr_all_fs(wm_domain)
 
+kernel_read_fs_sysctls(wm_domain)
+kernel_read_proc_symlinks(wm_domain)
+kernel_read_sysctl(wm_domain)
+
 miscfiles_read_fonts(wm_domain)
+miscfiles_read_generic_certs(wm_domain)
 miscfiles_read_localization(wm_domain)
 
+udev_read_pid_files(wm_domain)
+
+# this is needed by gnome-shell
+userdom_exec_user_home_content_files(wm_domain)
+
 userdom_manage_user_tmp_sockets(wm_domain)
 userdom_tmp_filetrans_user_tmp(wm_domain, sock_file)
 userdom_user_runtime_filetrans_user_tmp(wm_domain, sock_file)
 
 userdom_manage_user_home_content_dirs(wm_domain)
 userdom_manage_user_home_content_files(wm_domain)
+
 userdom_user_home_dir_filetrans_user_home_content(wm_domain, { dir file })
 
+wm_dontaudit_exec_tmp_files(wm_domain)
+wm_dontaudit_exec_tmpfs_files(wm_domain)
+
 optional_policy(`
 	accountsd_dbus_chat(wm_domain)
 ')
@@ -55,10 +96,51 @@ optional_policy(`
 ')		
 
 optional_policy(`
+	consolekit_dbus_chat(wm_domain)
+')
+
+optional_policy(`
 	devicekit_dbus_chat_power(wm_domain)
 ')
 
 optional_policy(`
+	evolution_domtrans(wm_domain)
+
+	optional_policy(`
+		evolution_dbus_chat(wm_domain)
+		evolution_alarm_dbus_chat(wm_domain)
+	')
+')
+
+optional_policy(`
+	games_domtrans(wm_domain)
+
+	optional_policy(`
+		games_dbus_chat(wm_domain)
+	')
+')
+
+optional_policy(`
+	java_domtrans(wm_domain)
+')
+
+optional_policy(`
+	mono_domtrans(wm_domain)
+')
+
+optional_policy(`
+	mozilla_domtrans(wm_domain)
+
+	optional_policy(`
+		mozilla_dbus_chat(wm_domain)
+	')
+')
+
+optional_policy(`
+	mplayer_domtrans(wm_domain)
+')
+
+optional_policy(`
 	networkmanager_dbus_chat(wm_domain)
 ')
 
@@ -67,9 +149,13 @@ optional_policy(`
 ')
 
 optional_policy(`
-	pulseaudio_stream_connect(wm_domain)
+	telepathy_mission_control_dbus_chat(wm_domain)
 ')
 
 optional_policy(`
 	userhelper_exec_consolehelper(wm_domain)
 ')
+
+optional_policy(`
+	xserver_dbus_chat_xdm(wm_domain)
+')
diff -pruN refpolicy-git-07122016-orig/policy/modules/roles/staff.te refpolicy-git-07122016/policy/modules/roles/staff.te
--- refpolicy-git-07122016-orig/policy/modules/roles/staff.te	2016-12-07 13:39:08.669449296 +0100
+++ refpolicy-git-07122016/policy/modules/roles/staff.te	2016-12-13 22:45:02.857851229 +0100
@@ -88,11 +88,11 @@ ifndef(`distro_redhat',`
 		')
 
 		optional_policy(`
-			pulseaudio_role(staff_r, staff_t)
+			telepathy_role_template(staff, staff_r, staff_t)
 		')
 
 		optional_policy(`
-			telepathy_role_template(staff, staff_r, staff_t)
+			wm_role_template(staff, staff_r, staff_t)
 		')
 	')
 
@@ -145,6 +145,10 @@ ifndef(`distro_redhat',`
 	')
 
 	optional_policy(`
+		pulseaudio_role(staff_r, staff_t)
+	')
+
+	optional_policy(`
 		pyzor_role(staff_r, staff_t)
 	')
 
diff -pruN refpolicy-git-07122016-orig/policy/modules/roles/sysadm.te refpolicy-git-07122016/policy/modules/roles/sysadm.te
--- refpolicy-git-07122016-orig/policy/modules/roles/sysadm.te	2016-12-07 13:39:08.669449296 +0100
+++ refpolicy-git-07122016/policy/modules/roles/sysadm.te	2016-12-13 22:45:25.577422292 +0100
@@ -1246,6 +1246,10 @@ ifndef(`distro_redhat',`
 		optional_policy(`
 			gnome_role_template(sysadm, sysadm_r, sysadm_t)
 		')
+
+		optional_policy(`
+			wm_role_template(sysadm, sysadm_r, sysadm_t)
+		')
 	')
 
 	optional_policy(`
diff -pruN refpolicy-git-07122016-orig/policy/modules/roles/unprivuser.te refpolicy-git-07122016/policy/modules/roles/unprivuser.te
--- refpolicy-git-07122016-orig/policy/modules/roles/unprivuser.te	2016-12-07 13:39:08.669449296 +0100
+++ refpolicy-git-07122016/policy/modules/roles/unprivuser.te	2016-12-13 22:44:50.493540449 +0100
@@ -57,11 +57,11 @@ ifndef(`distro_redhat',`
 		')
 
 		optional_policy(`
-			pulseaudio_role(user_r, user_t)
+			telepathy_role_template(user, user_r, user_t)
 		')
 
 		optional_policy(`
-			telepathy_role_template(user, user_r, user_t)
+			wm_role_template(user, user_r, user_t)
 		')
 	')
 
@@ -122,6 +122,10 @@ ifndef(`distro_redhat',`
 	')
 
 	optional_policy(`
+		pulseaudio_role(user_r, user_t)
+	')
+
+	optional_policy(`
 		pyzor_role(user_r, user_t)
 	')