From mboxrd@z Thu Jan  1 00:00:00 1970
From: guido@trentalancia.net (Guido Trentalancia)
Date: Wed, 28 Dec 2016 20:56:16 +0100
Subject: [refpolicy] [PATCH v2] xserver: restrict executable memory
 permissions (was "only run in confined mode and restrict execmem
 permissions")
In-Reply-To: <1482945627.7302.8.camel@trentalancia.net>
References: <1482945627.7302.8.camel@trentalancia.net>
Message-ID: <1482954976.2738.9.camel@trentalancia.net>
To: refpolicy@oss.tresys.com
List-Id: refpolicy.oss.tresys.com

The dangerous execheap permission is removed from xdm and the
dangerous execmem permission is only enabled for the Gnome
Display Manager (gnome-shell running in gdm mode) through a
new "gnome_xdm" boolean.

This patch also updates the XKB libs file context with their
default location, adds the ability to read udev pid files and
finally adds a couple of permissions so that xconsole can use
the terminals it needs to use.

Signed-off-by: Guido Trentalancia <guido@trentalancia.net>
---
 policy/modules/services/xserver.fc |    2 ++
 policy/modules/services/xserver.te |   21 +++++++++++++++++----
 2 files changed, 19 insertions(+), 4 deletions(-)

diff -pru a/policy/modules/services/xserver.fc b/policy/modules/services/xserver.fc
--- a/policy/modules/services/xserver.fc	2016-12-22 23:12:47.782929703 +0100
+++ b/policy/modules/services/xserver.fc	2016-12-28 20:47:28.677416395 +0100
@@ -79,6 +79,8 @@ HOME_DIR/\.Xauthority.*	--	gen_context(s
 
 /usr/sbin/lightdm	--	gen_context(system_u:object_r:xdm_exec_t,s0)
 
+/usr/share/X11/xkb(/.*)?	gen_context(system_u:object_r:xkb_var_lib_t,s0)
+
 /usr/X11R6/bin/[xgkw]dm	--	gen_context(system_u:object_r:xdm_exec_t,s0)
 /usr/X11R6/bin/iceauth	--	gen_context(system_u:object_r:iceauth_exec_t,s0)
 /usr/X11R6/bin/X	--	gen_context(system_u:object_r:xserver_exec_t,s0)
diff -pru a/policy/modules/services/xserver.te b/policy/modules/services/xserver.te
--- a/policy/modules/services/xserver.te	2016-12-22 23:12:47.782929703 +0100
+++ b/policy/modules/services/xserver.te	2016-12-28 20:50:53.138823311 +0100
@@ -42,6 +42,14 @@ gen_tunable(xdm_sysadm_login, false)
 
 ## <desc>
 ## <p>
+## Use gnome-shell in gdm mode as the
+## X Display Manager (XDM)
+## </p>
+## </desc>
+gen_tunable(gnome_xdm, false)
+
+## <desc>
+## <p>
 ## Support X userspace object manager
 ## </p>
 ## </desc>
@@ -450,6 +458,10 @@ term_setattr_console(xdm_t)
 term_use_unallocated_ttys(xdm_t)
 term_setattr_unallocated_ttys(xdm_t)
 
+# for xconsole
+term_use_ptmx(xdm_t)
+term_use_generic_ptys(xdm_t)
+
 auth_domtrans_pam_console(xdm_t)
 auth_manage_pam_pid(xdm_t)
 auth_manage_pam_console_data(xdm_t)
@@ -507,6 +519,10 @@ tunable_policy(`xdm_sysadm_login',`
 #	allow xserver_t xdm_tmpfs_t:file rw_file_perms;
 ')
 
+tunable_policy(`gnome_xdm',`
+	allow xdm_t self:process execmem;
+')
+
 optional_policy(`
 	alsa_domtrans(xdm_t)
 ')
@@ -586,10 +602,6 @@ optional_policy(`
 optional_policy(`
 	unconfined_domain(xdm_t)
 	unconfined_domtrans(xdm_t)
-
-	ifndef(`distro_redhat',`
-		allow xdm_t self:process { execheap execmem };
-	')
 ')
 
 optional_policy(`
@@ -803,6 +815,7 @@ optional_policy(`
 
 optional_policy(`
 	udev_read_db(xserver_t)
+	udev_read_pid_files(xserver_t)
 ')
 
 optional_policy(`