* [refpolicy] [PATCH] mozilla: let mozilla play audio
@ 2016-09-10 16:26 Guido Trentalancia
2016-09-11 13:03 ` Chris PeBenito
2016-09-11 13:21 ` Dominick Grift
0 siblings, 2 replies; 11+ messages in thread
From: Guido Trentalancia @ 2016-09-10 16:26 UTC (permalink / raw)
To: refpolicy
Let mozilla play audio:
- add new interfaces to the pulseaudio module;
- let mozilla read alsa configuration files;
- add further permissions to mozilla needed to use
pulseaudio to play audio.
Signed-off-by: Guido Trentalancia <guido@trentalancia.net>
---
policy/modules/contrib/mozilla.te | 9 ++++
policy/modules/contrib/pulseaudio.if | 77 +++++++++++++++++++++++++++++++++++
2 files changed, 86 insertions(+)
--- refpolicy-git-06082016-orig/policy/modules/contrib/mozilla.te 2016-09-10 18:09:13.357710355 +0200
+++ refpolicy-git-06082016/policy/modules/contrib/mozilla.te 2016-09-10 18:07:16.322739208 +0200
@@ -234,6 +239,11 @@ tunable_policy(`use_samba_home_dirs',`
')
optional_policy(`
+ alsa_read_config(mozilla_t)
+ alsa_read_home_files(mozilla_t)
+')
+
+optional_policy(`
apache_read_user_scripts(mozilla_t)
apache_read_user_content(mozilla_t)
')
@@ -292,6 +305,8 @@ optional_policy(`
optional_policy(`
pulseaudio_run(mozilla_t, mozilla_roles)
+ pulseaudio_rw_tmpfs_files(mozilla_t)
+ pulseaudio_use_fds(mozilla_t)
')
optional_policy(`
@@ -561,6 +580,8 @@ optional_policy(`
optional_policy(`
pulseaudio_run(mozilla_plugin_t, mozilla_plugin_roles)
+ pulseaudio_rw_tmpfs_files(mozilla_plugin_t)
+ pulseaudio_use_fds(mozilla_plugin_t)
')
optional_policy(`
--- refpolicy-git-06082016-orig/policy/modules/contrib/pulseaudio.if 2016-08-20 03:45:31.740027060 +0200
+++ refpolicy-git-06082016/policy/modules/contrib/pulseaudio.if 2016-08-20 00:25:39.112517500 +0200
@@ -346,3 +347,80 @@ interface(`pulseaudio_tmpfs_content',`
typeattribute $1 pulseaudio_tmpfsfile;
')
+
+#######################################
+## <summary>
+## Read pulseaudio tmpfs files.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`pulseaudio_read_tmpfs_files',`
+ gen_require(`
+ type pulseaudio_tmpfs_t;
+ ')
+
+ fs_search_tmpfs($1)
+ read_files_pattern($1, pulseaudio_tmpfs_t, pulseaudio_tmpfs_t)
+')
+
+#######################################
+## <summary>
+## Read and write pulseaudio tmpfs
+## files.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`pulseaudio_rw_tmpfs_files',`
+ gen_require(`
+ type pulseaudio_tmpfs_t;
+ ')
+
+ fs_search_tmpfs($1)
+ rw_files_pattern($1, pulseaudio_tmpfs_t, pulseaudio_tmpfs_t)
+')
+
+########################################
+## <summary>
+## Use file descriptors for
+## pulseaudio.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`pulseaudio_use_fds',`
+ gen_require(`
+ type pulseaudio_t;
+ ')
+
+ allow $1 pulseaudio_t:fd use;
+')
+
+########################################
+## <summary>
+## Do not audit attempts to use the
+## file descriptors for pulseaudio.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`pulseaudio_dontaudit_use_fds',`
+ gen_require(`
+ type pulseaudio_t;
+ ')
+
+ dontaudit $1 pulseaudio_t:fd use;
+')
^ permalink raw reply [flat|nested] 11+ messages in thread
* [refpolicy] [PATCH] mozilla: let mozilla play audio
2016-09-10 16:26 [refpolicy] [PATCH] mozilla: let mozilla play audio Guido Trentalancia
@ 2016-09-11 13:03 ` Chris PeBenito
2016-09-11 13:29 ` Guido Trentalancia
2016-09-11 13:21 ` Dominick Grift
1 sibling, 1 reply; 11+ messages in thread
From: Chris PeBenito @ 2016-09-11 13:03 UTC (permalink / raw)
To: refpolicy
On 09/10/16 12:26, Guido Trentalancia via refpolicy wrote:
> Let mozilla play audio:
>
> - add new interfaces to the pulseaudio module;
> - let mozilla read alsa configuration files;
> - add further permissions to mozilla needed to use
> pulseaudio to play audio.
Merged.
> Signed-off-by: Guido Trentalancia <guido@trentalancia.net>
> ---
> policy/modules/contrib/mozilla.te | 9 ++++
> policy/modules/contrib/pulseaudio.if | 77 +++++++++++++++++++++++++++++++++++
> 2 files changed, 86 insertions(+)
>
> --- refpolicy-git-06082016-orig/policy/modules/contrib/mozilla.te 2016-09-10 18:09:13.357710355 +0200
> +++ refpolicy-git-06082016/policy/modules/contrib/mozilla.te 2016-09-10 18:07:16.322739208 +0200
> @@ -234,6 +239,11 @@ tunable_policy(`use_samba_home_dirs',`
> ')
>
> optional_policy(`
> + alsa_read_config(mozilla_t)
> + alsa_read_home_files(mozilla_t)
> +')
> +
> +optional_policy(`
> apache_read_user_scripts(mozilla_t)
> apache_read_user_content(mozilla_t)
> ')
> @@ -292,6 +305,8 @@ optional_policy(`
>
> optional_policy(`
> pulseaudio_run(mozilla_t, mozilla_roles)
> + pulseaudio_rw_tmpfs_files(mozilla_t)
> + pulseaudio_use_fds(mozilla_t)
> ')
>
> optional_policy(`
> @@ -561,6 +580,8 @@ optional_policy(`
>
> optional_policy(`
> pulseaudio_run(mozilla_plugin_t, mozilla_plugin_roles)
> + pulseaudio_rw_tmpfs_files(mozilla_plugin_t)
> + pulseaudio_use_fds(mozilla_plugin_t)
> ')
>
> optional_policy(`
> --- refpolicy-git-06082016-orig/policy/modules/contrib/pulseaudio.if 2016-08-20 03:45:31.740027060 +0200
> +++ refpolicy-git-06082016/policy/modules/contrib/pulseaudio.if 2016-08-20 00:25:39.112517500 +0200
> @@ -346,3 +347,80 @@ interface(`pulseaudio_tmpfs_content',`
>
> typeattribute $1 pulseaudio_tmpfsfile;
> ')
> +
> +#######################################
> +## <summary>
> +## Read pulseaudio tmpfs files.
> +## </summary>
> +## <param name="domain">
> +## <summary>
> +## Domain allowed access.
> +## </summary>
> +## </param>
> +#
> +interface(`pulseaudio_read_tmpfs_files',`
> + gen_require(`
> + type pulseaudio_tmpfs_t;
> + ')
> +
> + fs_search_tmpfs($1)
> + read_files_pattern($1, pulseaudio_tmpfs_t, pulseaudio_tmpfs_t)
> +')
> +
> +#######################################
> +## <summary>
> +## Read and write pulseaudio tmpfs
> +## files.
> +## </summary>
> +## <param name="domain">
> +## <summary>
> +## Domain allowed access.
> +## </summary>
> +## </param>
> +#
> +interface(`pulseaudio_rw_tmpfs_files',`
> + gen_require(`
> + type pulseaudio_tmpfs_t;
> + ')
> +
> + fs_search_tmpfs($1)
> + rw_files_pattern($1, pulseaudio_tmpfs_t, pulseaudio_tmpfs_t)
> +')
> +
> +########################################
> +## <summary>
> +## Use file descriptors for
> +## pulseaudio.
> +## </summary>
> +## <param name="domain">
> +## <summary>
> +## Domain allowed access.
> +## </summary>
> +## </param>
> +#
> +interface(`pulseaudio_use_fds',`
> + gen_require(`
> + type pulseaudio_t;
> + ')
> +
> + allow $1 pulseaudio_t:fd use;
> +')
> +
> +########################################
> +## <summary>
> +## Do not audit attempts to use the
> +## file descriptors for pulseaudio.
> +## </summary>
> +## <param name="domain">
> +## <summary>
> +## Domain allowed access.
> +## </summary>
> +## </param>
> +#
> +interface(`pulseaudio_dontaudit_use_fds',`
> + gen_require(`
> + type pulseaudio_t;
> + ')
> +
> + dontaudit $1 pulseaudio_t:fd use;
> +')
> _______________________________________________
> refpolicy mailing list
> refpolicy at oss.tresys.com
> http://oss.tresys.com/mailman/listinfo/refpolicy
>
--
Chris PeBenito
^ permalink raw reply [flat|nested] 11+ messages in thread
* [refpolicy] [PATCH] mozilla: let mozilla play audio
2016-09-10 16:26 [refpolicy] [PATCH] mozilla: let mozilla play audio Guido Trentalancia
2016-09-11 13:03 ` Chris PeBenito
@ 2016-09-11 13:21 ` Dominick Grift
2016-09-11 15:22 ` Guido Trentalancia
1 sibling, 1 reply; 11+ messages in thread
From: Dominick Grift @ 2016-09-11 13:21 UTC (permalink / raw)
To: refpolicy
On 09/10/2016 06:26 PM, Guido Trentalancia via refpolicy wrote:
> Let mozilla play audio:
>
> - add new interfaces to the pulseaudio module;
> - let mozilla read alsa configuration files;
> - add further permissions to mozilla needed to use
> pulseaudio to play audio.
>
> Signed-off-by: Guido Trentalancia <guido@trentalancia.net>
> ---
> policy/modules/contrib/mozilla.te | 9 ++++
> policy/modules/contrib/pulseaudio.if | 77 +++++++++++++++++++++++++++++++++++
> 2 files changed, 86 insertions(+)
>
> --- refpolicy-git-06082016-orig/policy/modules/contrib/mozilla.te 2016-09-10 18:09:13.357710355 +0200
> +++ refpolicy-git-06082016/policy/modules/contrib/mozilla.te 2016-09-10 18:07:16.322739208 +0200
> @@ -234,6 +239,11 @@ tunable_policy(`use_samba_home_dirs',`
> ')
>
> optional_policy(`
> + alsa_read_config(mozilla_t)
> + alsa_read_home_files(mozilla_t)
> +')
> +
Applies to all pulseaudio clients, so this should have been added to
pulseaudio.te instead:
optional_policy(`
alsa_read_config(pulseaudio_client)
alsa_read_home_files(pulseaudio_client)
')
> +optional_policy(`
> apache_read_user_scripts(mozilla_t)
> apache_read_user_content(mozilla_t)
> ')
> @@ -292,6 +305,8 @@ optional_policy(`
>
> optional_policy(`
> pulseaudio_run(mozilla_t, mozilla_roles)
> + pulseaudio_rw_tmpfs_files(mozilla_t)
I wonder what exactly prompted you to add this. pulseaudio clients
should only be able to read and delete pulseaudio tmpfs files.
This is already in pulseaudio.te (so mozilla_t is already allowed to
read pulseaudio_tmpfs_t files (but not delete them, so that may be a bug
in pulseaudio.te:
read_files_pattern(pulseaudio_client, { pulseaudio_tmpfsfile
pulseaudio_tmpfs_t }, { pulseaudio_tmpfsfile pulseaudio_tmpfs_t })
> + pulseaudio_use_fds(mozilla_t)
This applies to all pulseaudio_client and thus should be added to
pulseaudio.te as follows instead:
pulseaudio_use_fds(pulseaudio_client)
> ')
>
> optional_policy(`
> @@ -561,6 +580,8 @@ optional_policy(`
>
> optional_policy(`
> pulseaudio_run(mozilla_plugin_t, mozilla_plugin_roles)
> + pulseaudio_rw_tmpfs_files(mozilla_plugin_t)
> + pulseaudio_use_fds(mozilla_plugin_t)
same as above
> ')
>
> optional_policy(`
> --- refpolicy-git-06082016-orig/policy/modules/contrib/pulseaudio.if 2016-08-20 03:45:31.740027060 +0200
> +++ refpolicy-git-06082016/policy/modules/contrib/pulseaudio.if 2016-08-20 00:25:39.112517500 +0200
> @@ -346,3 +347,80 @@ interface(`pulseaudio_tmpfs_content',`
>
> typeattribute $1 pulseaudio_tmpfsfile;
> ')
> +
> +#######################################
> +## <summary>
> +## Read pulseaudio tmpfs files.
> +## </summary>
> +## <param name="domain">
> +## <summary>
> +## Domain allowed access.
> +## </summary>
> +## </param>
> +#
> +interface(`pulseaudio_read_tmpfs_files',`
> + gen_require(`
> + type pulseaudio_tmpfs_t;
> + ')
> +
> + fs_search_tmpfs($1)
> + read_files_pattern($1, pulseaudio_tmpfs_t, pulseaudio_tmpfs_t)
> +')
> +
> +#######################################
> +## <summary>
> +## Read and write pulseaudio tmpfs
> +## files.
> +## </summary>
> +## <param name="domain">
> +## <summary>
> +## Domain allowed access.
> +## </summary>
> +## </param>
> +#
> +interface(`pulseaudio_rw_tmpfs_files',`
> + gen_require(`
> + type pulseaudio_tmpfs_t;
> + ')
> +
> + fs_search_tmpfs($1)
> + rw_files_pattern($1, pulseaudio_tmpfs_t, pulseaudio_tmpfs_t)
> +')
> +
> +########################################
> +## <summary>
> +## Use file descriptors for
> +## pulseaudio.
> +## </summary>
> +## <param name="domain">
> +## <summary>
> +## Domain allowed access.
> +## </summary>
> +## </param>
> +#
> +interface(`pulseaudio_use_fds',`
> + gen_require(`
> + type pulseaudio_t;
> + ')
> +
> + allow $1 pulseaudio_t:fd use;
> +')
> +
> +########################################
> +## <summary>
> +## Do not audit attempts to use the
> +## file descriptors for pulseaudio.
> +## </summary>
> +## <param name="domain">
> +## <summary>
> +## Domain allowed access.
> +## </summary>
> +## </param>
> +#
> +interface(`pulseaudio_dontaudit_use_fds',`
> + gen_require(`
> + type pulseaudio_t;
> + ')
> +
> + dontaudit $1 pulseaudio_t:fd use;
> +')
> _______________________________________________
> refpolicy mailing list
> refpolicy at oss.tresys.com
> http://oss.tresys.com/mailman/listinfo/refpolicy
>
--
Key fingerprint = 5F4D 3CDB D3F8 3652 FBD8 02D5 3B6C 5F1D 2C7B 6B02
https://sks-keyservers.net/pks/lookup?op=get&search=0x3B6C5F1D2C7B6B02
Dominick Grift
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 648 bytes
Desc: OpenPGP digital signature
Url : http://oss.tresys.com/pipermail/refpolicy/attachments/20160911/a6bdbbc8/attachment.bin
^ permalink raw reply [flat|nested] 11+ messages in thread
* [refpolicy] [PATCH] mozilla: let mozilla play audio
2016-09-11 13:03 ` Chris PeBenito
@ 2016-09-11 13:29 ` Guido Trentalancia
0 siblings, 0 replies; 11+ messages in thread
From: Guido Trentalancia @ 2016-09-11 13:29 UTC (permalink / raw)
To: refpolicy
On Sun, 11/09/2016 at 09.03 -0400, Chris PeBenito wrote:
> On 09/10/16 12:26, Guido Trentalancia via refpolicy wrote:
> >
> > Let mozilla play audio:
> >
> > - add new interfaces to the pulseaudio module;
> > - let mozilla read alsa configuration files;
> > - add further permissions to mozilla needed to use
> > ? pulseaudio to play audio.
>
> Merged.
Excellent, thanks !
> > Signed-off-by: Guido Trentalancia <guido@trentalancia.net>
> > ---
> > ?policy/modules/contrib/mozilla.te????|????9 ++++
> > ?policy/modules/contrib/pulseaudio.if |???77
> > +++++++++++++++++++++++++++++++++++
> > ?2 files changed, 86 insertions(+)
Best regards,
Guido
^ permalink raw reply [flat|nested] 11+ messages in thread
* [refpolicy] [PATCH] mozilla: let mozilla play audio
2016-09-11 13:21 ` Dominick Grift
@ 2016-09-11 15:22 ` Guido Trentalancia
2016-09-12 22:51 ` Chris PeBenito
0 siblings, 1 reply; 11+ messages in thread
From: Guido Trentalancia @ 2016-09-11 15:22 UTC (permalink / raw)
To: refpolicy
Hello Dominick (and cc Chris) !
On Sun, 11/09/2016 at 15.21 +0200, Dominick Grift via refpolicy wrote:
> On 09/10/2016 06:26 PM, Guido Trentalancia via refpolicy wrote:
> >
> > Let mozilla play audio:
> >
> > - add new interfaces to the pulseaudio module;
> > - let mozilla read alsa configuration files;
> > - add further permissions to mozilla needed to use
> > ? pulseaudio to play audio.
> >
> > Signed-off-by: Guido Trentalancia <guido@trentalancia.net>
> > ---
> > ?policy/modules/contrib/mozilla.te????|????9 ++++
> > ?policy/modules/contrib/pulseaudio.if |???77
> > +++++++++++++++++++++++++++++++++++
> > ?2 files changed, 86 insertions(+)
[...]
> Applies to all pulseaudio clients, so this should have been added to
> pulseaudio.te instead:
I am fine with improving this.
> optional_policy(`
> alsa_read_config(pulseaudio_client)
> alsa_read_home_files(pulseaudio_client)
> ')
and this:
> >
> > + pulseaudio_use_fds(mozilla_t)
>
> This applies to all pulseaudio_client and thus should be added to
> pulseaudio.te as follows instead:
>
> pulseaudio_use_fds(pulseaudio_client)
as long as it is also fine to Christopher.
The other change (delete instead of read/write) doesn't make a big
difference in my opinion.
Here is the small diff:
Improvements to the mozilla and pulseaudio modules
as suggested by Dominick Grift.
policy/modules/contrib/mozilla.te | 14 --------------
policy/modules/contrib/pulseaudio.te | 8 ++++++++
2 files changed, 8 insertions(+), 14 deletions(-)
--- refpolicy-git-06082016-orig/policy/modules/contrib/mozilla.te 2016-09-11 17:05:47.916850416 +0200
+++ refpolicy-git-06082016/policy/modules/contrib/mozilla.te 2016-09-11 17:05:27.911531798 +0200
@@ -234,11 +267,6 @@ tunable_policy(`use_samba_home_dirs',`
')
optional_policy(`
- alsa_read_config(mozilla_t)
- alsa_read_home_files(mozilla_t)
-')
-
-optional_policy(`
apache_read_user_scripts(mozilla_t)
apache_read_user_content(mozilla_t)
')
@@ -297,8 +329,6 @@ optional_policy(`
optional_policy(`
pulseaudio_run(mozilla_t, mozilla_roles)
- pulseaudio_rw_tmpfs_files(mozilla_t)
- pulseaudio_use_fds(mozilla_t)
')
optional_policy(`
@@ -525,11 +569,6 @@ tunable_policy(`use_samba_home_dirs',`
')
optional_policy(`
- alsa_read_config(mozilla_plugin_t)
- alsa_read_home_files(mozilla_plugin_t)
-')
-
-optional_policy(`
automount_dontaudit_getattr_tmp_dirs(mozilla_plugin_t)
')
@@ -568,8 +607,6 @@ optional_policy(`
optional_policy(`
pulseaudio_run(mozilla_plugin_t, mozilla_plugin_roles)
- pulseaudio_rw_tmpfs_files(mozilla_plugin_t)
- pulseaudio_use_fds(mozilla_plugin_t)
')
optional_policy(`
--- refpolicy-git-06082016-orig/policy/modules/contrib/pulseaudio.te 2016-08-20 03:45:31.741027074 +0200
+++ refpolicy-git-06082016/policy/modules/contrib/pulseaudio.te 2016-09-11 17:15:40.155169246 +0200
@@ -231,6 +258,9 @@ pulseaudio_home_filetrans_pulseaudio_hom
pulseaudio_home_filetrans_pulseaudio_home(pulseaudio_client, file, ".pulse-cookie")
pulseaudio_signull(pulseaudio_client)
+pulseaudio_rw_tmpfs_files(pulseaudio_client)
+pulseaudio_use_fds(pulseaudio_client)
+
userdom_read_user_tmpfs_files(pulseaudio_client)
userdom_user_runtime_filetrans(pulseaudio_client, pulseaudio_tmp_t, dir, "pulse")
# userdom_delete_user_tmpfs_files(pulseaudio_client)
@@ -250,6 +280,11 @@ tunable_policy(`use_samba_home_dirs',`
')
optional_policy(`
+ alsa_read_config(pulseaudio_client)
+ alsa_read_home_files(pulseaudio_client)
+')
+
+optional_policy(`
pulseaudio_dbus_chat(pulseaudio_client)
')
^ permalink raw reply [flat|nested] 11+ messages in thread
* [refpolicy] [PATCH] mozilla: let mozilla play audio
2016-09-11 15:22 ` Guido Trentalancia
@ 2016-09-12 22:51 ` Chris PeBenito
2016-09-13 11:29 ` Guido Trentalancia
` (2 more replies)
0 siblings, 3 replies; 11+ messages in thread
From: Chris PeBenito @ 2016-09-12 22:51 UTC (permalink / raw)
To: refpolicy
On 09/11/16 11:22, Guido Trentalancia via refpolicy wrote:
> Hello Dominick (and cc Chris) !
>
> On Sun, 11/09/2016 at 15.21 +0200, Dominick Grift via refpolicy wrote:
>> On 09/10/2016 06:26 PM, Guido Trentalancia via refpolicy wrote:
>>>
>>> Let mozilla play audio:
>>>
>>> - add new interfaces to the pulseaudio module;
>>> - let mozilla read alsa configuration files;
>>> - add further permissions to mozilla needed to use
>>> pulseaudio to play audio.
>>>
>>> Signed-off-by: Guido Trentalancia <guido@trentalancia.net>
>>> ---
>>> policy/modules/contrib/mozilla.te | 9 ++++
>>> policy/modules/contrib/pulseaudio.if | 77
>>> +++++++++++++++++++++++++++++++++++
>>> 2 files changed, 86 insertions(+)
>
> [...]
>
>> Applies to all pulseaudio clients, so this should have been added to
>> pulseaudio.te instead:
>
> I am fine with improving this.
>
>> optional_policy(`
>> alsa_read_config(pulseaudio_client)
>> alsa_read_home_files(pulseaudio_client)
>> ')
>
> and this:
>
>>>
>>> + pulseaudio_use_fds(mozilla_t)
>>
>> This applies to all pulseaudio_client and thus should be added to
>> pulseaudio.te as follows instead:
>>
>> pulseaudio_use_fds(pulseaudio_client)
>
> as long as it is also fine to Christopher.
If the rules apply to all pulseaudio domains, then it should be done as
Dominick suggests.
> The other change (delete instead of read/write) doesn't make a big
> difference in my opinion.
>
> Here is the small diff:
>
> Improvements to the mozilla and pulseaudio modules
> as suggested by Dominick Grift.
>
> policy/modules/contrib/mozilla.te | 14 --------------
> policy/modules/contrib/pulseaudio.te | 8 ++++++++
> 2 files changed, 8 insertions(+), 14 deletions(-)
>
> --- refpolicy-git-06082016-orig/policy/modules/contrib/mozilla.te 2016-09-11 17:05:47.916850416 +0200
> +++ refpolicy-git-06082016/policy/modules/contrib/mozilla.te 2016-09-11 17:05:27.911531798 +0200
> @@ -234,11 +267,6 @@ tunable_policy(`use_samba_home_dirs',`
> ')
>
> optional_policy(`
> - alsa_read_config(mozilla_t)
> - alsa_read_home_files(mozilla_t)
> -')
> -
> -optional_policy(`
> apache_read_user_scripts(mozilla_t)
> apache_read_user_content(mozilla_t)
> ')
> @@ -297,8 +329,6 @@ optional_policy(`
>
> optional_policy(`
> pulseaudio_run(mozilla_t, mozilla_roles)
> - pulseaudio_rw_tmpfs_files(mozilla_t)
> - pulseaudio_use_fds(mozilla_t)
> ')
>
> optional_policy(`
> @@ -525,11 +569,6 @@ tunable_policy(`use_samba_home_dirs',`
> ')
>
> optional_policy(`
> - alsa_read_config(mozilla_plugin_t)
> - alsa_read_home_files(mozilla_plugin_t)
> -')
> -
> -optional_policy(`
> automount_dontaudit_getattr_tmp_dirs(mozilla_plugin_t)
> ')
>
> @@ -568,8 +607,6 @@ optional_policy(`
>
> optional_policy(`
> pulseaudio_run(mozilla_plugin_t, mozilla_plugin_roles)
> - pulseaudio_rw_tmpfs_files(mozilla_plugin_t)
> - pulseaudio_use_fds(mozilla_plugin_t)
> ')
>
> optional_policy(`
> --- refpolicy-git-06082016-orig/policy/modules/contrib/pulseaudio.te 2016-08-20 03:45:31.741027074 +0200
> +++ refpolicy-git-06082016/policy/modules/contrib/pulseaudio.te 2016-09-11 17:15:40.155169246 +0200
> @@ -231,6 +258,9 @@ pulseaudio_home_filetrans_pulseaudio_hom
> pulseaudio_home_filetrans_pulseaudio_home(pulseaudio_client, file, ".pulse-cookie")
> pulseaudio_signull(pulseaudio_client)
>
> +pulseaudio_rw_tmpfs_files(pulseaudio_client)
> +pulseaudio_use_fds(pulseaudio_client)
> +
> userdom_read_user_tmpfs_files(pulseaudio_client)
> userdom_user_runtime_filetrans(pulseaudio_client, pulseaudio_tmp_t, dir, "pulse")
> # userdom_delete_user_tmpfs_files(pulseaudio_client)
> @@ -250,6 +280,11 @@ tunable_policy(`use_samba_home_dirs',`
> ')
>
> optional_policy(`
> + alsa_read_config(pulseaudio_client)
> + alsa_read_home_files(pulseaudio_client)
> +')
> +
> +optional_policy(`
> pulseaudio_dbus_chat(pulseaudio_client)
> ')
>
> _______________________________________________
> refpolicy mailing list
> refpolicy at oss.tresys.com
> http://oss.tresys.com/mailman/listinfo/refpolicy
>
--
Chris PeBenito
^ permalink raw reply [flat|nested] 11+ messages in thread
* [refpolicy] [PATCH] mozilla: let mozilla play audio
2016-09-12 22:51 ` Chris PeBenito
@ 2016-09-13 11:29 ` Guido Trentalancia
2016-09-13 11:37 ` Guido Trentalancia
2016-09-13 11:57 ` Guido Trentalancia
2 siblings, 0 replies; 11+ messages in thread
From: Guido Trentalancia @ 2016-09-13 11:29 UTC (permalink / raw)
To: refpolicy
Hi!
There was a small diff attached to the previous message to move the permissions to the pulseaudio module in the pulseaudio_client section.
Please refer to that.
Guido
On the 13th of September 2016 00:51:44 CEST, Chris PeBenito <pebenito@ieee.org> wrote:
>On 09/11/16 11:22, Guido Trentalancia via refpolicy wrote:
>> Hello Dominick (and cc Chris) !
>>
>> On Sun, 11/09/2016 at 15.21 +0200, Dominick Grift via refpolicy
>wrote:
>>> On 09/10/2016 06:26 PM, Guido Trentalancia via refpolicy wrote:
>>>>
>>>> Let mozilla play audio:
>>>>
>>>> - add new interfaces to the pulseaudio module;
>>>> - let mozilla read alsa configuration files;
>>>> - add further permissions to mozilla needed to use
>>>> pulseaudio to play audio.
>>>>
>>>> Signed-off-by: Guido Trentalancia <guido@trentalancia.net>
>>>> ---
>>>> policy/modules/contrib/mozilla.te | 9 ++++
>>>> policy/modules/contrib/pulseaudio.if | 77
>>>> +++++++++++++++++++++++++++++++++++
>>>> 2 files changed, 86 insertions(+)
>>
>> [...]
>>
>>> Applies to all pulseaudio clients, so this should have been added to
>>> pulseaudio.te instead:
>>
>> I am fine with improving this.
>>
>>> optional_policy(`
>>> alsa_read_config(pulseaudio_client)
>>> alsa_read_home_files(pulseaudio_client)
>>> ')
>>
>> and this:
>>
>>>>
>>>> + pulseaudio_use_fds(mozilla_t)
>>>
>>> This applies to all pulseaudio_client and thus should be added to
>>> pulseaudio.te as follows instead:
>>>
>>> pulseaudio_use_fds(pulseaudio_client)
>>
>> as long as it is also fine to Christopher.
>
>If the rules apply to all pulseaudio domains, then it should be done as
>
>Dominick suggests.
>
>
>
>> The other change (delete instead of read/write) doesn't make a big
>> difference in my opinion.
>>
>> Here is the small diff:
>>
>> Improvements to the mozilla and pulseaudio modules
>> as suggested by Dominick Grift.
>>
>> policy/modules/contrib/mozilla.te | 14 --------------
>> policy/modules/contrib/pulseaudio.te | 8 ++++++++
>> 2 files changed, 8 insertions(+), 14 deletions(-)
>>
>> ---
>refpolicy-git-06082016-orig/policy/modules/contrib/mozilla.te 2016-09-11
>17:05:47.916850416 +0200
>> +++
>refpolicy-git-06082016/policy/modules/contrib/mozilla.te 2016-09-11
>17:05:27.911531798 +0200
>> @@ -234,11 +267,6 @@ tunable_policy(`use_samba_home_dirs',`
>> ')
>>
>> optional_policy(`
>> - alsa_read_config(mozilla_t)
>> - alsa_read_home_files(mozilla_t)
>> -')
>> -
>> -optional_policy(`
>> apache_read_user_scripts(mozilla_t)
>> apache_read_user_content(mozilla_t)
>> ')
>> @@ -297,8 +329,6 @@ optional_policy(`
>>
>> optional_policy(`
>> pulseaudio_run(mozilla_t, mozilla_roles)
>> - pulseaudio_rw_tmpfs_files(mozilla_t)
>> - pulseaudio_use_fds(mozilla_t)
>> ')
>>
>> optional_policy(`
>> @@ -525,11 +569,6 @@ tunable_policy(`use_samba_home_dirs',`
>> ')
>>
>> optional_policy(`
>> - alsa_read_config(mozilla_plugin_t)
>> - alsa_read_home_files(mozilla_plugin_t)
>> -')
>> -
>> -optional_policy(`
>> automount_dontaudit_getattr_tmp_dirs(mozilla_plugin_t)
>> ')
>>
>> @@ -568,8 +607,6 @@ optional_policy(`
>>
>> optional_policy(`
>> pulseaudio_run(mozilla_plugin_t, mozilla_plugin_roles)
>> - pulseaudio_rw_tmpfs_files(mozilla_plugin_t)
>> - pulseaudio_use_fds(mozilla_plugin_t)
>> ')
>>
>> optional_policy(`
>> ---
>refpolicy-git-06082016-orig/policy/modules/contrib/pulseaudio.te 2016-08-20
>03:45:31.741027074 +0200
>> +++
>refpolicy-git-06082016/policy/modules/contrib/pulseaudio.te 2016-09-11
>17:15:40.155169246 +0200
>> @@ -231,6 +258,9 @@ pulseaudio_home_filetrans_pulseaudio_hom
>> pulseaudio_home_filetrans_pulseaudio_home(pulseaudio_client, file,
>".pulse-cookie")
>> pulseaudio_signull(pulseaudio_client)
>>
>> +pulseaudio_rw_tmpfs_files(pulseaudio_client)
>> +pulseaudio_use_fds(pulseaudio_client)
>> +
>> userdom_read_user_tmpfs_files(pulseaudio_client)
>> userdom_user_runtime_filetrans(pulseaudio_client, pulseaudio_tmp_t,
>dir, "pulse")
>> # userdom_delete_user_tmpfs_files(pulseaudio_client)
>> @@ -250,6 +280,11 @@ tunable_policy(`use_samba_home_dirs',`
>> ')
>>
>> optional_policy(`
>> + alsa_read_config(pulseaudio_client)
>> + alsa_read_home_files(pulseaudio_client)
>> +')
>> +
>> +optional_policy(`
>> pulseaudio_dbus_chat(pulseaudio_client)
>> ')
>>
>> _______________________________________________
>> refpolicy mailing list
>> refpolicy at oss.tresys.com
>> http://oss.tresys.com/mailman/listinfo/refpolicy
>>
^ permalink raw reply [flat|nested] 11+ messages in thread
* [refpolicy] [PATCH] mozilla: let mozilla play audio
2016-09-12 22:51 ` Chris PeBenito
2016-09-13 11:29 ` Guido Trentalancia
@ 2016-09-13 11:37 ` Guido Trentalancia
2016-09-13 11:57 ` Guido Trentalancia
2 siblings, 0 replies; 11+ messages in thread
From: Guido Trentalancia @ 2016-09-13 11:37 UTC (permalink / raw)
To: refpolicy
However consider that I have no indication that other pulseaudio clients also need those permissions...
There are no test results that indicate this.
So, although it's not very risky, change it at your own risk.
Regards,
Guido
Il 13 settembre 2016 00:51:44 CEST, Chris PeBenito <pebenito@ieee.org> ha scritto:
>On 09/11/16 11:22, Guido Trentalancia via refpolicy wrote:
>> Hello Dominick (and cc Chris) !
>>
>> On Sun, 11/09/2016 at 15.21 +0200, Dominick Grift via refpolicy
>wrote:
>>> On 09/10/2016 06:26 PM, Guido Trentalancia via refpolicy wrote:
>>>>
>>>> Let mozilla play audio:
>>>>
>>>> - add new interfaces to the pulseaudio module;
>>>> - let mozilla read alsa configuration files;
>>>> - add further permissions to mozilla needed to use
>>>> pulseaudio to play audio.
>>>>
>>>> Signed-off-by: Guido Trentalancia <guido@trentalancia.net>
>>>> ---
>>>> policy/modules/contrib/mozilla.te | 9 ++++
>>>> policy/modules/contrib/pulseaudio.if | 77
>>>> +++++++++++++++++++++++++++++++++++
>>>> 2 files changed, 86 insertions(+)
>>
>> [...]
>>
>>> Applies to all pulseaudio clients, so this should have been added to
>>> pulseaudio.te instead:
>>
>> I am fine with improving this.
>>
>>> optional_policy(`
>>> alsa_read_config(pulseaudio_client)
>>> alsa_read_home_files(pulseaudio_client)
>>> ')
>>
>> and this:
>>
>>>>
>>>> + pulseaudio_use_fds(mozilla_t)
>>>
>>> This applies to all pulseaudio_client and thus should be added to
>>> pulseaudio.te as follows instead:
>>>
>>> pulseaudio_use_fds(pulseaudio_client)
>>
>> as long as it is also fine to Christopher.
>
>If the rules apply to all pulseaudio domains, then it should be done as
>
>Dominick suggests.
>
>
>
>> The other change (delete instead of read/write) doesn't make a big
>> difference in my opinion.
>>
>> Here is the small diff:
>>
>> Improvements to the mozilla and pulseaudio modules
>> as suggested by Dominick Grift.
>>
>> policy/modules/contrib/mozilla.te | 14 --------------
>> policy/modules/contrib/pulseaudio.te | 8 ++++++++
>> 2 files changed, 8 insertions(+), 14 deletions(-)
>>
>> ---
>refpolicy-git-06082016-orig/policy/modules/contrib/mozilla.te 2016-09-11
>17:05:47.916850416 +0200
>> +++
>refpolicy-git-06082016/policy/modules/contrib/mozilla.te 2016-09-11
>17:05:27.911531798 +0200
>> @@ -234,11 +267,6 @@ tunable_policy(`use_samba_home_dirs',`
>> ')
>>
>> optional_policy(`
>> - alsa_read_config(mozilla_t)
>> - alsa_read_home_files(mozilla_t)
>> -')
>> -
>> -optional_policy(`
>> apache_read_user_scripts(mozilla_t)
>> apache_read_user_content(mozilla_t)
>> ')
>> @@ -297,8 +329,6 @@ optional_policy(`
>>
>> optional_policy(`
>> pulseaudio_run(mozilla_t, mozilla_roles)
>> - pulseaudio_rw_tmpfs_files(mozilla_t)
>> - pulseaudio_use_fds(mozilla_t)
>> ')
>>
>> optional_policy(`
>> @@ -525,11 +569,6 @@ tunable_policy(`use_samba_home_dirs',`
>> ')
>>
>> optional_policy(`
>> - alsa_read_config(mozilla_plugin_t)
>> - alsa_read_home_files(mozilla_plugin_t)
>> -')
>> -
>> -optional_policy(`
>> automount_dontaudit_getattr_tmp_dirs(mozilla_plugin_t)
>> ')
>>
>> @@ -568,8 +607,6 @@ optional_policy(`
>>
>> optional_policy(`
>> pulseaudio_run(mozilla_plugin_t, mozilla_plugin_roles)
>> - pulseaudio_rw_tmpfs_files(mozilla_plugin_t)
>> - pulseaudio_use_fds(mozilla_plugin_t)
>> ')
>>
>> optional_policy(`
>> ---
>refpolicy-git-06082016-orig/policy/modules/contrib/pulseaudio.te 2016-08-20
>03:45:31.741027074 +0200
>> +++
>refpolicy-git-06082016/policy/modules/contrib/pulseaudio.te 2016-09-11
>17:15:40.155169246 +0200
>> @@ -231,6 +258,9 @@ pulseaudio_home_filetrans_pulseaudio_hom
>> pulseaudio_home_filetrans_pulseaudio_home(pulseaudio_client, file,
>".pulse-cookie")
>> pulseaudio_signull(pulseaudio_client)
>>
>> +pulseaudio_rw_tmpfs_files(pulseaudio_client)
>> +pulseaudio_use_fds(pulseaudio_client)
>> +
>> userdom_read_user_tmpfs_files(pulseaudio_client)
>> userdom_user_runtime_filetrans(pulseaudio_client, pulseaudio_tmp_t,
>dir, "pulse")
>> # userdom_delete_user_tmpfs_files(pulseaudio_client)
>> @@ -250,6 +280,11 @@ tunable_policy(`use_samba_home_dirs',`
>> ')
>>
>> optional_policy(`
>> + alsa_read_config(pulseaudio_client)
>> + alsa_read_home_files(pulseaudio_client)
>> +')
>> +
>> +optional_policy(`
>> pulseaudio_dbus_chat(pulseaudio_client)
>> ')
>>
>> _______________________________________________
>> refpolicy mailing list
>> refpolicy at oss.tresys.com
>> http://oss.tresys.com/mailman/listinfo/refpolicy
>>
^ permalink raw reply [flat|nested] 11+ messages in thread
* [refpolicy] [PATCH] mozilla: let mozilla play audio
2016-09-12 22:51 ` Chris PeBenito
2016-09-13 11:29 ` Guido Trentalancia
2016-09-13 11:37 ` Guido Trentalancia
@ 2016-09-13 11:57 ` Guido Trentalancia
2016-09-13 14:40 ` Dominick Grift
2 siblings, 1 reply; 11+ messages in thread
From: Guido Trentalancia @ 2016-09-13 11:57 UTC (permalink / raw)
To: refpolicy
For your information.
Pulseaudio clients such as mplayer and pavucontrol do play audio and change the audio settings respectively without requiring those extra permissions in the pulseaudio module at the pulseaudio_client section.
Regards,
Guido
On the 13th of September 2016 00:51:44 CEST, Chris PeBenito <pebenito@ieee.org> wrote:
>On 09/11/16 11:22, Guido Trentalancia via refpolicy wrote:
>> Hello Dominick (and cc Chris) !
>>
>> On Sun, 11/09/2016 at 15.21 +0200, Dominick Grift via refpolicy
>wrote:
>>> On 09/10/2016 06:26 PM, Guido Trentalancia via refpolicy wrote:
>>>>
>>>> Let mozilla play audio:
>>>>
>>>> - add new interfaces to the pulseaudio module;
>>>> - let mozilla read alsa configuration files;
>>>> - add further permissions to mozilla needed to use
>>>> pulseaudio to play audio.
>>>>
>>>> Signed-off-by: Guido Trentalancia <guido@trentalancia.net>
>>>> ---
>>>> policy/modules/contrib/mozilla.te | 9 ++++
>>>> policy/modules/contrib/pulseaudio.if | 77
>>>> +++++++++++++++++++++++++++++++++++
>>>> 2 files changed, 86 insertions(+)
>>
>> [...]
>>
>>> Applies to all pulseaudio clients, so this should have been added to
>>> pulseaudio.te instead:
>>
>> I am fine with improving this.
>>
>>> optional_policy(`
>>> alsa_read_config(pulseaudio_client)
>>> alsa_read_home_files(pulseaudio_client)
>>> ')
>>
>> and this:
>>
>>>>
>>>> + pulseaudio_use_fds(mozilla_t)
>>>
>>> This applies to all pulseaudio_client and thus should be added to
>>> pulseaudio.te as follows instead:
>>>
>>> pulseaudio_use_fds(pulseaudio_client)
>>
>> as long as it is also fine to Christopher.
>
>If the rules apply to all pulseaudio domains, then it should be done as
>
>Dominick suggests.
>
>
>
>> The other change (delete instead of read/write) doesn't make a big
>> difference in my opinion.
>>
>> Here is the small diff:
>>
>> Improvements to the mozilla and pulseaudio modules
>> as suggested by Dominick Grift.
>>
>> policy/modules/contrib/mozilla.te | 14 --------------
>> policy/modules/contrib/pulseaudio.te | 8 ++++++++
>> 2 files changed, 8 insertions(+), 14 deletions(-)
>>
>> ---
>refpolicy-git-06082016-orig/policy/modules/contrib/mozilla.te 2016-09-11
>17:05:47.916850416 +0200
>> +++
>refpolicy-git-06082016/policy/modules/contrib/mozilla.te 2016-09-11
>17:05:27.911531798 +0200
>> @@ -234,11 +267,6 @@ tunable_policy(`use_samba_home_dirs',`
>> ')
>>
>> optional_policy(`
>> - alsa_read_config(mozilla_t)
>> - alsa_read_home_files(mozilla_t)
>> -')
>> -
>> -optional_policy(`
>> apache_read_user_scripts(mozilla_t)
>> apache_read_user_content(mozilla_t)
>> ')
>> @@ -297,8 +329,6 @@ optional_policy(`
>>
>> optional_policy(`
>> pulseaudio_run(mozilla_t, mozilla_roles)
>> - pulseaudio_rw_tmpfs_files(mozilla_t)
>> - pulseaudio_use_fds(mozilla_t)
>> ')
>>
>> optional_policy(`
>> @@ -525,11 +569,6 @@ tunable_policy(`use_samba_home_dirs',`
>> ')
>>
>> optional_policy(`
>> - alsa_read_config(mozilla_plugin_t)
>> - alsa_read_home_files(mozilla_plugin_t)
>> -')
>> -
>> -optional_policy(`
>> automount_dontaudit_getattr_tmp_dirs(mozilla_plugin_t)
>> ')
>>
>> @@ -568,8 +607,6 @@ optional_policy(`
>>
>> optional_policy(`
>> pulseaudio_run(mozilla_plugin_t, mozilla_plugin_roles)
>> - pulseaudio_rw_tmpfs_files(mozilla_plugin_t)
>> - pulseaudio_use_fds(mozilla_plugin_t)
>> ')
>>
>> optional_policy(`
>> ---
>refpolicy-git-06082016-orig/policy/modules/contrib/pulseaudio.te 2016-08-20
>03:45:31.741027074 +0200
>> +++
>refpolicy-git-06082016/policy/modules/contrib/pulseaudio.te 2016-09-11
>17:15:40.155169246 +0200
>> @@ -231,6 +258,9 @@ pulseaudio_home_filetrans_pulseaudio_hom
>> pulseaudio_home_filetrans_pulseaudio_home(pulseaudio_client, file,
>".pulse-cookie")
>> pulseaudio_signull(pulseaudio_client)
>>
>> +pulseaudio_rw_tmpfs_files(pulseaudio_client)
>> +pulseaudio_use_fds(pulseaudio_client)
>> +
>> userdom_read_user_tmpfs_files(pulseaudio_client)
>> userdom_user_runtime_filetrans(pulseaudio_client, pulseaudio_tmp_t,
>dir, "pulse")
>> # userdom_delete_user_tmpfs_files(pulseaudio_client)
>> @@ -250,6 +280,11 @@ tunable_policy(`use_samba_home_dirs',`
>> ')
>>
>> optional_policy(`
>> + alsa_read_config(pulseaudio_client)
>> + alsa_read_home_files(pulseaudio_client)
>> +')
>> +
>> +optional_policy(`
>> pulseaudio_dbus_chat(pulseaudio_client)
>> ')
>>
>> _______________________________________________
>> refpolicy mailing list
>> refpolicy at oss.tresys.com
>> http://oss.tresys.com/mailman/listinfo/refpolicy
>>
^ permalink raw reply [flat|nested] 11+ messages in thread
* [refpolicy] [PATCH] mozilla: let mozilla play audio
2016-09-13 11:57 ` Guido Trentalancia
@ 2016-09-13 14:40 ` Dominick Grift
2016-09-13 15:43 ` Guido Trentalancia
0 siblings, 1 reply; 11+ messages in thread
From: Dominick Grift @ 2016-09-13 14:40 UTC (permalink / raw)
To: refpolicy
On 09/13/2016 01:57 PM, Guido Trentalancia via refpolicy wrote:
> For your information.
>
> Pulseaudio clients such as mplayer and pavucontrol do play audio and change the audio settings respectively without requiring those extra permissions in the pulseaudio module at the pulseaudio_client section.
>
I have to admit that mplayer seems to not need to read /etc/alsa in my
quick test either.
So yes I may just be wrong about this, or maybe i am just not able to
trigger it in short notice.
> Regards,
>
> Guido
>
> On the 13th of September 2016 00:51:44 CEST, Chris PeBenito <pebenito@ieee.org> wrote:
>> On 09/11/16 11:22, Guido Trentalancia via refpolicy wrote:
>>> Hello Dominick (and cc Chris) !
>>>
>>> On Sun, 11/09/2016 at 15.21 +0200, Dominick Grift via refpolicy
>> wrote:
>>>> On 09/10/2016 06:26 PM, Guido Trentalancia via refpolicy wrote:
>>>>>
>>>>> Let mozilla play audio:
>>>>>
>>>>> - add new interfaces to the pulseaudio module;
>>>>> - let mozilla read alsa configuration files;
>>>>> - add further permissions to mozilla needed to use
>>>>> pulseaudio to play audio.
>>>>>
>>>>> Signed-off-by: Guido Trentalancia <guido@trentalancia.net>
>>>>> ---
>>>>> policy/modules/contrib/mozilla.te | 9 ++++
>>>>> policy/modules/contrib/pulseaudio.if | 77
>>>>> +++++++++++++++++++++++++++++++++++
>>>>> 2 files changed, 86 insertions(+)
>>>
>>> [...]
>>>
>>>> Applies to all pulseaudio clients, so this should have been added to
>>>> pulseaudio.te instead:
>>>
>>> I am fine with improving this.
>>>
>>>> optional_policy(`
>>>> alsa_read_config(pulseaudio_client)
>>>> alsa_read_home_files(pulseaudio_client)
>>>> ')
>>>
>>> and this:
>>>
>>>>>
>>>>> + pulseaudio_use_fds(mozilla_t)
>>>>
>>>> This applies to all pulseaudio_client and thus should be added to
>>>> pulseaudio.te as follows instead:
>>>>
>>>> pulseaudio_use_fds(pulseaudio_client)
>>>
>>> as long as it is also fine to Christopher.
>>
>> If the rules apply to all pulseaudio domains, then it should be done as
>>
>> Dominick suggests.
>>
>>
>>
>>> The other change (delete instead of read/write) doesn't make a big
>>> difference in my opinion.
>>>
>>> Here is the small diff:
>>>
>>> Improvements to the mozilla and pulseaudio modules
>>> as suggested by Dominick Grift.
>>>
>>> policy/modules/contrib/mozilla.te | 14 --------------
>>> policy/modules/contrib/pulseaudio.te | 8 ++++++++
>>> 2 files changed, 8 insertions(+), 14 deletions(-)
>>>
>>> ---
>> refpolicy-git-06082016-orig/policy/modules/contrib/mozilla.te 2016-09-11
>> 17:05:47.916850416 +0200
>>> +++
>> refpolicy-git-06082016/policy/modules/contrib/mozilla.te 2016-09-11
>> 17:05:27.911531798 +0200
>>> @@ -234,11 +267,6 @@ tunable_policy(`use_samba_home_dirs',`
>>> ')
>>>
>>> optional_policy(`
>>> - alsa_read_config(mozilla_t)
>>> - alsa_read_home_files(mozilla_t)
>>> -')
>>> -
>>> -optional_policy(`
>>> apache_read_user_scripts(mozilla_t)
>>> apache_read_user_content(mozilla_t)
>>> ')
>>> @@ -297,8 +329,6 @@ optional_policy(`
>>>
>>> optional_policy(`
>>> pulseaudio_run(mozilla_t, mozilla_roles)
>>> - pulseaudio_rw_tmpfs_files(mozilla_t)
>>> - pulseaudio_use_fds(mozilla_t)
>>> ')
>>>
>>> optional_policy(`
>>> @@ -525,11 +569,6 @@ tunable_policy(`use_samba_home_dirs',`
>>> ')
>>>
>>> optional_policy(`
>>> - alsa_read_config(mozilla_plugin_t)
>>> - alsa_read_home_files(mozilla_plugin_t)
>>> -')
>>> -
>>> -optional_policy(`
>>> automount_dontaudit_getattr_tmp_dirs(mozilla_plugin_t)
>>> ')
>>>
>>> @@ -568,8 +607,6 @@ optional_policy(`
>>>
>>> optional_policy(`
>>> pulseaudio_run(mozilla_plugin_t, mozilla_plugin_roles)
>>> - pulseaudio_rw_tmpfs_files(mozilla_plugin_t)
>>> - pulseaudio_use_fds(mozilla_plugin_t)
>>> ')
>>>
>>> optional_policy(`
>>> ---
>> refpolicy-git-06082016-orig/policy/modules/contrib/pulseaudio.te 2016-08-20
>> 03:45:31.741027074 +0200
>>> +++
>> refpolicy-git-06082016/policy/modules/contrib/pulseaudio.te 2016-09-11
>> 17:15:40.155169246 +0200
>>> @@ -231,6 +258,9 @@ pulseaudio_home_filetrans_pulseaudio_hom
>>> pulseaudio_home_filetrans_pulseaudio_home(pulseaudio_client, file,
>> ".pulse-cookie")
>>> pulseaudio_signull(pulseaudio_client)
>>>
>>> +pulseaudio_rw_tmpfs_files(pulseaudio_client)
>>> +pulseaudio_use_fds(pulseaudio_client)
>>> +
>>> userdom_read_user_tmpfs_files(pulseaudio_client)
>>> userdom_user_runtime_filetrans(pulseaudio_client, pulseaudio_tmp_t,
>> dir, "pulse")
>>> # userdom_delete_user_tmpfs_files(pulseaudio_client)
>>> @@ -250,6 +280,11 @@ tunable_policy(`use_samba_home_dirs',`
>>> ')
>>>
>>> optional_policy(`
>>> + alsa_read_config(pulseaudio_client)
>>> + alsa_read_home_files(pulseaudio_client)
>>> +')
>>> +
>>> +optional_policy(`
>>> pulseaudio_dbus_chat(pulseaudio_client)
>>> ')
>>>
>>> _______________________________________________
>>> refpolicy mailing list
>>> refpolicy at oss.tresys.com
>>> http://oss.tresys.com/mailman/listinfo/refpolicy
>>>
>
> _______________________________________________
> refpolicy mailing list
> refpolicy at oss.tresys.com
> http://oss.tresys.com/mailman/listinfo/refpolicy
>
--
Key fingerprint = 5F4D 3CDB D3F8 3652 FBD8 02D5 3B6C 5F1D 2C7B 6B02
https://sks-keyservers.net/pks/lookup?op=get&search=0x3B6C5F1D2C7B6B02
Dominick Grift
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 648 bytes
Desc: OpenPGP digital signature
Url : http://oss.tresys.com/pipermail/refpolicy/attachments/20160913/bb0ca895/attachment.bin
^ permalink raw reply [flat|nested] 11+ messages in thread
* [refpolicy] [PATCH] mozilla: let mozilla play audio
2016-09-13 14:40 ` Dominick Grift
@ 2016-09-13 15:43 ` Guido Trentalancia
0 siblings, 0 replies; 11+ messages in thread
From: Guido Trentalancia @ 2016-09-13 15:43 UTC (permalink / raw)
To: refpolicy
Just pump up the volume and enjoy!!
Guido
On the 13th of September 2016 16:40:13 CEST, Dominick Grift via refpolicy <refpolicy@oss.tresys.com> wrote:
>On 09/13/2016 01:57 PM, Guido Trentalancia via refpolicy wrote:
>> For your information.
>>
>> Pulseaudio clients such as mplayer and pavucontrol do play audio and
>change the audio settings respectively without requiring those extra
>permissions in the pulseaudio module at the pulseaudio_client section.
>>
>
>I have to admit that mplayer seems to not need to read /etc/alsa in my
>quick test either.
>
>So yes I may just be wrong about this, or maybe i am just not able to
>trigger it in short notice.
>
>> Regards,
>>
>> Guido
>>
>> On the 13th of September 2016 00:51:44 CEST, Chris PeBenito
><pebenito@ieee.org> wrote:
>>> On 09/11/16 11:22, Guido Trentalancia via refpolicy wrote:
>>>> Hello Dominick (and cc Chris) !
>>>>
>>>> On Sun, 11/09/2016 at 15.21 +0200, Dominick Grift via refpolicy
>>> wrote:
>>>>> On 09/10/2016 06:26 PM, Guido Trentalancia via refpolicy wrote:
>>>>>>
>>>>>> Let mozilla play audio:
>>>>>>
>>>>>> - add new interfaces to the pulseaudio module;
>>>>>> - let mozilla read alsa configuration files;
>>>>>> - add further permissions to mozilla needed to use
>>>>>> pulseaudio to play audio.
>>>>>>
>>>>>> Signed-off-by: Guido Trentalancia <guido@trentalancia.net>
>>>>>> ---
>>>>>> policy/modules/contrib/mozilla.te | 9 ++++
>>>>>> policy/modules/contrib/pulseaudio.if | 77
>>>>>> +++++++++++++++++++++++++++++++++++
>>>>>> 2 files changed, 86 insertions(+)
>>>>
>>>> [...]
>>>>
>>>>> Applies to all pulseaudio clients, so this should have been added
>to
>>>>> pulseaudio.te instead:
>>>>
>>>> I am fine with improving this.
>>>>
>>>>> optional_policy(`
>>>>> alsa_read_config(pulseaudio_client)
>>>>> alsa_read_home_files(pulseaudio_client)
>>>>> ')
>>>>
>>>> and this:
>>>>
>>>>>>
>>>>>> + pulseaudio_use_fds(mozilla_t)
>>>>>
>>>>> This applies to all pulseaudio_client and thus should be added to
>>>>> pulseaudio.te as follows instead:
>>>>>
>>>>> pulseaudio_use_fds(pulseaudio_client)
>>>>
>>>> as long as it is also fine to Christopher.
>>>
>>> If the rules apply to all pulseaudio domains, then it should be done
>as
>>>
>>> Dominick suggests.
>>>
>>>
>>>
>>>> The other change (delete instead of read/write) doesn't make a big
>>>> difference in my opinion.
>>>>
>>>> Here is the small diff:
>>>>
>>>> Improvements to the mozilla and pulseaudio modules
>>>> as suggested by Dominick Grift.
>>>>
>>>> policy/modules/contrib/mozilla.te | 14 --------------
>>>> policy/modules/contrib/pulseaudio.te | 8 ++++++++
>>>> 2 files changed, 8 insertions(+), 14 deletions(-)
>>>>
>>>> ---
>>>
>refpolicy-git-06082016-orig/policy/modules/contrib/mozilla.te 2016-09-11
>>> 17:05:47.916850416 +0200
>>>> +++
>>> refpolicy-git-06082016/policy/modules/contrib/mozilla.te 2016-09-11
>>> 17:05:27.911531798 +0200
>>>> @@ -234,11 +267,6 @@ tunable_policy(`use_samba_home_dirs',`
>>>> ')
>>>>
>>>> optional_policy(`
>>>> - alsa_read_config(mozilla_t)
>>>> - alsa_read_home_files(mozilla_t)
>>>> -')
>>>> -
>>>> -optional_policy(`
>>>> apache_read_user_scripts(mozilla_t)
>>>> apache_read_user_content(mozilla_t)
>>>> ')
>>>> @@ -297,8 +329,6 @@ optional_policy(`
>>>>
>>>> optional_policy(`
>>>> pulseaudio_run(mozilla_t, mozilla_roles)
>>>> - pulseaudio_rw_tmpfs_files(mozilla_t)
>>>> - pulseaudio_use_fds(mozilla_t)
>>>> ')
>>>>
>>>> optional_policy(`
>>>> @@ -525,11 +569,6 @@ tunable_policy(`use_samba_home_dirs',`
>>>> ')
>>>>
>>>> optional_policy(`
>>>> - alsa_read_config(mozilla_plugin_t)
>>>> - alsa_read_home_files(mozilla_plugin_t)
>>>> -')
>>>> -
>>>> -optional_policy(`
>>>> automount_dontaudit_getattr_tmp_dirs(mozilla_plugin_t)
>>>> ')
>>>>
>>>> @@ -568,8 +607,6 @@ optional_policy(`
>>>>
>>>> optional_policy(`
>>>> pulseaudio_run(mozilla_plugin_t, mozilla_plugin_roles)
>>>> - pulseaudio_rw_tmpfs_files(mozilla_plugin_t)
>>>> - pulseaudio_use_fds(mozilla_plugin_t)
>>>> ')
>>>>
>>>> optional_policy(`
>>>> ---
>>>
>refpolicy-git-06082016-orig/policy/modules/contrib/pulseaudio.te 2016-08-20
>>> 03:45:31.741027074 +0200
>>>> +++
>>>
>refpolicy-git-06082016/policy/modules/contrib/pulseaudio.te 2016-09-11
>>> 17:15:40.155169246 +0200
>>>> @@ -231,6 +258,9 @@ pulseaudio_home_filetrans_pulseaudio_hom
>>>> pulseaudio_home_filetrans_pulseaudio_home(pulseaudio_client, file,
>>> ".pulse-cookie")
>>>> pulseaudio_signull(pulseaudio_client)
>>>>
>>>> +pulseaudio_rw_tmpfs_files(pulseaudio_client)
>>>> +pulseaudio_use_fds(pulseaudio_client)
>>>> +
>>>> userdom_read_user_tmpfs_files(pulseaudio_client)
>>>> userdom_user_runtime_filetrans(pulseaudio_client,
>pulseaudio_tmp_t,
>>> dir, "pulse")
>>>> # userdom_delete_user_tmpfs_files(pulseaudio_client)
>>>> @@ -250,6 +280,11 @@ tunable_policy(`use_samba_home_dirs',`
>>>> ')
>>>>
>>>> optional_policy(`
>>>> + alsa_read_config(pulseaudio_client)
>>>> + alsa_read_home_files(pulseaudio_client)
>>>> +')
>>>> +
>>>> +optional_policy(`
>>>> pulseaudio_dbus_chat(pulseaudio_client)
>>>> ')
>>>>
>>>> _______________________________________________
>>>> refpolicy mailing list
>>>> refpolicy at oss.tresys.com
>>>> http://oss.tresys.com/mailman/listinfo/refpolicy
>>>>
>>
>> _______________________________________________
>> refpolicy mailing list
>> refpolicy at oss.tresys.com
>> http://oss.tresys.com/mailman/listinfo/refpolicy
>>
^ permalink raw reply [flat|nested] 11+ messages in thread
end of thread, other threads:[~2016-09-13 15:43 UTC | newest]
Thread overview: 11+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2016-09-10 16:26 [refpolicy] [PATCH] mozilla: let mozilla play audio Guido Trentalancia
2016-09-11 13:03 ` Chris PeBenito
2016-09-11 13:29 ` Guido Trentalancia
2016-09-11 13:21 ` Dominick Grift
2016-09-11 15:22 ` Guido Trentalancia
2016-09-12 22:51 ` Chris PeBenito
2016-09-13 11:29 ` Guido Trentalancia
2016-09-13 11:37 ` Guido Trentalancia
2016-09-13 11:57 ` Guido Trentalancia
2016-09-13 14:40 ` Dominick Grift
2016-09-13 15:43 ` Guido Trentalancia
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.