policy_module(vino, 1.0.0) ######################################## # # Vino server personal declarations. # type vino_server_t; type vino_server_exec_t; application_domain(vino_server_t, vino_server_exec_t) ubac_constrained(vino_server_t) type vino_server_data_home_t; userdom_user_home_content(vino_server_data_home_t) type vino_server_tmp_t; files_tmp_file(vino_server_tmp_t) ubac_constrained(vino_server_tmp_t) type vino_server_tmpfs_t; files_tmpfs_file(vino_server_tmpfs_t) ubac_constrained(vino_server_tmpfs_t) #tcp:26570-26575 ######################################## # # Vino server personal policy. # allow vino_server_t self:process { getsched signal signull }; allow vino_server_t self:fifo_file rw_fifo_file_perms; allow vino_server_t self:netlink_route_socket create_netlink_socket_perms; allow vino_server_t self:shm create_shm_perms; allow vino_server_t self:tcp_socket create_stream_socket_perms; allow vino_server_t self:udp_socket create_stream_socket_perms; allow vino_server_t self:unix_dgram_socket create_socket_perms; allow vino_server_t self:unix_stream_socket create_socket_perms; # ~/.local/share/vino/vino-server.lock. optional_policy(` manage_dirs_pattern(vino_server_t, vino_server_data_home_t, vino_server_data_home_t) manage_files_pattern(vino_server_t, vino_server_data_home_t, vino_server_data_home_t) gnome_data_filetrans(vino_server_t, vino_server_data_home_t, { dir file }) ') manage_sock_files_pattern(vino_server_t, vino_server_tmp_t, vino_server_tmp_t) files_tmp_filetrans(vino_server_t, vino_server_tmp_t, sock_file) manage_files_pattern(vino_server_t, vino_server_tmpfs_t, vino_server_tmpfs_t) fs_tmpfs_filetrans(vino_server_t, vino_server_tmpfs_t, file) corenet_all_recvfrom_netlabel(vino_server_t) corenet_all_recvfrom_unlabeled(vino_server_t) corenet_sendrecv_http_client_packets(vino_server_t) corenet_sendrecv_vnc_server_packets(vino_server_t) corenet_tcp_bind_generic_node(vino_server_t) corenet_tcp_bind_vnc_port(vino_server_t) corenet_tcp_connect_http_port(vino_server_t) corenet_tcp_sendrecv_generic_if(vino_server_t) corenet_tcp_sendrecv_generic_node(vino_server_t) corenet_tcp_sendrecv_generic_port(vino_server_t) # /usr/bin/vino-preferences corecmd_exec_bin(vino_server_t) dev_read_urand(vino_server_t) # /etc/nsswitch.conf files_read_etc_files(vino_server_t) files_read_usr_files(vino_server_t) fs_getattr_tmpfs(vino_server_t) fs_search_auto_mountpoints(vino_server_t) kernel_read_network_state(vino_server_t) miscfiles_read_localization(vino_server_t) sysnet_read_config(vino_server_t) # We need a non-generic type for ~/.icons userdom_dontaudit_read_user_home_content_files(vino_server_t) userdom_stream_connect(vino_server_t) userdom_use_user_terminals(vino_server_t) userdom_read_user_tmpfs_files(vino_server_t) # Bug: user pulseaudio files need open,read and unlink: allow vino_server_t user_tmpfs_t:file unlink; userdom_signull_unpriv_users(vino_server_t) # This sucks: we need a type for orbit-$USER so that we can do a gnome_orbit_filetrans() # avc: denied { create } for pid=5641 comm="vino-server" name="linc-1609-0-1586984db4146" # scontext=staff_u:staff_r:vino_server_t:s0 tcontext=staff_u:object_r:user_tmp_t:s0 tclass=sock_file userdom_manage_user_tmp_sockets(vino_server_t) # orbit-$USER dir. userdom_setattr_user_tmp_dirs(vino_server_t) tunable_policy(`use_nfs_home_dirs', ` fs_manage_nfs_dirs(vino_server_t) fs_manage_nfs_files(vino_server_t) fs_manage_nfs_named_sockets(vino_server_t) ') tunable_policy(`use_samba_home_dirs', ` fs_manage_cifs_dirs(vino_server_t) fs_manage_cifs_files(vino_server_t) fs_manage_cifs_named_sockets(vino_server_t) ') optional_policy(` automount_dontaudit_getattr_tmp_dirs(vino_server_t) ') optional_policy(` dbus_system_bus_client(vino_server_t) ') optional_policy(` gnome_rw_generic_cache(vino_server_t) ') optional_policy(` nis_use_ypbind(vino_server_t) ') optional_policy(` pulseaudio_stream_connect(vino_server_t) pulseaudio_signull(vino_server_t) pulseaudio_rw_home_files(vino_server_t) ') optional_policy(` telepathy_gabble_dbus_chat(vino_server_t) ') optional_policy(` xserver_user_x_domain_template(vino_server, vino_server_t, vino_server_tmpfs_t) ')