From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from lists.gentoo.org (unknown [208.92.234.80]) by finch.gentoo.org (Postfix) with ESMTP id 15F9F1381FA for ; Thu, 22 May 2014 16:53:38 +0000 (UTC) Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id 65B3CE0A95; Thu, 22 May 2014 16:53:37 +0000 (UTC) Received: from smtp.gentoo.org (smtp.gentoo.org [140.211.166.183]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by pigeon.gentoo.org (Postfix) with ESMTPS id D0902E0A8C for ; Thu, 22 May 2014 16:53:36 +0000 (UTC) Received: from spoonbill.gentoo.org (unknown [81.93.255.5]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by smtp.gentoo.org (Postfix) with ESMTPS id F348B33FDE7 for ; Thu, 22 May 2014 16:53:35 +0000 (UTC) Received: from localhost.localdomain (localhost [127.0.0.1]) by spoonbill.gentoo.org (Postfix) with ESMTP id 9B1F3182D3 for ; Thu, 22 May 2014 16:53:34 +0000 (UTC) From: "Sven Vermeulen" To: gentoo-commits@lists.gentoo.org Content-Transfer-Encoding: 8bit Content-type: text/plain; charset=UTF-8 Reply-To: gentoo-dev@lists.gentoo.org, "Sven Vermeulen" Message-ID: <1400777562.f0c9d69ef883747dd922d9bdcf3b24e534aa4469.swift@gentoo> Subject: [gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/contrib/ X-VCS-Repository: proj/hardened-refpolicy X-VCS-Files: policy/modules/contrib/gnome.fc policy/modules/contrib/gnome.te X-VCS-Directories: policy/modules/contrib/ X-VCS-Committer: swift X-VCS-Committer-Name: Sven Vermeulen X-VCS-Revision: f0c9d69ef883747dd922d9bdcf3b24e534aa4469 X-VCS-Branch: master Date: Thu, 22 May 2014 16:53:34 +0000 (UTC) Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-commits@lists.gentoo.org X-Archives-Salt: 427b639a-1356-4443-bd82-cb1080b76766 X-Archives-Hash: eaf5fdf784cf60dc49523c17f333a3c7 commit: f0c9d69ef883747dd922d9bdcf3b24e534aa4469 Author: Jason Zaman perfinion com> AuthorDate: Mon May 19 20:44:45 2014 +0000 Commit: Sven Vermeulen gentoo org> CommitDate: Thu May 22 16:52:42 2014 +0000 URL: http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=f0c9d69e gconfd keeps its database in the xdg directories gconfd stores settings for applications in the gnome desktop. it needs to be able to manage gnome directories inside ~/.{cache,config,local}/ Signed-off-by: Jason Zaman perfinion.com> --- policy/modules/contrib/gnome.fc | 2 ++ policy/modules/contrib/gnome.te | 18 ++++++++++++++++++ 2 files changed, 20 insertions(+) diff --git a/policy/modules/contrib/gnome.fc b/policy/modules/contrib/gnome.fc index 9bc2c50..31d8c6c 100644 --- a/policy/modules/contrib/gnome.fc +++ b/policy/modules/contrib/gnome.fc @@ -18,5 +18,7 @@ HOME_DIR/\.gnome2_private(/.*)? gen_context(system_u:object_r:gnome_home_t,s0) ifdef(`distro_gentoo',` +HOME_DIR/\.config/dconf(/.*)? gen_context(system_u:object_r:gnome_xdg_config_home_t,s0) +HOME_DIR/\.cache/dconf(/.*)? gen_context(system_u:object_r:gnome_xdg_cache_home_t,s0) HOME_DIR/\.cache/keyring-.* gen_context(system_u:object_r:gnome_xdg_cache_home_t,s0) ') diff --git a/policy/modules/contrib/gnome.te b/policy/modules/contrib/gnome.te index 98cd996..99b426d 100644 --- a/policy/modules/contrib/gnome.te +++ b/policy/modules/contrib/gnome.te @@ -170,4 +170,22 @@ ifdef(`distro_gentoo',` allow gkeyringd_domain gnome_xdg_data_home_t:file manage_file_perms; manage_dirs_pattern(gkeyringd_domain, gnome_xdg_data_home_t, gnome_xdg_data_home_t) + + ## + ## gconfd + ## + + xdg_cache_home_filetrans(gconfd_t, gnome_xdg_cache_home_t, dir) + xdg_config_home_filetrans(gconfd_t, gnome_xdg_config_home_t, dir) + xdg_data_home_filetrans(gconfd_t, gnome_xdg_data_home_t, dir) + + # gconf stores settings for gnome, it needs access + allow gconfd_t gnome_xdg_cache_home_t:file manage_file_perms; + manage_dirs_pattern(gconfd_t, gnome_xdg_cache_home_t, gnome_xdg_cache_home_t) + + allow gconfd_t gnome_xdg_config_home_t:file manage_file_perms; + manage_dirs_pattern(gconfd_t, gnome_xdg_config_home_t, gnome_xdg_config_home_t) + + allow gconfd_t gnome_xdg_data_home_t:file manage_file_perms; + manage_dirs_pattern(gconfd_t, gnome_xdg_data_home_t, gnome_xdg_data_home_t) ')