[gentoo-commits] proj/hardened-refpolicy:userroles commit in: policy/modules/roles/

["Jason Zaman" <gentoo@perfinion.com>]

commit:     3677ba127d40a22289d282c32d28323604c5e4c1
Author:     Jason Zaman <jason <AT> perfinion <DOT> com>
AuthorDate: Tue Dec  2 12:00:05 2014 +0000
Commit:     Jason Zaman <gentoo <AT> perfinion <DOT> com>
CommitDate: Tue Dec  2 14:17:11 2014 +0000
URL:        http://sources.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=3677ba12

Allow users to talk to devicekit

Needed to read battery status and disk info.

type=USER_AVC msg=audit(1417367573.060:234): pid=3121 uid=101
auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t
msg='avc:  denied  { send_msg } for msgtype=signal
interface=org.freedesktop.UPower member=DeviceChanged
dest=org.freedesktop.DBus spid=3606 tpid=3858
scontext=system_u:system_r:devicekit_power_t
tcontext=staff_u:staff_r:staff_t tclass=dbus  exe="/usr/bin/dbus-daemon"
sauid=101 hostname=? addr=? terminal=?'

type=USER_AVC msg=audit(1417363447.011:103525): pid=3339 uid=101
auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t
msg='avc:  denied  { send_msg } for msgtype=signal
interface=org.freedesktop.DBus.Properties member=PropertiesChanged
dest=org.freedesktop.DBus spid=4094 tpid=4090
scontext=system_u:system_r:devicekit_disk_t
tcontext=staff_u:staff_r:staff_t tclass=dbus  exe="/usr/bin/dbus-daemon"
sauid=101 hostname=? addr=? terminal=?'

---
 policy/modules/roles/staff.te      | 5 +++++
 policy/modules/roles/unprivuser.te | 5 +++++
 2 files changed, 10 insertions(+)

diff --git a/policy/modules/roles/staff.te b/policy/modules/roles/staff.te
index 1a867f0..0c15bb5 100644
--- a/policy/modules/roles/staff.te
+++ b/policy/modules/roles/staff.te
@@ -200,6 +200,11 @@ ifdef(`distro_gentoo',`
 	')
 
 	optional_policy(`
+		devicekit_dbus_chat_disk(staff_t)
+		devicekit_dbus_chat_power(staff_t)
+	')
+
+	optional_policy(`
 		dropbox_role(staff_r, staff_t)
 	')
 

diff --git a/policy/modules/roles/unprivuser.te b/policy/modules/roles/unprivuser.te
index e349a03..63dced4 100644
--- a/policy/modules/roles/unprivuser.te
+++ b/policy/modules/roles/unprivuser.te
@@ -185,6 +185,11 @@ ifdef(`distro_gentoo',`
 	')
 
 	optional_policy(`
+		devicekit_dbus_chat_disk(user_t)
+		devicekit_dbus_chat_power(user_t)
+	')
+
+	optional_policy(`
 		dropbox_role(user_r, user_t)
 	')