From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by finch.gentoo.org (Postfix) with ESMTPS id 46994139088 for ; Fri, 13 Jan 2017 18:43:14 +0000 (UTC) Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id CD301E0C72; Fri, 13 Jan 2017 18:43:12 +0000 (UTC) Received: from smtp.gentoo.org (mail.gentoo.org [IPv6:2001:470:ea4a:1:5054:ff:fec7:86e4]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by pigeon.gentoo.org (Postfix) with ESMTPS id 9DB3AE0C72 for ; Fri, 13 Jan 2017 18:43:12 +0000 (UTC) Received: from oystercatcher.gentoo.org (oystercatcher.gentoo.org [148.251.78.52]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.gentoo.org (Postfix) with ESMTPS id 235B13417FE for ; Fri, 13 Jan 2017 18:43:11 +0000 (UTC) Received: from localhost.localdomain (localhost [127.0.0.1]) by oystercatcher.gentoo.org (Postfix) with ESMTP id 81D8A262C for ; Fri, 13 Jan 2017 18:43:09 +0000 (UTC) From: "Sven Vermeulen" To: gentoo-commits@lists.gentoo.org Content-Transfer-Encoding: 8bit Content-type: text/plain; charset=UTF-8 Reply-To: gentoo-dev@lists.gentoo.org, "Sven Vermeulen" Message-ID: <1484332725.71ed05134f724892f2fe1529bc55d88fe021ce2a.swift@gentoo> Subject: [gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/services/ X-VCS-Repository: proj/hardened-refpolicy X-VCS-Files: policy/modules/services/xserver.fc policy/modules/services/xserver.te X-VCS-Directories: policy/modules/services/ X-VCS-Committer: swift X-VCS-Committer-Name: Sven Vermeulen X-VCS-Revision: 71ed05134f724892f2fe1529bc55d88fe021ce2a X-VCS-Branch: master Date: Fri, 13 Jan 2017 18:43:09 +0000 (UTC) Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-commits@lists.gentoo.org X-Archives-Salt: 6b906b5e-9955-4710-bb5a-d0126d2cb689 X-Archives-Hash: 5e733470d22059347805632a266b8fc5 commit: 71ed05134f724892f2fe1529bc55d88fe021ce2a Author: Guido Trentalancia trentalancia net> AuthorDate: Sat Dec 31 16:43:46 2016 +0000 Commit: Sven Vermeulen gentoo org> CommitDate: Fri Jan 13 18:38:45 2017 +0000 URL: https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=71ed0513 xserver: restrict executable memory permissions The dangerous execheap permission is removed from xdm and the dangerous execmem permission is only enabled for the Gnome Display Manager (gnome-shell running in gdm mode) through a new "xserver_gnome_xdm" boolean. This patch also updates the XKB libs file context with their default location (which at the moment is not compliant with FHS3 due to the fact that it allows by default to write the output from xkbcomp), adds the ability to read udev pid files and finally adds a few permissions so that xconsole can run smoothly. The anomalous permission to execute XKB var library files has been removed and the old X11R6 library location has been updated so that subdirectories are also labeled as xkb_var_lib. This patch includes various improvements and bug fixes as kindly suggested in reviews made by Christopher PeBenito. Signed-off-by: Guido Trentalancia trentalancia.net> policy/modules/services/xserver.fc | 6 ++++-- policy/modules/services/xserver.te | 25 ++++++++++++++++--------- 2 files changed, 20 insertions(+), 11 deletions(-) diff --git a/policy/modules/services/xserver.fc b/policy/modules/services/xserver.fc index 389b74f..40b214a 100644 --- a/policy/modules/services/xserver.fc +++ b/policy/modules/services/xserver.fc @@ -82,6 +82,9 @@ HOME_DIR/\.Xauthority.* -- gen_context(system_u:object_r:xauth_home_t,s0) /usr/sbin/lightdm -- gen_context(system_u:object_r:xdm_exec_t,s0) +# xserver default configure bug: not FHS-compliant because not read-only ! +/usr/share/X11/xkb(/.*)? gen_context(system_u:object_r:xkb_var_lib_t,s0) + /usr/X11R6/bin/[xgkw]dm -- gen_context(system_u:object_r:xdm_exec_t,s0) /usr/X11R6/bin/iceauth -- gen_context(system_u:object_r:iceauth_exec_t,s0) /usr/X11R6/bin/X -- gen_context(system_u:object_r:xserver_exec_t,s0) @@ -90,8 +93,7 @@ HOME_DIR/\.Xauthority.* -- gen_context(system_u:object_r:xauth_home_t,s0) /usr/X11R6/bin/Xipaq -- gen_context(system_u:object_r:xserver_exec_t,s0) /usr/X11R6/bin/Xorg -- gen_context(system_u:object_r:xserver_exec_t,s0) /usr/X11R6/bin/Xwrapper -- gen_context(system_u:object_r:xserver_exec_t,s0) -/usr/X11R6/lib/X11/xkb -d gen_context(system_u:object_r:xkb_var_lib_t,s0) -/usr/X11R6/lib/X11/xkb/.* -- gen_context(system_u:object_r:xkb_var_lib_t,s0) +/usr/X11R6/lib/X11/xkb(/.*)? gen_context(system_u:object_r:xkb_var_lib_t,s0) ifndef(`distro_debian',` /usr/var/[xgkw]dm(/.*)? gen_context(system_u:object_r:xserver_log_t,s0) diff --git a/policy/modules/services/xserver.te b/policy/modules/services/xserver.te index 33f0487..2df9a3e 100644 --- a/policy/modules/services/xserver.te +++ b/policy/modules/services/xserver.te @@ -42,6 +42,14 @@ gen_tunable(xdm_sysadm_login, false) ## ##

+## Use gnome-shell in gdm mode as the +## X Display Manager (XDM) +##

+## +gen_tunable(xserver_gnome_xdm, false) + +## +##

## Support X userspace object manager ##

## @@ -307,6 +315,7 @@ optional_policy(` # allow xdm_t self:capability { setgid setuid sys_resource kill sys_tty_config mknod chown dac_override dac_read_search fowner fsetid ipc_owner sys_nice sys_rawio net_bind_service }; +dontaudit xdm_t self:capability sys_admin; allow xdm_t self:process { setexec setpgid getsched setsched setrlimit signal_perms }; allow xdm_t self:fifo_file rw_fifo_file_perms; allow xdm_t self:shm create_shm_perms; @@ -319,7 +328,7 @@ allow xdm_t self:socket create_socket_perms; allow xdm_t self:appletalk_socket create_socket_perms; allow xdm_t self:key { search link write }; -allow xdm_t xconsole_device_t:fifo_file { getattr setattr }; +allow xdm_t xconsole_device_t:fifo_file { read_fifo_file_perms setattr_fifo_file_perms }; # Allow gdm to run gdm-binary can_exec(xdm_t, xdm_exec_t) @@ -510,6 +519,10 @@ tunable_policy(`xdm_sysadm_login',` # allow xserver_t xdm_tmpfs_t:file rw_file_perms; ') +tunable_policy(`xserver_gnome_xdm',` + allow xdm_t self:process execmem; +') + optional_policy(` alsa_domtrans(xdm_t) ') @@ -589,10 +602,6 @@ optional_policy(` optional_policy(` unconfined_domain(xdm_t) unconfined_domtrans(xdm_t) - - ifndef(`distro_redhat',` - allow xdm_t self:process { execheap execmem }; - ') ') optional_policy(` @@ -658,6 +667,7 @@ manage_fifo_files_pattern(xserver_t, xserver_tmpfs_t, xserver_tmpfs_t) manage_sock_files_pattern(xserver_t, xserver_tmpfs_t, xserver_tmpfs_t) fs_tmpfs_filetrans(xserver_t, xserver_tmpfs_t, { dir file lnk_file sock_file fifo_file }) +# Run xkbcomp manage_files_pattern(xserver_t, xkb_var_lib_t, xkb_var_lib_t) manage_lnk_files_pattern(xserver_t, xkb_var_lib_t, xkb_var_lib_t) files_search_var_lib(xserver_t) @@ -806,6 +816,7 @@ optional_policy(` optional_policy(` udev_read_db(xserver_t) + udev_read_pid_files(xserver_t) ') optional_policy(` @@ -843,10 +854,6 @@ manage_files_pattern(xserver_t, xdm_tmp_t, xdm_tmp_t) manage_lnk_files_pattern(xserver_t, xdm_tmp_t, xdm_tmp_t) manage_sock_files_pattern(xserver_t, xdm_tmp_t, xdm_tmp_t) -# Run xkbcomp. -allow xserver_t xkb_var_lib_t:lnk_file read; -can_exec(xserver_t, xkb_var_lib_t) - # Run Xorg.wrap can_exec(xserver_t, xserver_exec_t)