diff options
| author |   Jason Zaman <jason@perfinion.com> | 2018-07-10 23:03:17 +0800 |
|---|---|---|
| committer | Jason Zaman <jason@perfinion.com> | 2018-07-11 22:41:35 +0800 |
| commit | b655a97dc1dbc580f51f58201bb101b39da39ea0 (patch) | |
| tree | 6d28abc3151145af0aa1ea68b379ccfd0294af42 | |
| parent | xserver: label .cache/fontconfig as user_fonts_cache_t (diff) | |
| download | hardened-refpolicy-b655a97dc1dbc580f51f58201bb101b39da39ea0.tar.gz hardened-refpolicy-b655a97dc1dbc580f51f58201bb101b39da39ea0.tar.bz2 hardened-refpolicy-b655a97dc1dbc580f51f58201bb101b39da39ea0.zip | |
Allow map xserver_misc_device_t for nvidia driver
| -rw-r--r-- | policy/modules/kernel/devices.if | 18 | ||||
| -rw-r--r-- | policy/modules/services/xserver.if | 1 | ||||
| -rw-r--r-- | policy/modules/services/xserver.te | 1 | ||||
| -rw-r--r-- | policy/modules/system/init.te | 1 |
4 files changed, 21 insertions, 0 deletions
diff --git a/policy/modules/kernel/devices.if b/policy/modules/kernel/devices.if index 3e7f4538..f68d60ab 100644 --- a/policy/modules/kernel/devices.if +++ b/policy/modules/kernel/devices.if @@ -5081,6 +5081,24 @@ interface(`dev_rw_xserver_misc',` ######################################## ## <summary> +## Map X server miscellaneous devices. +## </summary> +## <param name="domain"> +## <summary> +## Domain allowed access. +## </summary> +## </param> +# +interface(`dev_map_xserver_misc',` + gen_require(` + type xserver_misc_device_t; + ') + + allow $1 xserver_misc_device_t:chr_file map; +') + +######################################## +## <summary> ## Read and write to the zero device (/dev/zero). ## </summary> ## <param name="domain"> diff --git a/policy/modules/services/xserver.if b/policy/modules/services/xserver.if index 24caccad..7e13483b 100644 --- a/policy/modules/services/xserver.if +++ b/policy/modules/services/xserver.if @@ -82,6 +82,7 @@ interface(`xserver_restricted_role',` allow $2 xserver_tmp_t:file { getattr read }; dev_rw_xserver_misc($2) + dev_map_xserver_misc($2) dev_rw_power_management($2) dev_read_input($2) dev_read_misc($2) diff --git a/policy/modules/services/xserver.te b/policy/modules/services/xserver.te index 1202b8e5..2e85c3bd 100644 --- a/policy/modules/services/xserver.te +++ b/policy/modules/services/xserver.te @@ -749,6 +749,7 @@ dev_read_raw_memory(xserver_t) dev_wx_raw_memory(xserver_t) # for other device nodes such as the NVidia binary-only driver dev_rw_xserver_misc(xserver_t) +dev_map_xserver_misc(xserver_t) # read events - the synaptics touchpad driver reads raw events dev_rw_input_dev(xserver_t) dev_rwx_zero(xserver_t) diff --git a/policy/modules/system/init.te b/policy/modules/system/init.te index 7ffda24c..a1222272 100644 --- a/policy/modules/system/init.te +++ b/policy/modules/system/init.te @@ -635,6 +635,7 @@ dev_delete_generic_symlinks(initrc_t) dev_getattr_all_blk_files(initrc_t) dev_getattr_all_chr_files(initrc_t) dev_rw_xserver_misc(initrc_t) +dev_map_xserver_misc(initrc_t) domain_kill_all_domains(initrc_t) domain_signal_all_domains(initrc_t) |