89 lines
2.1 KiB
Text
89 lines
2.1 KiB
Text
|
# KMSCon SELinux policy module
|
||
|
|
# Contributed by Lubomir Rintel <lkundrak@v3.sk>
|
||
|
|
|
||
|
|
########################################
|
||
|
|
#
|
||
|
|
# Declarations
|
||
|
|
#
|
||
|
|
policy_module(kmscon, 1.0)
|
||
|
|
|
||
|
|
type kmscon_t;
|
||
|
|
type kmscon_exec_t;
|
||
|
|
init_daemon_domain(kmscon_t, kmscon_exec_t)
|
||
|
|
|
||
|
|
type kmscon_conf_t;
|
||
|
|
files_config_file(kmscon_conf_t)
|
||
|
|
|
||
|
|
type kmscon_unit_file_t;
|
||
|
|
systemd_unit_file(kmscon_unit_file_t)
|
||
|
|
|
||
|
|
type kmscon_devpts_t;
|
||
|
|
term_pty(kmscon_devpts_t)
|
||
|
|
# Label this as t, so that login_t can read our terminal with use_all_ttys()
|
||
|
|
term_tty(kmscon_devpts_t)
|
||
|
|
|
||
|
|
########################################
|
||
|
|
#
|
||
|
|
# zoneminder local policy
|
||
|
|
#
|
||
|
|
|
||
|
|
# Switch the VT into a graphics mode ; Set DRM master
|
||
|
|
allow kmscon_t self:capability {sys_admin sys_tty_config};
|
||
|
|
|
||
|
|
dontaudit kmscon_t self:capability2 block_suspend;
|
||
|
|
|
||
|
|
# Create an udev monitor
|
||
|
|
allow kmscon_t self:netlink_kobject_uevent_socket { bind create setopt getattr };
|
||
|
|
|
||
|
|
allow kmscon_t kmscon_devpts_t:chr_file { rw_chr_file_perms setattr_chr_file_perms };
|
||
|
|
term_create_pty(kmscon_t, kmscon_devpts_t)
|
||
|
|
|
||
|
|
list_dirs_pattern(kmscon_t, kmscon_conf_t, kmscon_conf_t)
|
||
|
|
read_files_pattern(kmscon_t, kmscon_conf_t, kmscon_conf_t)
|
||
|
|
|
||
|
|
kernel_read_system_state(kmscon_t)
|
||
|
|
|
||
|
|
auth_read_passwd(kmscon_t)
|
||
|
|
|
||
|
|
dev_rw_dri(kmscon_t)
|
||
|
|
dev_read_sysfs(kmscon_t)
|
||
|
|
dev_read_framebuffer(kmscon_t)
|
||
|
|
dev_write_framebuffer(kmscon_t)
|
||
|
|
dev_rw_input_dev(kmscon_t)
|
||
|
|
|
||
|
|
# Get allowed path length for directory with modules
|
||
|
|
fs_getattr_xattr_fs(kmscon_t)
|
||
|
|
|
||
|
|
locallogin_domtrans(kmscon_t)
|
||
|
|
|
||
|
|
miscfiles_read_fonts(kmscon_t)
|
||
|
|
miscfiles_manage_fonts_cache(kmscon_t)
|
||
|
|
|
||
|
|
# Open the tty, so that it can be handed over to the seat manager
|
||
|
|
term_use_unallocated_ttys(kmscon_t)
|
||
|
|
|
||
|
|
optional_policy(`
|
||
|
|
# Learn about the input devices
|
||
|
|
udev_read_db(kmscon_t)
|
||
|
|
')
|
||
|
|
|
||
|
|
optional_policy(`
|
||
|
|
# Fontconfig and Pango configuration
|
||
|
|
gnome_read_home_config(kmscon_t)
|
||
|
|
')
|
||
|
|
|
||
|
|
optional_policy(`
|
||
|
|
dbus_system_bus_client(kmscon_t)
|
||
|
|
init_dbus_chat(kmscon_t)
|
||
|
|
|
||
|
|
optional_policy(`
|
||
|
|
systemd_dbus_chat_logind(kmscon_t)
|
||
|
|
|
||
|
|
# List seats
|
||
|
|
systemd_login_list_pid_dirs(kmscon_t)
|
||
|
|
systemd_login_read_pid_files(kmscon_t)
|
||
|
|
|
||
|
|
kmscon_systemctl(systemd_logind_t)
|
||
|
|
')
|
||
|
|
')
|