Joe Nall wrote:
What other desktop related processes need MLS policies to be written
to get a minimally functional Fedora/Gnome enforcing X environment?
What window manager/environment do you use in your enforcing X
development and test?
Many AVC's I'm getting are caused by the fact that the server starts up
as xdm_xserver_t:
allow sysadm_t xdm_rootwindow_t:x_colormap { use install uninstall };
allow sysadm_t xdm_rootwindow_t:x_drawable { get_property show read manage add_child remove_child list_child hide setattr receive set_property create send write
allow sysadm_t xdm_xserver_t:x_device { setfocus use setattr grab manage getattr freeze };
allow sysadm_t xdm_xserver_t:x_screen { saver_setattr saver_getattr setattr };
allow sysadm_t xdm_xserver_t:x_server manage;
...and xdm_t windows are apparently still open on the display when the
user's gnome-session is run:
allow sysadm_t xdm_t:x_client destroy;
allow sysadm_t xdm_t:x_drawable { get_property receive getattr list_child };
allow sysadm_t xdm_xproperty_t:x_property { write read };
This week I attempted to write a prototype display manager that would
stop the X server and run a new one after the user logs in. However
this process looks incredibly ugly and takes forever, and I'm also
having trouble with the X server not starting up at all some of the
time, so I've given up on that for now.
I did get a patch into gdm this week though. Once libxcb-selinux is
released I'll be able to make patch for PAM to have it relabel X server
objects dynamically as part of pam_open_session.
I'll take a look at the window manager policy next week.
--
Eamon Walsh <ewalsh@xxxxxxxxxxxxx>
National Security Agency
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@xxxxxxxxxxxxx with
the words "unsubscribe selinux" without quotes as the message.
