diff options
author | Eamon Walsh <ewalsh@tycho.nsa.gov> | 2009-10-14 21:17:46 -0400 |
---|---|---|
committer | Eamon Walsh <ewalsh@tycho.nsa.gov> | 2009-10-14 21:17:46 -0400 |
commit | e26957d0cd937a6433f980c7384f0290c0c579b3 (patch) | |
tree | 050c9caf4229d2f8618204cb295419a74b36fcb0 | |
parent | e81a665ef210845911d2b03bcca4f6a05cb367d0 (diff) |
xselinux: switch from x_device to separate x_pointer and x_keyboard classes.
This will allow separate controls over pointer and keyboard without having
to relabel the devices to separate types.
[Backport to 1.6]
Signed-off-by: Eamon Walsh <ewalsh@tycho.nsa.gov>
-rw-r--r-- | Xext/xselinux.c | 18 | ||||
-rw-r--r-- | Xext/xselinux.h | 13 |
2 files changed, 22 insertions, 9 deletions
diff --git a/Xext/xselinux.c b/Xext/xselinux.c index 238bdb5d5..9d6343684 100644 --- a/Xext/xselinux.c +++ b/Xext/xselinux.c | |||
@@ -147,7 +147,8 @@ static struct security_class_mapping map[] = { | |||
147 | { "x_selection", { "read", "", "", "setattr", "getattr", "setattr", NULL }}, | 147 | { "x_selection", { "read", "", "", "setattr", "getattr", "setattr", NULL }}, |
148 | { "x_cursor", { "read", "write", "destroy", "create", "getattr", "setattr", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "use", NULL }}, | 148 | { "x_cursor", { "read", "write", "destroy", "create", "getattr", "setattr", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "use", NULL }}, |
149 | { "x_client", { "", "", "destroy", "", "getattr", "setattr", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "manage", NULL }}, | 149 | { "x_client", { "", "", "destroy", "", "getattr", "setattr", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "manage", NULL }}, |
150 | { "x_device", { "read", "write", "", "", "getattr", "setattr", "", "", "", "getfocus", "setfocus", "", "", "", "", "", "", "grab", "freeze", "force_cursor", "", "", "", "", "use", "manage", "", "bell", NULL }}, | 150 | { "x_pointer", { "read", "write", "", "", "getattr", "setattr", "", "", "", "getfocus", "setfocus", "", "", "", "", "", "", "grab", "freeze", "force_cursor", "", "", "", "", "use", "manage", "", "bell", NULL }}, |
151 | { "x_keyboard", { "read", "write", "", "", "getattr", "setattr", "", "", "", "getfocus", "setfocus", "", "", "", "", "", "", "grab", "freeze", "force_cursor", "", "", "", "", "use", "manage", "", "bell", NULL }}, | ||
151 | { "x_server", { "record", "", "", "", "getattr", "setattr", "", "", "", "", "", "", "", "", "", "", "", "grab", "", "", "", "", "", "", "", "manage", "debug", NULL }}, | 152 | { "x_server", { "record", "", "", "", "getattr", "setattr", "", "", "", "", "", "", "", "", "", "", "", "grab", "", "", "", "", "", "", "", "manage", "debug", NULL }}, |
152 | { "x_extension", { "", "", "", "", "query", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "use", NULL }}, | 153 | { "x_extension", { "", "", "", "", "query", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "use", NULL }}, |
153 | { "x_event", { "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "send", "receive", NULL }}, | 154 | { "x_event", { "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "send", "receive", NULL }}, |
@@ -428,6 +429,16 @@ SELinuxTypeToClass(RESTYPE type) | |||
428 | } | 429 | } |
429 | 430 | ||
430 | /* | 431 | /* |
432 | * Returns true if device is a pointer device. | ||
433 | * Note: this duplicates dix IsPointerDevice() which is not exported. | ||
434 | */ | ||
435 | static inline Bool | ||
436 | IsPointerDev(DeviceIntPtr dev) | ||
437 | { | ||
438 | return (dev->valuator && dev->button); | ||
439 | } | ||
440 | |||
441 | /* | ||
431 | * Performs an SELinux permission check. | 442 | * Performs an SELinux permission check. |
432 | */ | 443 | */ |
433 | static int | 444 | static int |
@@ -690,6 +701,7 @@ SELinuxDevice(CallbackListPtr *pcbl, pointer unused, pointer calldata) | |||
690 | SELinuxSubjectRec *subj; | 701 | SELinuxSubjectRec *subj; |
691 | SELinuxObjectRec *obj; | 702 | SELinuxObjectRec *obj; |
692 | SELinuxAuditRec auditdata = { .client = rec->client, .dev = rec->dev }; | 703 | SELinuxAuditRec auditdata = { .client = rec->client, .dev = rec->dev }; |
704 | security_class_t cls; | ||
693 | int rc; | 705 | int rc; |
694 | 706 | ||
695 | subj = dixLookupPrivate(&rec->client->devPrivates, subjectKey); | 707 | subj = dixLookupPrivate(&rec->client->devPrivates, subjectKey); |
@@ -714,8 +726,8 @@ SELinuxDevice(CallbackListPtr *pcbl, pointer unused, pointer calldata) | |||
714 | } | 726 | } |
715 | } | 727 | } |
716 | 728 | ||
717 | rc = SELinuxDoCheck(subj, obj, SECCLASS_X_DEVICE, rec->access_mode, | 729 | cls = IsPointerDev(rec->dev) ? SECCLASS_X_POINTER : SECCLASS_X_KEYBOARD; |
718 | &auditdata); | 730 | rc = SELinuxDoCheck(subj, obj, cls, rec->access_mode, &auditdata); |
719 | if (rc != Success) | 731 | if (rc != Success) |
720 | rec->status = rc; | 732 | rec->status = rc; |
721 | } | 733 | } |
diff --git a/Xext/xselinux.h b/Xext/xselinux.h index 7c3ffdcb7..a9f39ffe5 100644 --- a/Xext/xselinux.h +++ b/Xext/xselinux.h | |||
@@ -149,11 +149,12 @@ typedef struct { | |||
149 | #define SECCLASS_X_SELECTION 7 | 149 | #define SECCLASS_X_SELECTION 7 |
150 | #define SECCLASS_X_CURSOR 8 | 150 | #define SECCLASS_X_CURSOR 8 |
151 | #define SECCLASS_X_CLIENT 9 | 151 | #define SECCLASS_X_CLIENT 9 |
152 | #define SECCLASS_X_DEVICE 10 | 152 | #define SECCLASS_X_POINTER 10 |
153 | #define SECCLASS_X_SERVER 11 | 153 | #define SECCLASS_X_KEYBOARD 11 |
154 | #define SECCLASS_X_EXTENSION 12 | 154 | #define SECCLASS_X_SERVER 12 |
155 | #define SECCLASS_X_EVENT 13 | 155 | #define SECCLASS_X_EXTENSION 13 |
156 | #define SECCLASS_X_FAKEEVENT 14 | 156 | #define SECCLASS_X_EVENT 14 |
157 | #define SECCLASS_X_RESOURCE 15 | 157 | #define SECCLASS_X_FAKEEVENT 15 |
158 | #define SECCLASS_X_RESOURCE 16 | ||
158 | 159 | ||
159 | #endif /* _XSELINUX_H */ | 160 | #endif /* _XSELINUX_H */ |