Skip to content

Commit 1348d77

Browse files
WavyEbuilderWavyEbuilder
committed
wayland: new policy module
A new type attribute wayland_compositor is introduced for shared rules for Wayland compositors. To support the security-context protocol[1], two new type attributes are introduced: wayland_client for regular Wayland clients, and wayland_client_sandboxed for sandboxed Wayland clients for use in applications run by sandbox engines such as Flatpak that support security-context[2]. As a fair amount of new policy modules can be expected to work with modern Wayland desktop sessions, a new policy layer has be created, session, to contain these new policy modules. [1] https://wayland.app/protocols/security-context-v1 [2] flatpak/flatpak#4920 Signed-off-by: Rahul Sandhu <[email protected]>
1 parent 2e5804e commit 1348d77

File tree

4 files changed

+151
-0
lines changed

4 files changed

+151
-0
lines changed

‎policy/modules/session/metadata.xml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
<summary>Policy modules for desktop sessions.</summary>

‎policy/modules/session/wayland.fc‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
/run/user/%{USERID}/wayland-([0-9]+)? -s gen_context(system_u:object_r:wayland_runtime_t,s0)
2+
/run/user/%{USERID}/wayland-([0-9]+)?\.lock -- gen_context(system_u:object_r:wayland_runtime_t,s0)

‎policy/modules/session/wayland.if‎

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
## <summary>Policy for wayland desktops.</summary>
2+
3+
#########################################
4+
## <summary>
5+
## Manage the Wayland socket.
6+
## </summary>
7+
## <param name="domain">
8+
## <summary>
9+
## Domain allowed access.
10+
## </summary>
11+
## </param>
12+
#
13+
interface(`wayland_compositor_domain',`
14+
gen_require(`
15+
attribute wayland_compositor;
16+
')
17+
18+
typeattribute $1 wayland_compositor;
19+
')
20+
21+
#########################################
22+
## <summary>
23+
## Connect and talk over the Wayland
24+
## socket.
25+
## </summary>
26+
## <param name="domain">
27+
## <summary>
28+
## Domain allowed access.
29+
## </summary>
30+
## </param>
31+
## <param name="domain">
32+
## <summary>
33+
## Domain allowed access.
34+
## </summary>
35+
## </param>
36+
#
37+
interface(`wayland_client_domain',`
38+
gen_require(`
39+
attribute wayland_client;
40+
attribute wayland_client_tmpfs_type;
41+
')
42+
43+
typeattribute $1 wayland_client;
44+
typeattribute $2 wayland_client_tmpfs_type;
45+
')
46+
47+
#########################################
48+
## <summary>
49+
## Connect and talk over sandboxed
50+
## Wayland sockets.
51+
## </summary>
52+
## <param name="domain">
53+
## <summary>
54+
## Domain allowed access.
55+
## </summary>
56+
## </param>
57+
## <param name="domain">
58+
## <summary>
59+
## Domain allowed access.
60+
## </summary>
61+
## </param>
62+
#
63+
interface(`wayland_client_sandboxed_domain',`
64+
gen_require(`
65+
attribute wayland_client_sandboxed;
66+
attribute wayland_client_tmpfs_type;
67+
')
68+
69+
typeattribute $1 wayland_client_sandboxed;
70+
typeattribute $2 wayland_client_tmpfs_type;
71+
')

‎policy/modules/session/wayland.te‎

Lines changed: 77 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,77 @@
1+
policy_module(wayland)
2+
3+
########################################
4+
#
5+
# Declarations
6+
#
7+
8+
attribute wayland_compositor;
9+
attribute wayland_client;
10+
11+
# For use by clients only allowed to talk through security_context restricted sockets.
12+
attribute wayland_client_sandboxed;
13+
14+
type wayland_runtime_t;
15+
files_runtime_file(wayland_runtime_t)
16+
userdom_user_runtime_content(wayland_runtime_t)
17+
18+
# For use by sandbox engines implementing the security_context protocol.
19+
type wayland_runtime_sandboxed_t;
20+
files_runtime_file(wayland_runtime_t)
21+
userdom_user_runtime_content(wayland_runtime_t)
22+
23+
# No need to distinguish between the shm of sandboxed and unsandboxed clients;
24+
# all clients should have their own shm type, this attribute is only to group them
25+
# and grant wayland_compositor access to them.
26+
attribute wayland_client_tmpfs_type;
27+
28+
##############################
29+
#
30+
# Local Policy
31+
#
32+
33+
allow wayland_compositor wayland_client_tmpfs_type:file { mmap_rw_inherited_file_perms };
34+
allow wayland_compositor wayland_client:fd use;
35+
allow wayland_compositor wayland_client_sandboxed:fd use;
36+
37+
# Compositors may make more privileged sockets in $XDG_RUNTIME_DIR, so let's
38+
# hardcode in WAYLAND_DISPLAY so we can give other sockets created a higher level
39+
# of privilege (namebased filetransitions are not supported yet).
40+
userdom_user_runtime_filetrans(wayland_compositor, wayland_runtime_t, socket, "wayland-0")
41+
userdom_user_runtime_filetrans(wayland_compositor, wayland_runtime_t, socket, "wayland-1")
42+
userdom_user_runtime_filetrans(wayland_compositor, wayland_runtime_t, socket, "wayland-2")
43+
userdom_user_runtime_filetrans(wayland_compositor, wayland_runtime_t, socket, "wayland-3")
44+
userdom_user_runtime_filetrans(wayland_compositor, wayland_runtime_t, socket, "wayland-4")
45+
userdom_user_runtime_filetrans(wayland_compositor, wayland_runtime_t, socket, "wayland-5")
46+
userdom_user_runtime_filetrans(wayland_compositor, wayland_runtime_t, socket, "wayland-6")
47+
userdom_user_runtime_filetrans(wayland_compositor, wayland_runtime_t, socket, "wayland-7")
48+
userdom_user_runtime_filetrans(wayland_compositor, wayland_runtime_t, socket, "wayland-8")
49+
userdom_user_runtime_filetrans(wayland_compositor, wayland_runtime_t, socket, "wayland-9")
50+
userdom_user_runtime_filetrans(wayland_compositor, wayland_runtime_t, file, "wayland-0.lock")
51+
userdom_user_runtime_filetrans(wayland_compositor, wayland_runtime_t, file, "wayland-1.lock")
52+
userdom_user_runtime_filetrans(wayland_compositor, wayland_runtime_t, file, "wayland-2.lock")
53+
userdom_user_runtime_filetrans(wayland_compositor, wayland_runtime_t, file, "wayland-3.lock")
54+
userdom_user_runtime_filetrans(wayland_compositor, wayland_runtime_t, file, "wayland-4.lock")
55+
userdom_user_runtime_filetrans(wayland_compositor, wayland_runtime_t, file, "wayland-5.lock")
56+
userdom_user_runtime_filetrans(wayland_compositor, wayland_runtime_t, file, "wayland-6.lock")
57+
userdom_user_runtime_filetrans(wayland_compositor, wayland_runtime_t, file, "wayland-7.lock")
58+
userdom_user_runtime_filetrans(wayland_compositor, wayland_runtime_t, file, "wayland-8.lock")
59+
userdom_user_runtime_filetrans(wayland_compositor, wayland_runtime_t, file, "wayland-9.lock")
60+
61+
# GPU Access
62+
dev_rw_dri(wayland_compositor)
63+
64+
# For seats
65+
systemd_use_logind_fds(wayland_compositor)
66+
67+
# /dev/input
68+
dev_rw_input_dev(wayland_compositor)
69+
70+
files_read_usr_files(wayland_compositor)
71+
72+
# Fonts
73+
miscfiles_read_fonts(wayland_compositor)
74+
xserver_use_user_fonts(wayland_compositor)
75+
76+
xserver_read_xkb_libs(wayland_compositor)
77+
xserver_rw_mesa_shader_cache(wayland_compositor)

0 commit comments

Comments
 (0)