Skip to content

Commit 56496e5

Browse files
WavyEbuilderWavyEbuilder
committed
wayland: new policy module
A new type attribute wayland_compositor is introduced for shared rules for Wayland compositors. To support the security-context protocol[1], two new type attributes are introduced: wayland_client for regular Wayland clients, and wayland_client_sandboxed for sandboxed Wayland clients for use in applications run by sandbox engines such as Flatpak that support security-context[2]. As a fair amount of new policy modules can be expected to work with modern Wayland desktop sessions, a new policy layer has been created, session, to contain these new policy modules. [1] https://wayland.app/protocols/security-context-v1 [2] flatpak/flatpak#4920 Signed-off-by: Rahul Sandhu <[email protected]>
1 parent 2e5804e commit 56496e5

File tree

4 files changed

+166
-0
lines changed

4 files changed

+166
-0
lines changed

‎policy/modules/session/metadata.xml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
<summary>Policy modules for desktop sessions.</summary>

‎policy/modules/session/wayland.fc‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
/run/user/%{USERID}/wayland-[0-9]+ -s gen_context(system_u:object_r:wayland_runtime_t,s0)
2+
/run/user/%{USERID}/wayland-[0-9]+\.lock -- gen_context(system_u:object_r:wayland_runtime_t,s0)

‎policy/modules/session/wayland.if‎

Lines changed: 79 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,79 @@
1+
## <summary>Policy for wayland desktops.</summary>
2+
3+
#########################################
4+
## <summary>
5+
## Associate the specified domain with the
6+
## Wayland compositor attribute.
7+
## </summary>
8+
## <param name="domain">
9+
## <summary>
10+
## Domain allowed access.
11+
## </summary>
12+
## </param>
13+
## <param name="domain">
14+
## <summary>
15+
## Domain allowed access.
16+
## </summary>
17+
## </param>
18+
#
19+
interface(`wayland_compositor_domain',`
20+
gen_require(`
21+
attribute wayland_compositor;
22+
attribute wayland_compositor_tmpfs_type;
23+
')
24+
25+
typeattribute $1 wayland_compositor;
26+
typeattribute $2 wayland_compositor_tmpfs_type;
27+
')
28+
29+
#########################################
30+
## <summary>
31+
## Connect and talk over the Wayland
32+
## socket.
33+
## </summary>
34+
## <param name="domain">
35+
## <summary>
36+
## Domain allowed access.
37+
## </summary>
38+
## </param>
39+
## <param name="domain">
40+
## <summary>
41+
## Domain allowed access.
42+
## </summary>
43+
## </param>
44+
#
45+
interface(`wayland_client_domain',`
46+
gen_require(`
47+
attribute wayland_client;
48+
attribute wayland_client_tmpfs_type;
49+
')
50+
51+
typeattribute $1 wayland_client;
52+
typeattribute $2 wayland_client_tmpfs_type;
53+
')
54+
55+
#########################################
56+
## <summary>
57+
## Connect and talk over sandboxed
58+
## Wayland sockets.
59+
## </summary>
60+
## <param name="domain">
61+
## <summary>
62+
## Domain allowed access.
63+
## </summary>
64+
## </param>
65+
## <param name="domain">
66+
## <summary>
67+
## Domain allowed access.
68+
## </summary>
69+
## </param>
70+
#
71+
interface(`wayland_client_sandboxed_domain',`
72+
gen_require(`
73+
attribute wayland_client_sandboxed;
74+
attribute wayland_client_tmpfs_type;
75+
')
76+
77+
typeattribute $1 wayland_client_sandboxed;
78+
typeattribute $2 wayland_client_tmpfs_type;
79+
')

‎policy/modules/session/wayland.te‎

Lines changed: 84 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,84 @@
1+
policy_module(wayland)
2+
3+
########################################
4+
#
5+
# Declarations
6+
#
7+
8+
attribute wayland_compositor;
9+
attribute wayland_client;
10+
11+
# For use by clients only allowed to talk through security_context restricted sockets.
12+
attribute wayland_client_sandboxed;
13+
14+
type wayland_runtime_t;
15+
files_runtime_file(wayland_runtime_t)
16+
userdom_user_runtime_content(wayland_runtime_t)
17+
18+
# For use by sandbox engines implementing the security_context protocol.
19+
type wayland_runtime_sandboxed_t;
20+
files_runtime_file(wayland_runtime_t)
21+
userdom_user_runtime_content(wayland_runtime_sandboxed_t)
22+
23+
# Wayland compositors also have their own shared memory.
24+
attribute wayland_compositor_tmpfs_type;
25+
26+
# No need to distinguish between the shm of sandboxed and unsandboxed clients;
27+
# all clients should have their own shm type, this attribute is only to group them
28+
# and grant wayland_compositor access to them.
29+
attribute wayland_client_tmpfs_type;
30+
31+
##############################
32+
#
33+
# Local Policy
34+
#
35+
36+
allow wayland_client wayland_compositor_tmpfs_type:file { mmap_rw_inherited_file_perms };
37+
38+
allow wayland_compositor wayland_client_tmpfs_type:file { mmap_rw_inherited_file_perms };
39+
allow wayland_compositor wayland_client:fd use;
40+
allow wayland_compositor wayland_client_sandboxed:fd use;
41+
42+
# Compositors may make more privileged sockets in $XDG_RUNTIME_DIR, so let's
43+
# hardcode in WAYLAND_DISPLAY so we can give other sockets created a higher level
44+
# of privilege (namebased filetransitions are not supported yet).
45+
userdom_user_runtime_filetrans(wayland_compositor, wayland_runtime_t, sock_file, "wayland-0")
46+
userdom_user_runtime_filetrans(wayland_compositor, wayland_runtime_t, sock_file, "wayland-1")
47+
userdom_user_runtime_filetrans(wayland_compositor, wayland_runtime_t, sock_file, "wayland-2")
48+
userdom_user_runtime_filetrans(wayland_compositor, wayland_runtime_t, sock_file, "wayland-3")
49+
userdom_user_runtime_filetrans(wayland_compositor, wayland_runtime_t, sock_file, "wayland-4")
50+
userdom_user_runtime_filetrans(wayland_compositor, wayland_runtime_t, sock_file, "wayland-5")
51+
userdom_user_runtime_filetrans(wayland_compositor, wayland_runtime_t, sock_file, "wayland-6")
52+
userdom_user_runtime_filetrans(wayland_compositor, wayland_runtime_t, sock_file, "wayland-7")
53+
userdom_user_runtime_filetrans(wayland_compositor, wayland_runtime_t, sock_file, "wayland-8")
54+
userdom_user_runtime_filetrans(wayland_compositor, wayland_runtime_t, sock_file, "wayland-9")
55+
userdom_user_runtime_filetrans(wayland_compositor, wayland_runtime_t, file, "wayland-0.lock")
56+
userdom_user_runtime_filetrans(wayland_compositor, wayland_runtime_t, file, "wayland-1.lock")
57+
userdom_user_runtime_filetrans(wayland_compositor, wayland_runtime_t, file, "wayland-2.lock")
58+
userdom_user_runtime_filetrans(wayland_compositor, wayland_runtime_t, file, "wayland-3.lock")
59+
userdom_user_runtime_filetrans(wayland_compositor, wayland_runtime_t, file, "wayland-4.lock")
60+
userdom_user_runtime_filetrans(wayland_compositor, wayland_runtime_t, file, "wayland-5.lock")
61+
userdom_user_runtime_filetrans(wayland_compositor, wayland_runtime_t, file, "wayland-6.lock")
62+
userdom_user_runtime_filetrans(wayland_compositor, wayland_runtime_t, file, "wayland-7.lock")
63+
userdom_user_runtime_filetrans(wayland_compositor, wayland_runtime_t, file, "wayland-8.lock")
64+
userdom_user_runtime_filetrans(wayland_compositor, wayland_runtime_t, file, "wayland-9.lock")
65+
66+
# GPU Access
67+
dev_rw_dri(wayland_compositor)
68+
69+
# /dev/input
70+
dev_rw_input_dev(wayland_compositor)
71+
72+
files_read_usr_files(wayland_compositor)
73+
74+
# Fonts
75+
miscfiles_read_fonts(wayland_compositor)
76+
xserver_use_user_fonts(wayland_compositor)
77+
78+
xserver_read_xkb_libs(wayland_compositor)
79+
xserver_rw_mesa_shader_cache(wayland_compositor)
80+
81+
optional_policy(`
82+
# For seats
83+
systemd_use_logind_fds(wayland_compositor)
84+
')

0 commit comments

Comments
 (0)