Skip to content

Commit ea8e486

Browse files
WavyEbuilderWavyEbuilder
committed
wayland: new policy module
A new type attribute wayland_compositor is introduced for shared rules for Wayland compositors. To support the security-context protocol[1], two new type attributes are introduced: wayland_client for regular Wayland clients, and wayland_client_sandboxed for sandboxed Wayland clients for use in applications run by sandbox engines such as Flatpak that support security-context[2]. As a fair amount of new policy modules can be expected to work with modern Wayland desktop sessions, a new policy layer has been created, session, to contain these new policy modules. [1] https://wayland.app/protocols/security-context-v1 [2] flatpak/flatpak#4920 Signed-off-by: Rahul Sandhu <[email protected]>
1 parent 2e5804e commit ea8e486

File tree

4 files changed

+188
-0
lines changed

4 files changed

+188
-0
lines changed

‎policy/modules/session/metadata.xml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
<summary>Policy modules for desktop sessions.</summary>

‎policy/modules/session/wayland.fc‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
/run/user/%{USERID}/wayland-[0-9]+ -s gen_context(system_u:object_r:wayland_runtime_t,s0)
2+
/run/user/%{USERID}/wayland-[0-9]+\.lock -- gen_context(system_u:object_r:wayland_runtime_t,s0)

‎policy/modules/session/wayland.if‎

Lines changed: 101 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,101 @@
1+
## <summary>Policy for wayland desktops.</summary>
2+
3+
#########################################
4+
## <summary>
5+
## Associate the specified domain with
6+
## the Wayland compositor attribute.
7+
## </summary>
8+
## <param name="domain">
9+
## <summary>
10+
## Domain allowed access.
11+
## </summary>
12+
## </param>
13+
#
14+
interface(`wayland_compositor_domain',`
15+
gen_require(`
16+
attribute wayland_compositor;
17+
')
18+
19+
typeattribute $1 wayland_compositor;
20+
')
21+
22+
#########################################
23+
## <summary>
24+
## Associate the specified domain with the
25+
## Wayland compositor tmpfs attribute.
26+
## </summary>
27+
## <param name="domain">
28+
## <summary>
29+
## Domain allowed access.
30+
## </summary>
31+
## </param>
32+
#
33+
interface(`wayland_compositor_tmpfs',`
34+
gen_require(`
35+
attribute wayland_compositor_tmpfs_type;
36+
')
37+
38+
typeattribute $1 wayland_compositor_tmpfs_type;
39+
')
40+
41+
#########################################
42+
## <summary>
43+
## Associate the specified domain with
44+
## the Wayland client attribute.
45+
## </summary>
46+
## <param name="domain">
47+
## <summary>
48+
## Domain allowed access.
49+
## </summary>
50+
## </param>
51+
#
52+
interface(`wayland_client_domain',`
53+
gen_require(`
54+
attribute wayland_client;
55+
')
56+
57+
typeattribute $1 wayland_client;
58+
')
59+
60+
#########################################
61+
## <summary>
62+
## Associate the specified domain with the
63+
## Wayland client tmpfs attribute.
64+
## </summary>
65+
## <param name="domain">
66+
## <summary>
67+
## Domain allowed access.
68+
## </summary>
69+
## </param>
70+
#
71+
interface(`wayland_client_tmpfs',`
72+
gen_require(`
73+
attribute wayland_client_tmpfs_type;
74+
')
75+
76+
typeattribute $1 wayland_client_tmpfs_type;
77+
')
78+
79+
#########################################
80+
## <summary>
81+
## Associate the specified domain with
82+
## the Wayland client sandboxed attribute.
83+
## </summary>
84+
## <param name="domain">
85+
## <summary>
86+
## Domain allowed access.
87+
## </summary>
88+
## </param>
89+
## <param name="domain">
90+
## <summary>
91+
## Domain allowed access.
92+
## </summary>
93+
## </param>
94+
#
95+
interface(`wayland_client_sandboxed_domain',`
96+
gen_require(`
97+
attribute wayland_client_sandboxed;
98+
')
99+
100+
typeattribute $1 wayland_client_sandboxed;
101+
')

‎policy/modules/session/wayland.te‎

Lines changed: 84 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,84 @@
1+
policy_module(wayland)
2+
3+
########################################
4+
#
5+
# Declarations
6+
#
7+
8+
attribute wayland_compositor;
9+
attribute wayland_client;
10+
11+
# For use by clients only allowed to talk through security_context restricted sockets.
12+
attribute wayland_client_sandboxed;
13+
14+
type wayland_runtime_t;
15+
files_runtime_file(wayland_runtime_t)
16+
userdom_user_runtime_content(wayland_runtime_t)
17+
18+
# For use by sandbox engines implementing the security_context protocol.
19+
type wayland_runtime_sandboxed_t;
20+
files_runtime_file(wayland_runtime_t)
21+
userdom_user_runtime_content(wayland_runtime_sandboxed_t)
22+
23+
# Wayland compositors also have their own shared memory.
24+
attribute wayland_compositor_tmpfs_type;
25+
26+
# No need to distinguish between the shm of sandboxed and unsandboxed clients;
27+
# all clients should have their own shm type, this attribute is only to group them
28+
# and grant wayland_compositor access to them.
29+
attribute wayland_client_tmpfs_type;
30+
31+
##############################
32+
#
33+
# Local Policy
34+
#
35+
36+
allow wayland_client wayland_compositor_tmpfs_type:file mmap_rw_inherited_file_perms;
37+
38+
allow wayland_compositor wayland_client_tmpfs_type:file mmap_rw_inherited_file_perms;
39+
allow wayland_compositor wayland_client:fd use;
40+
allow wayland_compositor wayland_client_sandboxed:fd use;
41+
42+
# Compositors may make more privileged sockets in $XDG_RUNTIME_DIR, so let's
43+
# hardcode in WAYLAND_DISPLAY so we can give other sockets created a higher level
44+
# of privilege (namebased filetransitions are not supported yet).
45+
userdom_user_runtime_filetrans(wayland_compositor, wayland_runtime_t, sock_file, "wayland-0")
46+
userdom_user_runtime_filetrans(wayland_compositor, wayland_runtime_t, sock_file, "wayland-1")
47+
userdom_user_runtime_filetrans(wayland_compositor, wayland_runtime_t, sock_file, "wayland-2")
48+
userdom_user_runtime_filetrans(wayland_compositor, wayland_runtime_t, sock_file, "wayland-3")
49+
userdom_user_runtime_filetrans(wayland_compositor, wayland_runtime_t, sock_file, "wayland-4")
50+
userdom_user_runtime_filetrans(wayland_compositor, wayland_runtime_t, sock_file, "wayland-5")
51+
userdom_user_runtime_filetrans(wayland_compositor, wayland_runtime_t, sock_file, "wayland-6")
52+
userdom_user_runtime_filetrans(wayland_compositor, wayland_runtime_t, sock_file, "wayland-7")
53+
userdom_user_runtime_filetrans(wayland_compositor, wayland_runtime_t, sock_file, "wayland-8")
54+
userdom_user_runtime_filetrans(wayland_compositor, wayland_runtime_t, sock_file, "wayland-9")
55+
userdom_user_runtime_filetrans(wayland_compositor, wayland_runtime_t, file, "wayland-0.lock")
56+
userdom_user_runtime_filetrans(wayland_compositor, wayland_runtime_t, file, "wayland-1.lock")
57+
userdom_user_runtime_filetrans(wayland_compositor, wayland_runtime_t, file, "wayland-2.lock")
58+
userdom_user_runtime_filetrans(wayland_compositor, wayland_runtime_t, file, "wayland-3.lock")
59+
userdom_user_runtime_filetrans(wayland_compositor, wayland_runtime_t, file, "wayland-4.lock")
60+
userdom_user_runtime_filetrans(wayland_compositor, wayland_runtime_t, file, "wayland-5.lock")
61+
userdom_user_runtime_filetrans(wayland_compositor, wayland_runtime_t, file, "wayland-6.lock")
62+
userdom_user_runtime_filetrans(wayland_compositor, wayland_runtime_t, file, "wayland-7.lock")
63+
userdom_user_runtime_filetrans(wayland_compositor, wayland_runtime_t, file, "wayland-8.lock")
64+
userdom_user_runtime_filetrans(wayland_compositor, wayland_runtime_t, file, "wayland-9.lock")
65+
66+
# GPU Access
67+
dev_rw_dri(wayland_compositor)
68+
69+
# /dev/input
70+
dev_rw_input_dev(wayland_compositor)
71+
72+
files_read_usr_files(wayland_compositor)
73+
74+
# Fonts
75+
miscfiles_read_fonts(wayland_compositor)
76+
xserver_use_user_fonts(wayland_compositor)
77+
78+
xserver_read_xkb_libs(wayland_compositor)
79+
xserver_rw_mesa_shader_cache(wayland_compositor)
80+
81+
optional_policy(`
82+
# For seats
83+
systemd_use_logind_fds(wayland_compositor)
84+
')

0 commit comments

Comments
 (0)