module x_context_base 1.0.0;
#
##########################################################################
#                                                                        #
# This Loadable Module will allow the X-Windows OM to label objects      #
# using the sample x_contexts files that form part of the test examples: #
#     x_contexts-file-with-new-labels                                    #
#     x_contexts-file-with-new-polylabels                                #
#                                                                        #
##########################################################################
#

require {
	type unconfined_t;
	class x_property { create destroy read write append getattr setattr };
	class x_selection { read write getattr setattr };
	class x_extension { query use };
	class x_event { send receive };
	class x_synthetic_event { send receive };
}	

#
########################## START TYPES ##########################
#
# The default client rule defines a context to be used for all clients
# connecting to the server from a remote host.
#
type remote_xclient_t;

#
##
### Rules for X Properties
##
#

#
# Property rules map a property name to a context.  A default property
# rule indicated by an asterisk should follow all other property rules.
#
# Properties that normal clients may only read
type xfree86_vt_xproperty_t;
type xfree86_ddc_edid1_rawdata_xproperty_t;
type resource_manager_xproperty_t;
type screen_resources_xproperty_t;
type mit_priority_colors_xproperty_t;
type at_spi_ior_xproperty_t;
type selinux_client_context_xproperty_t;
type net_workarea_xproperty_t;
type xkb_rules_names_xproperty_t;

# Clipboard and selection properties
type cut_buffer0_xproperty_t;
type cut_buffer1_xproperty_t;
type cut_buffer2_xproperty_t;
type cut_buffer3_xproperty_t;
type cut_buffer4_xproperty_t;
type cut_buffer5_xproperty_t;
type cut_buffer6_xproperty_t;
type cut_buffer7_xproperty_t;

# Added these as they are used by the XSetWMProperties function call:
type wm_name_xproperty_t;
type wm_incon_name_xproperty_t;
type wm_hints_xproperty_t;
type wm_normal_hints_xproperty_t;
type wm_class_xproperty_t;
type wm_command_xproperty_t;
type wm_client_machine_xproperty_t;

# Add XA_STRING:
type string_xproperty_t;

# Default fallback type
type undefined_xproperty_t;

#
##
### Rules for X Extensions
##
#

#
# Extension rules map an extension name to a context.  A default extension
# rule indicated by an asterisk should follow all other extension rules.
#
# Standard extensions
type big-requests_xextension_t;
type shape_xextension_t;
type sync_xextension_t;
type xc-misc_xextension_t;
type xfixes_xextension_t;
type xinputextension_xextension_t;
type xkeyboard_xextension_t;
type damage_xextension_t;
type render_xextension_t;
type xinerama_xextension_t;

# Direct hardware access extensions
type xfree86-dga_xextension_t;
type xfree86-vidmodeextension_xextension_t;

# Screen management and multihead extensions
type randr_xextension_t;
type composite_xextension_t;

# Screensaver, power management extensions
type dpms_xextension_t;
type mit-screen-saver_xextension_t;

# Shared memory extensions
type mit-shm_xextension_t;
type xfree86-bigfont_xextension_t;

# Accelerated graphics, OpenGL, direct rendering extensions
type glx_xextension_t;
type nv-control_xextension_t;
type nv-glx_xextension_t;
type nvidia-glx_xextension_t;

# Debugging, testing, and recording extensions
type record_xextension_t;
type x-resource_xextension_t;
type xtest_xextension_t;

# Security-related extensions
type security_xextension_t;
type selinux_xextension_t;
type xaccesscontrolextension_xextension_t;
type xc-appgroup_xextension_t;

# Video extensions
type xvideo_xextension_t;
type xvideo-motioncompensation_xextension_t;

# Default fallback type
type undefined_xextension_t;

#
##
### Rules for X Selections
##
#

# Selection rules map a selection name to a context.  A default selection
# rule indicated by an asterisk should follow all other selection rules.
#
# Standard selections
type xa_primary_xselection_t;
type xa_secondary_xselection_t;
type primary_xselection_t;
type clipboard_xselection_t;

# Default fallback type
type undefined_xselection_t;


#
##
### Rules for X Events
##
#

#
# Event rules map an event protocol name to a context.  A default event
# rule indicated by an asterisk should follow all other event rules.
#
# Input events
type x11_keypress_xevent_t;
type x11_keyrelease_xevent_t;
type x11_buttonpress_xevent_t;
type x11_buttonrelease_xevent_t;
type x11_motionnotify_xevent_t;
type x11_selectionnotify_xevent_t;
type xinputextension_devicekeypress_xevent_t;
type xinputextension_devicekeyrelease_xevent_t;
type xinputextension_devicebuttonpress_xevent_t;
type xinputextension_devicebuttonrelease_xevent_t;
type xinputextensionext_devicemotionnotify_xevent_t;
type xinputextension_devicevaluator_xevent_t;
type xinputextension_proximityin_xevent_t;
type xinputextension_proximityout_xevent_t;

# Focus events
type x11_foucusin_xevent_t;
type x11_focusout_xevent_t;
type x11_enternotify_xevent_t;
type x11_leavenotify_xevent_t;

# Property events
type x11_propertynotify_xevent_t;
# Added two additional selection events:
type x11_selectionrequest_xevent_t;
type x11_selectionclear_xevent_t;

# Client message events
type x11_clientmessage_xevent_t;

# Manager events
type x11_configurerequest_xevent_t;
type x11_resizerequest_xevent_t;
type x11_maprequest_xevent_t;
type x11_circulaterequest_xevent_t;
type x11_createnotify_xevent_t;
type x11_destroynotify_xevent_t;
type x11_mapnotify_xevent_t;
type x11_unmapnotify_xevent_t;
type x11_reparentnotify_xevent_t;
type x11_confignotify_xevent_t;
type x11_gravitynotify_xevent_t;
type x11_circulatenotify_xevent_t;
type x11_expose_xevent_t;
type x11_visibilitynotify_xevent_t;

# Unknown events (that are not registered in the X server's name database)
type unknown_xevent_t;

# Default fallback type
type undefined_xevent_t;

#
########################### END TYPES ##########################
#

#
##################### START ALLOW RULES ########################
#

#
# The default client rule defines a context to be used for all clients
# connecting to the server from a remote host.
#
# Does not need an allow rule as no remote clients
# remote_xclient_t;


#
##
### Rules for X Properties
##
#

#
# Property rules map a property name to a context.  A default property
# rule indicated by an asterisk should follow all other property rules.
#
# Properties that normal clients may only read
allow unconfined_t xfree86_vt_xproperty_t : x_property *;
allow unconfined_t xfree86_ddc_edid1_rawdata_xproperty_t : x_property *;
allow unconfined_t resource_manager_xproperty_t : x_property *;
allow unconfined_t screen_resources_xproperty_t : x_property *;
allow unconfined_t mit_priority_colors_xproperty_t : x_property *;
allow unconfined_t at_spi_ior_xproperty_t : x_property *;
allow unconfined_t selinux_client_context_xproperty_t : x_property *;
allow unconfined_t net_workarea_xproperty_t : x_property *;
allow unconfined_t xkb_rules_names_xproperty_t : x_property *;

# Clipboard and selection properties
allow unconfined_t cut_buffer0_xproperty_t : x_property *;
allow unconfined_t cut_buffer1_xproperty_t : x_property *;
allow unconfined_t cut_buffer2_xproperty_t : x_property *;
allow unconfined_t cut_buffer3_xproperty_t : x_property *;
allow unconfined_t cut_buffer4_xproperty_t : x_property *;
allow unconfined_t cut_buffer5_xproperty_t : x_property *;
allow unconfined_t cut_buffer6_xproperty_t : x_property *;
allow unconfined_t cut_buffer7_xproperty_t : x_property *;

# Added these as they are used by the XSetWMProperties function call:
allow unconfined_t wm_name_xproperty_t : x_property *;
allow unconfined_t wm_incon_name_xproperty_t : x_property *;
allow unconfined_t wm_hints_xproperty_t : x_property *;
allow unconfined_t wm_normal_hints_xproperty_t : x_property *;
allow unconfined_t wm_class_xproperty_t : x_property *;
allow unconfined_t wm_command_xproperty_t : x_property *;
allow unconfined_t wm_client_machine_xproperty_t : x_property *;

# Add XA_STRING:
allow unconfined_t string_xproperty_t : x_property *;

# Default fallback type
allow unconfined_t undefined_xproperty_t : x_property *;


#
##
### Rules for X Extensions
##
#

#
# Extension rules map an extension name to a context.  A default extension
# rule indicated by an asterisk should follow all other extension rules.
#
# Standard extensions
allow unconfined_t big-requests_xextension_t : x_extension *;
allow unconfined_t shape_xextension_t : x_extension *;
allow unconfined_t sync_xextension_t : x_extension *;
allow unconfined_t xc-misc_xextension_t : x_extension *;
allow unconfined_t xfixes_xextension_t : x_extension *;
allow unconfined_t xinputextension_xextension_t : x_extension *;
allow unconfined_t xkeyboard_xextension_t : x_extension *;
allow unconfined_t damage_xextension_t : x_extension *;
allow unconfined_t render_xextension_t : x_extension *;
allow unconfined_t xinerama_xextension_t : x_extension *;

# Direct hardware access extensions
allow unconfined_t xfree86-dga_xextension_t : x_extension *;
allow unconfined_t xfree86-vidmodeextension_xextension_t : x_extension *;

# Screen management and multihead extensions
allow unconfined_t randr_xextension_t : x_extension *;
allow unconfined_t composite_xextension_t : x_extension *;

# Screensaver, power management extensions
allow unconfined_t dpms_xextension_t : x_extension *;
allow unconfined_t mit-screen-saver_xextension_t : x_extension *;

# Shared memory extensions
allow unconfined_t mit-shm_xextension_t : x_extension *;
allow unconfined_t xfree86-bigfont_xextension_t : x_extension *;

# Accelerated graphics, OpenGL, direct rendering extensions
allow unconfined_t glx_xextension_t : x_extension *;
allow unconfined_t nv-control_xextension_t : x_extension *;
allow unconfined_t nv-glx_xextension_t : x_extension *;
allow unconfined_t nvidia-glx_xextension_t : x_extension *;

# Debugging, testing, and recording extensions
allow unconfined_t record_xextension_t : x_extension *;
allow unconfined_t x-resource_xextension_t : x_extension *;
allow unconfined_t xtest_xextension_t : x_extension *;

# Security-related extensions
allow unconfined_t security_xextension_t : x_extension *;
allow unconfined_t selinux_xextension_t : x_extension *;
allow unconfined_t xaccesscontrolextension_xextension_t : x_extension *;
allow unconfined_t xc-appgroup_xextension_t : x_extension *;

# Video extensions
allow unconfined_t xvideo_xextension_t : x_extension *;
allow unconfined_t xvideo-motioncompensation_xextension_t : x_extension *;

# Default fallback type
allow unconfined_t undefined_xextension_t : x_extension *;


#
##
### Rules for X Selections
##
#

# Selection rules map a selection name to a context.  A default selection
# rule indicated by an asterisk should follow all other selection rules.
#
# Standard selections
allow unconfined_t xa_primary_xselection_t : x_selection *;
allow unconfined_t xa_secondary_xselection_t : x_selection *;
allow unconfined_t primary_xselection_t : x_selection *;
allow unconfined_t clipboard_xselection_t : x_selection *;

# Default fallback type
allow unconfined_t undefined_xselection_t : x_selection *;


#
##
### Rules for X Events
##
#

#
# Event rules map an event protocol name to a context.  A default event
# rule indicated by an asterisk should follow all other event rules.
#
# Input events
allow unconfined_t x11_keypress_xevent_t : x_event *;
allow unconfined_t x11_keyrelease_xevent_t : x_event *;
allow unconfined_t x11_buttonpress_xevent_t : x_event *;
allow unconfined_t x11_buttonrelease_xevent_t : x_event *;
allow unconfined_t x11_motionnotify_xevent_t : x_event *;
allow unconfined_t x11_selectionnotify_xevent_t : x_synthetic_event *;
allow unconfined_t xinputextension_devicekeypress_xevent_t : x_event *;
allow unconfined_t xinputextension_devicekeyrelease_xevent_t : x_event *;
allow unconfined_t xinputextension_devicebuttonpress_xevent_t : x_event *;
allow unconfined_t xinputextension_devicebuttonrelease_xevent_t : x_event *;
allow unconfined_t xinputextensionext_devicemotionnotify_xevent_t : x_event *;
allow unconfined_t xinputextension_devicevaluator_xevent_t : x_event *;
allow unconfined_t xinputextension_proximityin_xevent_t : x_event *;
allow unconfined_t xinputextension_proximityout_xevent_t : x_event *;

# Focus events
allow unconfined_t x11_foucusin_xevent_t : x_event *;
allow unconfined_t x11_focusout_xevent_t : x_event *;
allow unconfined_t x11_enternotify_xevent_t : x_event *;
allow unconfined_t x11_leavenotify_xevent_t : x_event *;

# Property events
allow unconfined_t x11_propertynotify_xevent_t : x_event *;
# Added two additional selection events:
allow unconfined_t x11_selectionrequest_xevent_t : x_event *;
allow unconfined_t x11_selectionclear_xevent_t : x_event *;

# Client message events
allow unconfined_t x11_clientmessage_xevent_t : x_synthetic_event *;

# Manager events
allow unconfined_t x11_configurerequest_xevent_t : x_event *;
allow unconfined_t x11_resizerequest_xevent_t : x_event *;
allow unconfined_t x11_maprequest_xevent_t : x_event *;
allow unconfined_t x11_circulaterequest_xevent_t : x_event *;
allow unconfined_t x11_createnotify_xevent_t : x_event *;
allow unconfined_t x11_destroynotify_xevent_t : x_event *;
allow unconfined_t x11_mapnotify_xevent_t : x_event *;
allow unconfined_t x11_unmapnotify_xevent_t : x_synthetic_event *;
allow unconfined_t x11_unmapnotify_xevent_t : x_event *;
allow unconfined_t x11_reparentnotify_xevent_t : x_event *;
allow unconfined_t x11_confignotify_xevent_t : x_synthetic_event *;
allow unconfined_t x11_confignotify_xevent_t : x_event *;
allow unconfined_t x11_gravitynotify_xevent_t : x_event *;
allow unconfined_t x11_circulatenotify_xevent_t : x_event *;
allow unconfined_t x11_expose_xevent_t : x_event *;
allow unconfined_t x11_visibilitynotify_xevent_t : x_event *;

# Unknown events (that are not registered in the X server's name database)
allow unconfined_t unknown_xevent_t : x_event *;

# Default fallback type
allow unconfined_t undefined_xevent_t : x_event *;

#
##################### END ALLOW RULES ########################
#