# # Config file for XSELinux extension # ############################################################################## # # # Each entry in this file has a different label that is based on their # # Object Name for testing a basic policy that is explained in: # # The SELinux Notebook - The Foundations # # # # This version (x_contexts-base.conf-new-polylabels) does not have # # polyinstantiated entries. For testing X non-polyinstantiated objects, # # use the x_contexts-base.conf-new-labels file. # # # ############################################################################## # # ## ### Rules for X Clients ## # # # The default client rule defines a context to be used for all clients # connecting to the server from a remote host. # client * system_u:object_r:remote_xclient_t # ## ### Rules for X Properties ## # # # Property rules map a property name to a context. A default property # rule indicated by an asterisk should follow all other property rules. # # Polyinstantiated entries # Properties that normal clients may only read poly_property XFree86_VT system_u:object_r:xfree86_vt_xproperty_t poly_property XFree86_DDC_EDID1_RAWDATA system_u:object_r:xfree86_ddc_edid1_rawdata_xproperty_t poly_property RESOURCE_MANAGER system_u:object_r:resource_manager_xproperty_t poly_property SCREEN_RESOURCES system_u:object_r:screen_resources_xproperty_t poly_property _MIT_PRIORITY_COLORS system_u:object_r:mit_priority_colors_xproperty_t poly_property AT_SPI_IOR system_u:object_r:at_spi_ior_xproperty_t poly_property _SELINUX_CLIENT_CONTEXT system_u:object_r:selinux_client_context_xproperty_t poly_property _NET_WORKAREA system_u:object_r:net_workarea_xproperty_t # Need to remove poly_property from this as it stops some keys working on keyboard !!! property _XKB_RULES_NAMES system_u:object_r:xkb_rules_names_xproperty_t # Clipboard and selection properties poly_property CUT_BUFFER0 system_u:object_r:cut_buffer0_xproperty_t poly_property CUT_BUFFER1 system_u:object_r:cut_buffer1_xproperty_t poly_property CUT_BUFFER2 system_u:object_r:cut_buffer2_xproperty_t poly_property CUT_BUFFER3 system_u:object_r:cut_buffer3_xproperty_t poly_property CUT_BUFFER4 system_u:object_r:cut_buffer4_xproperty_t poly_property CUT_BUFFER5 system_u:object_r:cut_buffer5_xproperty_t poly_property CUT_BUFFER6 system_u:object_r:cut_buffer6_xproperty_t poly_property CUT_BUFFER7 system_u:object_r:cut_buffer7_xproperty_t # Don't really need these as if not defined they will default to the # Default fallback type below. # Added these as they are used by the XSetWMProperties function call: poly_property WM_NAME system_u:object_r:wm_name_xproperty_t poly_property WM_ICON_NAME system_u:object_r:wm_incon_name_xproperty_t poly_property WM_HINTS system_u:object_r:wm_hints_xproperty_t poly_property WM_NORMAL_HINTS system_u:object_r:wm_normal_hints_xproperty_t poly_property WM_CLASS system_u:object_r:wm_class_xproperty_t poly_property WM_COMMAND system_u:object_r:wm_command_xproperty_t poly_property WM_CLIENT_MACHINE system_u:object_r:wm_client_machine_xproperty_t # Add XA_STRING: poly_property STRING system_u:object_r:string_xproperty_t # As each Window has its own properties it is important to make sure # the undefined_xproperty_t is transitioned to the correct type when # building a module that uses 'derived' types (see x_derived_test.conf). # Default fallback type poly_property * system_u:object_r:undefined_xproperty_t # ## ### Rules for X Extensions ## # # # Extension rules map an extension name to a context. A default extension # rule indicated by an asterisk should follow all other extension rules. # # Standard extensions extension BIG-REQUESTS system_u:object_r:big-requests_xextension_t extension SHAPE system_u:object_r:shape_xextension_t extension SYNC system_u:object_r:sync_xextension_t extension XC-MISC system_u:object_r:xc-misc_xextension_t extension XFIXES system_u:object_r:xfixes_xextension_t extension XInputExtension system_u:object_r:xinputextension_xextension_t extension XKEYBOARD system_u:object_r:xkeyboard_xextension_t extension DAMAGE system_u:object_r:damage_xextension_t extension RENDER system_u:object_r:render_xextension_t extension XINERAMA system_u:object_r:xinerama_xextension_t # Direct hardware access extensions extension XFree86-DGA system_u:object_r:xfree86-dga_xextension_t extension XFree86-VidModeExtension system_u:object_r:xfree86-vidmodeextension_xextension_t # Screen management and multihead extensions extension RANDR system_u:object_r:randr_xextension_t extension Composite system_u:object_r:composite_xextension_t # Screensaver, power management extensions extension DPMS system_u:object_r:dpms_xextension_t extension MIT-SCREEN-SAVER system_u:object_r:mit-screen-saver_xextension_t # Shared memory extensions extension MIT-SHM system_u:object_r:mit-shm_xextension_t extension XFree86-Bigfont system_u:object_r:xfree86-bigfont_xextension_t # Accelerated graphics, OpenGL, direct rendering extensions extension GLX system_u:object_r:glx_xextension_t extension NV-CONTROL system_u:object_r:nv-control_xextension_t extension NV-GLX system_u:object_r:nv-glx_xextension_t extension NVIDIA-GLX system_u:object_r:nvidia-glx_xextension_t # Debugging, testing, and recording extensions extension RECORD system_u:object_r:record_xextension_t extension X-Resource system_u:object_r:x-resource_xextension_t extension XTEST system_u:object_r:xtest_xextension_t # Security-related extensions extension SECURITY system_u:object_r:security_xextension_t extension SELinux system_u:object_r:selinux_xextension_t extension XAccessControlExtension system_u:object_r:xaccesscontrolextension_xextension_t extension XC-APPGROUP system_u:object_r:xc-appgroup_xextension_t # Video extensions extension XVideo system_u:object_r:xvideo_xextension_t extension XVideo-MotionCompensation system_u:object_r:xvideo-motioncompensation_xextension_t # Default fallback type extension * system_u:object_r:undefined_xextension_t # ## ### Rules for X Selections ## # # Selection rules map a selection name to a context. A default selection # rule indicated by an asterisk should follow all other selection rules. # # Polyinstantiated entries # Standard selections poly_selection XA_PRIMARY system_u:object_r:xa_primary_xselection_t poly_selection XA_SECONDARY system_u:object_r:xa_secondary_xselection_t poly_selection PRIMARY system_u:object_r:primary_xselection_t poly_selection CLIPBOARD system_u:object_r:clipboard_xselection_t # Default fallback type poly_selection * system_u:object_r:undefined_xselection_t # ## ### Rules for X Events ## # # # Event rules map an event protocol name to a context. A default event # rule indicated by an asterisk should follow all other event rules. # # Input events event X11:KeyPress system_u:object_r:x11_keypress_xevent_t event X11:KeyRelease system_u:object_r:x11_keyrelease_xevent_t event X11:ButtonPress system_u:object_r:x11_buttonpress_xevent_t event X11:ButtonRelease system_u:object_r:x11_buttonrelease_xevent_t event X11:MotionNotify system_u:object_r:x11_motionnotify_xevent_t event X11:SelectionNotify system_u:object_r:x11_selectionnotify_xevent_t # Added two additional selection events: event X11:SelectionRequest system_u:object_r:x11_selectionrequest_xevent_t event X11:SelectionClear system_u:object_r:x11_selectionclear_xevent_t event XInputExtension:DeviceKeyPress system_u:object_r:xinputextension_devicekeypress_xevent_t event XInputExtension:DeviceKeyRelease system_u:object_r:xinputextension_devicekeyrelease_xevent_t event XInputExtension:DeviceButtonPress system_u:object_r:xinputextension_devicebuttonpress_xevent_t event XInputExtension:DeviceButtonRelease system_u:object_r:xinputextension_devicebuttonrelease_xevent_t event XInputExtension:DeviceMotionNotify system_u:object_r:xinputextensionext_devicemotionnotify_xevent_t event XInputExtension:DeviceValuator system_u:object_r:xinputextension_devicevaluator_xevent_t event XInputExtension:ProximityIn system_u:object_r:xinputextension_proximityin_xevent_t event XInputExtension:ProximityOut system_u:object_r:xinputextension_proximityout_xevent_t # Focus events event X11:FocusIn system_u:object_r:x11_foucusin_xevent_t event X11:FocusOut system_u:object_r:x11_focusout_xevent_t event X11:EnterNotify system_u:object_r:x11_enternotify_xevent_t event X11:LeaveNotify system_u:object_r:x11_leavenotify_xevent_t # Property events event X11:PropertyNotify system_u:object_r:x11_propertynotify_xevent_t # Client message events event X11:ClientMessage system_u:object_r:x11_clientmessage_xevent_t # Manager events event X11:ConfigureRequest system_u:object_r:x11_configurerequest_xevent_t event X11:ResizeRequest system_u:object_r:x11_resizerequest_xevent_t event X11:MapRequest system_u:object_r:x11_maprequest_xevent_t event X11:CirculateRequest system_u:object_r:x11_circulaterequest_xevent_t event X11:CreateNotify system_u:object_r:x11_createnotify_xevent_t event X11:DestroyNotify system_u:object_r:x11_destroynotify_xevent_t event X11:MapNotify system_u:object_r:x11_mapnotify_xevent_t event X11:UnmapNotify system_u:object_r:x11_unmapnotify_xevent_t event X11:ReparentNotify system_u:object_r:x11_reparentnotify_xevent_t event X11:ConfigureNotify system_u:object_r:x11_confignotify_xevent_t event X11:GravityNotify system_u:object_r:x11_gravitynotify_xevent_t event X11:CirculateNotify system_u:object_r:x11_circulatenotify_xevent_t event X11:Expose system_u:object_r:x11_expose_xevent_t event X11:VisibilityNotify system_u:object_r:x11_visibilitynotify_xevent_t # Unknown events (that are not registered in the X server's name database) event system_u:object_r:unknown_xevent_t # Default fallback type event * system_u:object_r:undefined_xevent_t