commit: 82dbbae293b2fe9a7a5f85590ea17dc1916ee529
Author: Dave Sugar <dsugar <AT> tresys <DOT> com>
AuthorDate: Thu Jan 28 22:13:57 2021 +0000
Commit: Jason Zaman <perfinion <AT> gentoo <DOT> org>
CommitDate: Mon Feb 1 01:21:42 2021 +0000
URL:
https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=82dbbae2
Work with xdg module disabled
These two cases I see when building on a system without graphical interface.
Move userdom_xdg_user_template into optional block
gpg module doesn't require a graphical front end, move xdg_read_data_files into
optional block
Signed-off-by: Dave Sugar <dsugar <AT> tresys.com>
Signed-off-by: Jason Zaman <perfinion <AT> gentoo.org>
policy/modules/apps/gpg.te | 6 ++++--
policy/modules/system/userdomain.if | 8 +++++---
2 files changed, 9 insertions(+), 5 deletions(-)
diff --git a/policy/modules/apps/gpg.te b/policy/modules/apps/gpg.te
index cfdb685a..376e1a9f 100644
--- a/policy/modules/apps/gpg.te
+++ b/policy/modules/apps/gpg.te
@@ -359,8 +359,6 @@ miscfiles_read_localization(gpg_pinentry_t)
userdom_use_user_terminals(gpg_pinentry_t)
-xdg_read_data_files(gpg_pinentry_t)
-
tunable_policy(`use_nfs_home_dirs',`
fs_read_nfs_files(gpg_pinentry_t)
')
@@ -382,6 +380,10 @@ optional_policy(`
pulseaudio_run(gpg_pinentry_t, gpg_pinentry_roles)
')
+optional_policy(`
+ xdg_read_data_files(gpg_pinentry_t)
+')
+
optional_policy(`
xserver_user_x_domain_template(gpg_pinentry, gpg_pinentry_t,
gpg_pinentry_tmpfs_t)
')
diff --git a/policy/modules/system/userdomain.if
b/policy/modules/system/userdomain.if
index 01135696..e14bdc01 100644
--- a/policy/modules/system/userdomain.if
+++ b/policy/modules/system/userdomain.if
@@ -1194,9 +1194,6 @@ template(`userdom_unpriv_user_template', `
fs_exec_noxattr($1_t)
')
- # Allow users to manage xdg content in their home directories
- userdom_xdg_user_template($1)
-
# Allow users to run TCP servers (bind to ports and accept connection
from
# the same domain and outside users) disabling this forces FTP passive
mode
# and may change other protocols
@@ -1239,6 +1236,11 @@ template(`userdom_unpriv_user_template', `
systemd_write_inherited_logind_inhibit_pipes($1_t)
')
+ # Allow users to manage xdg content in their home directories
+ optional_policy(`
+ userdom_xdg_user_template($1)
+ ')
+
# Allow controlling usbguard
optional_policy(`
tunable_policy(`usbguard_user_modify_rule_files',`
