Layer: services

Module: xserver

Tunables Interfaces Templates

Description:

X Windows Server


Tunables:

allow_write_xshm
Default value

false

Description

Allows clients to write to the X server shared memory segments.

allow_xserver_execmem
Default value

false

Description

Allows XServer to execute writable memory

xdm_sysadm_login
Default value

false

Description

Allow xdm logins as sysadm

xserver_object_manager
Default value

false

Description

Support X userspace object manager

Return

Interfaces:

xserver_common_app( domain )
Summary

Interface to provide X object permissions on a given X server to an X client domain. Provides the minimal set required by a basic X client application.

Parameters
Parameter:Description:
domain

Client domain allowed access.

xserver_communicate( domain , domain )
Summary

Rules required for using the X Windows server and environment.

Parameters
Parameter:Description:
domain

Domain allowed access.

domain

Domain allowed access.

xserver_create_xdm_tmp_sockets( domain )
Summary

Create a named socket in a XDM temporary directory.

Parameters
Parameter:Description:
domain

Domain allowed access.

xserver_delete_log( domain )
Summary

Do not audit attempts to write the X server log files.

Parameters
Parameter:Description:
domain

Domain to not audit

xserver_domtrans( domain )
Summary

Execute the X server in the X server domain.

Parameters
Parameter:Description:
domain

Domain allowed access.

xserver_domtrans_xauth( domain )
Summary

Transition to the Xauthority domain.

Parameters
Parameter:Description:
domain

Domain allowed access.

xserver_dontaudit_getattr_xdm_tmp_sockets( domain )
Summary

dontaudit getattr xdm temporary named sockets.

Parameters
Parameter:Description:
domain

Domain to not audit

xserver_dontaudit_read_xdm_tmp_files( domain )
Summary

Do not audit attempts to read xdm temporary files.

Parameters
Parameter:Description:
domain

Domain to not audit

xserver_dontaudit_rw_stream_sockets( domain )
Summary

Do not audit attempts to read and write X server unix domain stream sockets.

Parameters
Parameter:Description:
domain

Domain allowed access.

xserver_dontaudit_rw_tcp_sockets( domain )
Summary

Do not audit attempts to read and write to X server sockets.

Parameters
Parameter:Description:
domain

Domain to not audit

xserver_dontaudit_rw_xdm_home_files( domain )
Summary

Dontaudit write to .xsession-errors file

Parameters
Parameter:Description:
domain

Domain to not audit

xserver_dontaudit_rw_xdm_pipes( domain )
Summary

Do not audit attempts to read and write XDM unnamed pipes.

Parameters
Parameter:Description:
domain

Domain to not audit.

xserver_dontaudit_use_xdm_fds( domain )
Summary

Do not audit attempts to inherit XDM file descriptors.

Parameters
Parameter:Description:
domain

Domain to not audit.

xserver_dontaudit_write_log( domain )
Summary

Do not audit attempts to write the X server log files.

Parameters
Parameter:Description:
domain

Domain to not audit

xserver_entry_type( domain )
Summary

Make an X executable an entrypoint for the specified domain.

Parameters
Parameter:Description:
domain

The domain for which the shell is an entrypoint.

xserver_exec_pid( domain )
Summary

Execute xserver files created in /var/run

Parameters
Parameter:Description:
domain

Domain allowed access.

xserver_getattr_log( domain )
Summary

Get the attributes of X server logs.

Parameters
Parameter:Description:
domain

Domain allowed access.

xserver_getattr_xauth( domain )
Summary

Get the attributes of xauth executable

Parameters
Parameter:Description:
domain

Domain allowed access.

xserver_kill( domain )
Summary

Kill X servers

Parameters
Parameter:Description:
domain

Domain to not audit

xserver_manage_home_fonts( domain )
Summary

Read user homedir fonts.

Parameters
Parameter:Description:
domain

Domain allowed access.

xserver_manage_xdm_lib_files( domain )
Summary

Read XDM var lib files.

Parameters
Parameter:Description:
domain

Domain allowed access.

xserver_manage_xdm_pid( domain )
Summary

Manage XDM pid files.

Parameters
Parameter:Description:
domain

Domain allowed access.

xserver_manage_xdm_tmp_files( domain )
Summary

Create, read, write, and delete xdm temporary files.

Parameters
Parameter:Description:
domain

Domain to not audit

xserver_ptrace_xdm( domain )
Summary

Ptrace XDM

Parameters
Parameter:Description:
domain

Domain to not audit

xserver_read_home_fonts( domain )
Summary

Read user homedir fonts.

Parameters
Parameter:Description:
domain

Domain allowed access.

xserver_read_pid( domain )
Summary

Read xserver files created in /var/run

Parameters
Parameter:Description:
domain

Domain allowed access.

xserver_read_tmp_files( domain )
Summary

Read X server temporary files.

Parameters
Parameter:Description:
domain

Domain to not audit

xserver_read_user_xauth( domain )
Summary

Read all users .Xauthority.

Parameters
Parameter:Description:
domain

Domain allowed access.

xserver_read_xdm_lib_files( domain )
Summary

Read XDM var lib files.

Parameters
Parameter:Description:
domain

Domain allowed access.

xserver_read_xdm_pid( domain )
Summary

Read XDM pid files.

Parameters
Parameter:Description:
domain

Domain allowed access.

xserver_read_xdm_rw_config( domain )
Summary

Read xdm-writable configuration files.

Parameters
Parameter:Description:
domain

Domain allowed access.

xserver_read_xdm_tmp_files( domain )
Summary

Read xdm temporary files.

Parameters
Parameter:Description:
domain

Domain to not audit

xserver_read_xkb_libs( domain )
Summary

Read X keyboard extension libraries.

Parameters
Parameter:Description:
domain

Domain to not audit

xserver_ro_session( domain , tmpfs_type )
Summary

Create sessions on the X server, with read-only access to the X server shared memory segments.

Parameters
Parameter:Description:
domain

Domain allowed access.

tmpfs_type

The type of the domain SYSV tmpfs files.

xserver_role( role , domain )
Summary

Rules required for using the X Windows server and environment.

Parameters
Parameter:Description:
role

Role allowed access.

domain

Domain allowed access.

xserver_run( domain , role )
Summary

Execute xsever in the xserver domain, and allow the specified role the xserver domain.

Parameters
Parameter:Description:
domain

The type of the process performing this action.

role

The role to be allowed the xserver domain.

xserver_rw_console( domain )
Summary

Read and write the X windows console named pipe.

Parameters
Parameter:Description:
domain

Domain allowed access.

xserver_rw_session( domain , tmpfs_type )
Summary

Create sessions on the X server, with read and write access to the X server shared memory segments.

Parameters
Parameter:Description:
domain

Domain allowed access.

tmpfs_type

The type of the domain SYSV tmpfs files.

xserver_rw_shm( domain )
Summary

Read and write X server Sys V Shared memory segments.

Parameters
Parameter:Description:
domain

Domain allowed access.

xserver_rw_xdm_home_files( domain )
Summary

write to .xsession-errors file

Parameters
Parameter:Description:
domain

Domain allowed access.

xserver_rw_xdm_pipes( domain )
Summary

Read and write XDM unnamed pipes.

Parameters
Parameter:Description:
domain

Domain allowed access.

xserver_rw_xdm_tmp_files( domain )
Summary

Read write xdm temporary files.

Parameters
Parameter:Description:
domain

Domain to not audit

xserver_search_xdm_lib( domain )
Summary

Search XDM var lib dirs.

Parameters
Parameter:Description:
domain

Domain allowed access.

xserver_setattr_console_pipes( domain )
Summary

Set the attributes of the X windows console named pipes.

Parameters
Parameter:Description:
domain

Domain allowed access.

xserver_setattr_xdm_tmp_dirs( domain )
Summary

Set the attributes of XDM temporary directories.

Parameters
Parameter:Description:
domain

Domain allowed access.

xserver_signal( domain )
Summary

Signal X servers

Parameters
Parameter:Description:
domain

Domain to not audit

xserver_stream_connect( domain )
Summary

Connect to the X server over a unix domain stream socket.

Parameters
Parameter:Description:
domain

Domain allowed access.

xserver_stream_connect_xdm( domain )
Summary

Connect to XDM over a unix domain stream socket.

Parameters
Parameter:Description:
domain

Domain allowed access.

xserver_unconfined( domain )
Summary

Interface to provide X object permissions on a given X server to an X client domain. Gives the domain complete control over the display.

Parameters
Parameter:Description:
domain

Domain allowed access.

xserver_use_all_users_fonts( domain )
Summary

Read all users fonts, user font configurations, and manage all users font caches.

Parameters
Parameter:Description:
domain

Domain allowed access.

xserver_use_user_fonts( domain )
Summary

Read user fonts, user font configuration, and manage the user font cache.

Description

Read user fonts, user font configuration, and manage the user font cache.

This is a templated interface, and should only be called from a per-userdomain template.

Parameters
Parameter:Description:
domain

Domain allowed access.

xserver_use_xdm( domain )
Summary

Interface to provide X object permissions on a given X server to an X client domain. Provides the minimal set required by a basic X client application.

Parameters
Parameter:Description:
domain

Client domain allowed access.

xserver_use_xdm_fds( domain )
Summary

Use file descriptors for xdm.

Parameters
Parameter:Description:
domain

Domain allowed access.

xserver_user_client( domain , tmpfs_type )
Summary

Create full client sessions on a user X server.

Parameters
Parameter:Description:
domain

Domain allowed access.

tmpfs_type

The type of the domain SYSV tmpfs files.

xserver_user_home_dir_filetrans_user_xauth( domain )
Summary

Create a Xauthority file in the user home directory.

Parameters
Parameter:Description:
domain

Domain allowed access.

xserver_write_pid( domain )
Summary

Write xserver files created in /var/run

Parameters
Parameter:Description:
domain

Domain allowed access.

xserver_xdm_append_log( domain )
Summary

Allow append the xdm log files.

Parameters
Parameter:Description:
domain

Domain to not audit

xserver_xdm_dbus_chat( domain )
Summary

Send and receive messages from xdm over dbus.

Parameters
Parameter:Description:
domain

Domain allowed access.

xserver_xdm_manage_spool( domain )
Summary

Manage the xdm_spool files

Parameters
Parameter:Description:
domain

Domain allowed access.

xserver_xdm_stream_connect( domain )
Summary

Connect to apmd over an unix stream socket.

Parameters
Parameter:Description:
domain

Domain allowed access.

xserver_xsession_entry_type( domain )
Summary

Make an X session script an entrypoint for the specified domain.

Parameters
Parameter:Description:
domain

The domain for which the shell is an entrypoint.

xserver_xsession_spec_domtrans( domain , target_domain )
Summary

Execute an X session in the target domain. This is an explicit transition, requiring the caller to use setexeccon().

Description

Execute an Xsession in the target domain. This is an explicit transition, requiring the caller to use setexeccon().

No interprocess communication (signals, pipes, etc.) is provided by this interface since the domains are not owned by this module.

Parameters
Parameter:Description:
domain

Domain allowed access.

target_domain

The type of the shell process.

Return

Templates:

xserver_common_x_domain_template( prefix , domain )
Summary

Interface to provide X object permissions on a given X server to an X client domain. Provides the minimal set required by a basic X client application.

Parameters
Parameter:Description:
prefix

The prefix of the X client domain (e.g., user is the prefix for user_t).

domain

Client domain allowed access.

xserver_object_types_template( prefix )
Summary

Template for creating the set of types used in an X windows domain.

Parameters
Parameter:Description:
prefix

The prefix of the X client domain (e.g., user is the prefix for user_t).

xserver_read_user_iceauth( domain )
Summary

Read a user Iceauthority domain.

Parameters
Parameter:Description:
domain

Domain allowed access.

xserver_user_x_domain_template( prefix , domain , tmpfs_type )
Summary

Interface to provide X object permissions on a given X server to an X client domain. Provides the minimal set required by a basic X client application.

Parameters
Parameter:Description:
prefix

The prefix of the X client domain (e.g., user is the prefix for user_t).

domain

Client domain allowed access.

tmpfs_type

The type of the domain SYSV tmpfs files.

Return