X Windows Server
false
Allows clients to write to the X server shared memory segments.
false
Allows XServer to execute writable memory
false
Allow xdm logins as sysadm
false
Support X userspace object manager
Interface to provide X object permissions on a given X server to an X client domain. Provides the minimal set required by a basic X client application.
Parameter: | Description: |
---|---|
domain |
Client domain allowed access. |
Rules required for using the X Windows server and environment.
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
domain |
Domain allowed access. |
Create a named socket in a XDM temporary directory.
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Do not audit attempts to write the X server log files.
Parameter: | Description: |
---|---|
domain |
Domain to not audit |
Execute the X server in the X server domain.
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Transition to the Xauthority domain.
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
dontaudit getattr xdm temporary named sockets.
Parameter: | Description: |
---|---|
domain |
Domain to not audit |
Do not audit attempts to read xdm temporary files.
Parameter: | Description: |
---|---|
domain |
Domain to not audit |
Do not audit attempts to read and write X server unix domain stream sockets.
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Do not audit attempts to read and write to X server sockets.
Parameter: | Description: |
---|---|
domain |
Domain to not audit |
Dontaudit write to .xsession-errors file
Parameter: | Description: |
---|---|
domain |
Domain to not audit |
Do not audit attempts to read and write XDM unnamed pipes.
Parameter: | Description: |
---|---|
domain |
Domain to not audit. |
Do not audit attempts to inherit XDM file descriptors.
Parameter: | Description: |
---|---|
domain |
Domain to not audit. |
Do not audit attempts to write the X server log files.
Parameter: | Description: |
---|---|
domain |
Domain to not audit |
Make an X executable an entrypoint for the specified domain.
Parameter: | Description: |
---|---|
domain |
The domain for which the shell is an entrypoint. |
Execute xserver files created in /var/run
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Get the attributes of X server logs.
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Get the attributes of xauth executable
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Kill X servers
Parameter: | Description: |
---|---|
domain |
Domain to not audit |
Read user homedir fonts.
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Read XDM var lib files.
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Manage XDM pid files.
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Create, read, write, and delete xdm temporary files.
Parameter: | Description: |
---|---|
domain |
Domain to not audit |
Ptrace XDM
Parameter: | Description: |
---|---|
domain |
Domain to not audit |
Read user homedir fonts.
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Read xserver files created in /var/run
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Read X server temporary files.
Parameter: | Description: |
---|---|
domain |
Domain to not audit |
Read all users .Xauthority.
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Read XDM var lib files.
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Read XDM pid files.
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Read xdm-writable configuration files.
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Read xdm temporary files.
Parameter: | Description: |
---|---|
domain |
Domain to not audit |
Read X keyboard extension libraries.
Parameter: | Description: |
---|---|
domain |
Domain to not audit |
Create sessions on the X server, with read-only access to the X server shared memory segments.
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
tmpfs_type |
The type of the domain SYSV tmpfs files. |
Rules required for using the X Windows server and environment.
Parameter: | Description: |
---|---|
role |
Role allowed access. |
domain |
Domain allowed access. |
Execute xsever in the xserver domain, and allow the specified role the xserver domain.
Parameter: | Description: |
---|---|
domain |
The type of the process performing this action. |
role |
The role to be allowed the xserver domain. |
Read and write the X windows console named pipe.
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Create sessions on the X server, with read and write access to the X server shared memory segments.
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
tmpfs_type |
The type of the domain SYSV tmpfs files. |
Read and write X server Sys V Shared memory segments.
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
write to .xsession-errors file
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Read and write XDM unnamed pipes.
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Read write xdm temporary files.
Parameter: | Description: |
---|---|
domain |
Domain to not audit |
Search XDM var lib dirs.
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Set the attributes of the X windows console named pipes.
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Set the attributes of XDM temporary directories.
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Signal X servers
Parameter: | Description: |
---|---|
domain |
Domain to not audit |
Connect to the X server over a unix domain stream socket.
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Connect to XDM over a unix domain stream socket.
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Interface to provide X object permissions on a given X server to an X client domain. Gives the domain complete control over the display.
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Read all users fonts, user font configurations, and manage all users font caches.
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Read user fonts, user font configuration, and manage the user font cache.
Read user fonts, user font configuration, and manage the user font cache.
This is a templated interface, and should only be called from a per-userdomain template.
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Interface to provide X object permissions on a given X server to an X client domain. Provides the minimal set required by a basic X client application.
Parameter: | Description: |
---|---|
domain |
Client domain allowed access. |
Use file descriptors for xdm.
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Create full client sessions on a user X server.
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
tmpfs_type |
The type of the domain SYSV tmpfs files. |
Create a Xauthority file in the user home directory.
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Write xserver files created in /var/run
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Allow append the xdm log files.
Parameter: | Description: |
---|---|
domain |
Domain to not audit |
Send and receive messages from xdm over dbus.
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Manage the xdm_spool files
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Connect to apmd over an unix stream socket.
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Make an X session script an entrypoint for the specified domain.
Parameter: | Description: |
---|---|
domain |
The domain for which the shell is an entrypoint. |
Execute an X session in the target domain. This is an explicit transition, requiring the caller to use setexeccon().
Execute an Xsession in the target domain. This is an explicit transition, requiring the caller to use setexeccon().
No interprocess communication (signals, pipes, etc.) is provided by this interface since the domains are not owned by this module.
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
target_domain |
The type of the shell process. |
Interface to provide X object permissions on a given X server to an X client domain. Provides the minimal set required by a basic X client application.
Parameter: | Description: |
---|---|
prefix |
The prefix of the X client domain (e.g., user is the prefix for user_t). |
domain |
Client domain allowed access. |
Template for creating the set of types used in an X windows domain.
Parameter: | Description: |
---|---|
prefix |
The prefix of the X client domain (e.g., user is the prefix for user_t). |
Read a user Iceauthority domain.
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Interface to provide X object permissions on a given X server to an X client domain. Provides the minimal set required by a basic X client application.
Parameter: | Description: |
---|---|
prefix |
The prefix of the X client domain (e.g., user is the prefix for user_t). |
domain |
Client domain allowed access. |
tmpfs_type |
The type of the domain SYSV tmpfs files. |