Merge pull request #935 from etbe/phone

phone

Author: pebenito

policy/modules/services/eg25manager.te

@@ -34,6 +34,7 @@ allow eg25manager_t self:process { getsched setsched signal };
 allow eg25manager_t self:tcp_socket { connect create getattr getopt read setopt write };
 allow eg25manager_t self:udp_socket { connect create getattr read setopt write };
 allow eg25manager_t self:unix_dgram_socket { create write };
+allow eg25manager_t self:fifo_file rw_fifo_file_perms;
 
 files_tmp_filetrans(eg25manager_t, eg25manager_tmp_t, { file })
 allow eg25manager_t eg25manager_tmp_t:file manage_file_perms;

policy/modules/services/geoclue.te

@@ -20,16 +20,27 @@ files_type(geoclue_var_lib_t)
 # Local policy
 #
 
+allow geoclue_t self:process getsched;
+
 read_files_pattern(geoclue_t, geoclue_etc_t, geoclue_etc_t)
+allow geoclue_t geoclue_etc_t:dir list_dir_perms;
+
+allow geoclue_t geoclue_var_lib_t:dir rw_dir_perms;
 
 kernel_read_kernel_sysctls(geoclue_t)
+kernel_read_net_sysctls(geoclue_t)
+kernel_read_system_state(geoclue_t)
 
 corenet_tcp_connect_http_port(geoclue_t)
 
 dev_read_urand(geoclue_t)
 
 auth_use_nsswitch(geoclue_t)
 
+files_read_usr_files(geoclue_t)
+files_map_usr_files(geoclue_t)
+files_watch_etc_dirs(geoclue_t)
+
 logging_send_syslog_msg(geoclue_t)
 
 miscfiles_read_generic_certs(geoclue_t)
@@ -50,3 +61,12 @@ optional_policy(`
 optional_policy(`
 	modemmanager_dbus_chat(geoclue_t)
 ')
+
+optional_policy(`
+	unconfined_dbus_send(geoclue_t)
+')
+
+optional_policy(`
+	xserver_dbus_chat_xdm(geoclue_t)
+	xserver_read_xdm_state(geoclue_t)
+')

policy/modules/services/gpsd.te

@@ -29,7 +29,7 @@ files_tmpfs_file(gpsd_tmpfs_t)
 
 allow gpsd_t self:capability { fowner fsetid setgid setuid sys_nice sys_time sys_tty_config };
 dontaudit gpsd_t self:capability { dac_override dac_read_search };
-allow gpsd_t self:process { setsched signal_perms };
+allow gpsd_t self:process { getsession setsched signal_perms };
 allow gpsd_t self:shm create_shm_perms;
 allow gpsd_t self:unix_dgram_socket sendto;
 allow gpsd_t self:tcp_socket { accept listen };

policy/modules/services/modemmanager.te

@@ -19,7 +19,7 @@ allow modemmanager_t self:process { getsched setpgid setsched signal };
 allow modemmanager_t self:fifo_file rw_fifo_file_perms;
 allow modemmanager_t self:unix_stream_socket { connectto create_stream_socket_perms };
 allow modemmanager_t self:netlink_kobject_uevent_socket create_socket_perms;
-allow modemmanager_t self:netlink_route_socket { create getattr getopt nlmsg_write read write };
+allow modemmanager_t self:netlink_route_socket { create_socket_perms nlmsg_write };
 allow modemmanager_t self:qipcrtr_socket { create getattr getopt read write };
 
 # ModemManager  calls mmap(PROT_READ|PROT_WRITE|PROT_EXEC)