
policy_module(vino, 1.0.0) 

########################################
#
# Vino server personal declarations.
#

type vino_server_t;
type vino_server_exec_t;
application_domain(vino_server_t, vino_server_exec_t)
ubac_constrained(vino_server_t)

type vino_server_data_home_t;
userdom_user_home_content(vino_server_data_home_t)

type vino_server_tmp_t;
files_tmp_file(vino_server_tmp_t)
ubac_constrained(vino_server_tmp_t)

type vino_server_tmpfs_t;
files_tmpfs_file(vino_server_tmpfs_t)
ubac_constrained(vino_server_tmpfs_t)

#tcp:26570-26575

########################################
#
# Vino server personal policy.
#

allow vino_server_t self:process { getsched signal signull };
allow vino_server_t self:fifo_file rw_fifo_file_perms;
allow vino_server_t self:netlink_route_socket create_netlink_socket_perms;
allow vino_server_t self:shm create_shm_perms;
allow vino_server_t self:tcp_socket create_stream_socket_perms;
allow vino_server_t self:udp_socket create_stream_socket_perms;
allow vino_server_t self:unix_dgram_socket create_socket_perms;
allow vino_server_t self:unix_stream_socket create_socket_perms;

# ~/.local/share/vino/vino-server.lock.
optional_policy(`
	manage_dirs_pattern(vino_server_t, vino_server_data_home_t, vino_server_data_home_t)
	manage_files_pattern(vino_server_t, vino_server_data_home_t, vino_server_data_home_t)
	gnome_data_filetrans(vino_server_t, vino_server_data_home_t, { dir file })
')

manage_sock_files_pattern(vino_server_t, vino_server_tmp_t, vino_server_tmp_t)
files_tmp_filetrans(vino_server_t, vino_server_tmp_t, sock_file)

manage_files_pattern(vino_server_t, vino_server_tmpfs_t, vino_server_tmpfs_t)
fs_tmpfs_filetrans(vino_server_t, vino_server_tmpfs_t, file)

corenet_all_recvfrom_netlabel(vino_server_t)
corenet_all_recvfrom_unlabeled(vino_server_t)
corenet_sendrecv_http_client_packets(vino_server_t)
corenet_sendrecv_vnc_server_packets(vino_server_t)
corenet_tcp_bind_generic_node(vino_server_t)
corenet_tcp_bind_vnc_port(vino_server_t)
corenet_tcp_connect_http_port(vino_server_t)
corenet_tcp_sendrecv_generic_if(vino_server_t)
corenet_tcp_sendrecv_generic_node(vino_server_t)
corenet_tcp_sendrecv_generic_port(vino_server_t)

# /usr/bin/vino-preferences
corecmd_exec_bin(vino_server_t)

dev_read_urand(vino_server_t)

# /etc/nsswitch.conf
files_read_etc_files(vino_server_t)
files_read_usr_files(vino_server_t)

fs_getattr_tmpfs(vino_server_t)
fs_search_auto_mountpoints(vino_server_t)

kernel_read_network_state(vino_server_t)

miscfiles_read_localization(vino_server_t)

sysnet_read_config(vino_server_t)

# We need a non-generic type for ~/.icons
userdom_dontaudit_read_user_home_content_files(vino_server_t)

userdom_stream_connect(vino_server_t)
userdom_use_user_terminals(vino_server_t)
userdom_read_user_tmpfs_files(vino_server_t)
# Bug: user pulseaudio files need open,read and unlink:
allow vino_server_t user_tmpfs_t:file unlink;
userdom_signull_unpriv_users(vino_server_t)
# This sucks: we need a type for orbit-$USER so that we can do a gnome_orbit_filetrans()
# avc:  denied  { create } for  pid=5641 comm="vino-server" name="linc-1609-0-1586984db4146" 
# scontext=staff_u:staff_r:vino_server_t:s0 tcontext=staff_u:object_r:user_tmp_t:s0 tclass=sock_file
userdom_manage_user_tmp_sockets(vino_server_t)
# orbit-$USER dir.
userdom_setattr_user_tmp_dirs(vino_server_t)

tunable_policy(`use_nfs_home_dirs', `
	fs_manage_nfs_dirs(vino_server_t)
	fs_manage_nfs_files(vino_server_t)
	fs_manage_nfs_named_sockets(vino_server_t)
')

tunable_policy(`use_samba_home_dirs', `
	fs_manage_cifs_dirs(vino_server_t)
	fs_manage_cifs_files(vino_server_t)
	fs_manage_cifs_named_sockets(vino_server_t)
')

optional_policy(`
	automount_dontaudit_getattr_tmp_dirs(vino_server_t)
')

optional_policy(`
	dbus_system_bus_client(vino_server_t)
')

optional_policy(`
	gnome_rw_generic_cache(vino_server_t)
')

optional_policy(`
	nis_use_ypbind(vino_server_t)
')

optional_policy(`
	pulseaudio_stream_connect(vino_server_t)
	pulseaudio_signull(vino_server_t)
	pulseaudio_rw_home_files(vino_server_t)
')

optional_policy(`
	telepathy_gabble_dbus_chat(vino_server_t)
')

optional_policy(`
	xserver_user_x_domain_template(vino_server, vino_server_t, vino_server_tmpfs_t)
')
