From 5c6753167fe78f9ef88203360babb53a50ae4b5d Mon Sep 17 00:00:00 2001
From: Eamon Walsh <ewalsh@tycho.nsa.gov>
Date: Tue, 22 Sep 2009 13:31:49 -0700
Subject: xselinux: switch from x_device to separate x_pointer and x_keyboard
 classes.

This will allow separate controls over pointer and keyboard without having
to relabel the devices to separate types.

Signed-off-by: Eamon Walsh <ewalsh@tycho.nsa.gov>
---
 Xext/xselinux_hooks.c | 15 +++++++++++++--
 Xext/xselinuxint.h    | 45 ++++++++++++++++++++++++++++++++++++++-------
 2 files changed, 51 insertions(+), 9 deletions(-)

(limited to 'Xext')

diff --git a/Xext/xselinux_hooks.c b/Xext/xselinux_hooks.c
index fe534880b..fd2bfcfdf 100644
--- a/Xext/xselinux_hooks.c
+++ b/Xext/xselinux_hooks.c
@@ -86,6 +86,16 @@ static void SELinuxScreen(CallbackListPtr *, pointer, pointer);
 static pointer truep = (pointer)1;
 
 
+/*
+ * Returns true if device is a pointer device.
+ * Note: this duplicates dix IsPointerDevice() which is not exported.
+ */
+static inline Bool
+IsPointerDev(DeviceIntPtr dev)
+{
+    return (dev->type == MASTER_POINTER) || (dev->valuator && dev->button);
+}
+
 /*
  * Performs an SELinux permission check.
  */
@@ -348,6 +358,7 @@ SELinuxDevice(CallbackListPtr *pcbl, pointer unused, pointer calldata)
     SELinuxSubjectRec *subj;
     SELinuxObjectRec *obj;
     SELinuxAuditRec auditdata = { .client = rec->client, .dev = rec->dev };
+    security_class_t cls;
     int rc;
 
     subj = dixLookupPrivate(&rec->client->devPrivates, subjectKey);
@@ -372,8 +383,8 @@ SELinuxDevice(CallbackListPtr *pcbl, pointer unused, pointer calldata)
 	}
     }
 
-    rc = SELinuxDoCheck(subj, obj, SECCLASS_X_DEVICE, rec->access_mode,
-			&auditdata);
+    cls = IsPointerDev(rec->dev) ? SECCLASS_X_POINTER : SECCLASS_X_KEYBOARD;
+    rc = SELinuxDoCheck(subj, obj, cls, rec->access_mode, &auditdata);
     if (rc != Success)
 	rec->status = rc;
 }
diff --git a/Xext/xselinuxint.h b/Xext/xselinuxint.h
index d1b35bf89..854a57dd7 100644
--- a/Xext/xselinuxint.h
+++ b/Xext/xselinuxint.h
@@ -123,12 +123,13 @@ SELinuxFlaskReset(void);
 #define SECCLASS_X_SELECTION		7
 #define SECCLASS_X_CURSOR		8
 #define SECCLASS_X_CLIENT		9
-#define SECCLASS_X_DEVICE		10
-#define SECCLASS_X_SERVER		11
-#define SECCLASS_X_EXTENSION		12
-#define SECCLASS_X_EVENT		13
-#define SECCLASS_X_FAKEEVENT		14
-#define SECCLASS_X_RESOURCE		15
+#define SECCLASS_X_POINTER		10
+#define SECCLASS_X_KEYBOARD		11
+#define SECCLASS_X_SERVER		12
+#define SECCLASS_X_EXTENSION		13
+#define SECCLASS_X_EVENT		14
+#define SECCLASS_X_FAKEEVENT		15
+#define SECCLASS_X_RESOURCE		16
 
 #ifdef _XSELINUX_NEED_FLASK_MAP
 /* Mapping from DixAccess bits to Flask permissions */
@@ -344,7 +345,37 @@ static struct security_class_mapping map[] = {
           "",			/* DixUseAccess */
           "manage",		/* DixManageAccess */
           NULL }},
-    { "x_device",
+    { "x_pointer",
+        { "read",		/* DixReadAccess */
+          "write",		/* DixWriteAccess */
+          "destroy",		/* DixDestroyAccess */
+          "create",		/* DixCreateAccess */
+          "getattr",		/* DixGetAttrAccess */
+          "setattr",		/* DixSetAttrAccess */
+          "list_property",	/* DixListPropAccess */
+          "get_property",	/* DixGetPropAccess */
+          "set_property",	/* DixSetPropAccess */
+          "getfocus",		/* DixGetFocusAccess */
+          "setfocus",		/* DixSetFocusAccess */
+          "",			/* DixListAccess */
+          "add",		/* DixAddAccess */
+          "remove",		/* DixRemoveAccess */
+          "",			/* DixHideAccess */
+          "",			/* DixShowAccess */
+          "",			/* DixBlendAccess */
+          "grab",		/* DixGrabAccess */
+          "freeze",		/* DixFreezeAccess */
+          "force_cursor",	/* DixForceAccess */
+          "",			/* DixInstallAccess */
+          "",			/* DixUninstallAccess */
+          "",			/* DixSendAccess */
+          "",			/* DixReceiveAccess */
+          "use",		/* DixUseAccess */
+          "manage",		/* DixManageAccess */
+          "",			/* DixDebugAccess */
+          "bell",		/* DixBellAccess */
+          NULL }},
+    { "x_keyboard",
         { "read",		/* DixReadAccess */
           "write",		/* DixWriteAccess */
           "destroy",		/* DixDestroyAccess */
-- 
cgit v1.2.3