пользовательский интерфейс маркировки SELinux и формат файла конфигурации для бэкэнда контекстов системы X Window. Этот бэкэнд также используется для определения контекста по умолчанию для маркировки удаленно подключенных X-клиентов (userspace SELinux labeling interface and configuration file format for the X Window System contexts backend. This backend is also used to determine the default context for labeling remotely connected X clients)
Имя (Name)
selabel_x - userspace SELinux labeling interface and
configuration file format for the X Window System contexts
backend. This backend is also used to determine the default
context for labeling remotely connected X clients
Синопсис (Synopsis)
#include <selinux/label.h>
int selabel_lookup(struct selabel_handle *hnd,
char **context,
const char *object_name, int object_type);
int selabel_lookup_raw(struct selabel_handle *hnd,
char **context,
const char *object_name, int object_type);
Описание (Description)
The X contexts backend maps from X Window System object names
into security contexts. It is used to find the appropriate
context for X Window System objects whose significance and/or
usage semantics are determined primarily by name. The returned
context must be freed using freecon(3).
selabel_lookup(3) describes the function with its return and
error codes.
This backend is also used to determine the default context for
labeling remotely connected X clients.
The object_type argument should be set to one of the following
values:
SELABEL_X_PROP
The object_name argument specifies the name of a
window property, such as "WM_NAME".
SELABEL_X_SELN
The object_name argument specifies the name of a
selection, such as "PRIMARY".
SELABEL_X_EXT
The object_name argument specifies the name of a
protocol extension, such as "RENDER".
SELABEL_X_EVENT
The object_name argument specifies the name of an
event type, such as "X11:ButtonPress".
SELABEL_X_CLIENT
The object_name argument is ignored, however it
should be set to either * (an asterisk or
'wildcard' that will select the default entry) or a
specific entry such as "remote" in the X contexts
file as shown in the EXAMPLE section. The default
context for labeling remote X clients is then
returned.
SELABEL_X_POLYPROP
Like SELABEL_X_PROP, but checks if the property was
marked as being polyinstantiated. See NOTES below.
SELABEL_X_POLYSELN
Like SELABEL_X_SELN, but checks if the selection
was marked as being polyinstantiated. See NOTES
below.
Any messages generated by selabel_lookup(3) are sent to stderr by
default, although this can be changed by selinux_set_callback(3).
selabel_lookup_raw behaves identically to selabel_lookup but does
not perform context translation.
The FILES section details the configuration files used to
determine the X object context.
Параметры (Options)
In addition to the global options described in selabel_open(3),
this backend recognizes the following options:
SELABEL_OPT_PATH
A non-null value for this option specifies a path
to a file that will be opened in lieu of the
standard X contexts file (see the FILES section for
details).
Файлы (Files)
The X context file used to retrieve a default context depends on
the SELABEL_OPT_PATH parameter passed to selabel_open(3). If
NULL, then the SELABEL_OPT_PATH value will default to the active
policy X contexts location (as returned by
selinux_x_context_path(3)), otherwise the actual SELABEL_OPT_PATH
value specified is used.
The default X object contexts file is:
/etc/selinux/{SELINUXTYPE}/contexts/x_contexts
Where {SELINUXTYPE} is the entry from the selinux configuration
file config (see selinux_config(5)).
The entries within the X contexts file are shown in the Object
Name String Values and FILE FORMAT sections.
Строковые значения имени объекта (Object name string values)
The string name assigned to each object_type argument that can be
present in the X contexts file are:
┌───────────────────┬────────────────┐
│object_type │ Text Name │
├───────────────────┼────────────────┤
│SELABEL_X_PROP │ property │
├───────────────────┼────────────────┤
│SELABEL_X_SELN │ selection │
├───────────────────┼────────────────┤
│SELABEL_X_EXT │ extension │
├───────────────────┼────────────────┤
│SELABEL_X_EVENT │ event │
├───────────────────┼────────────────┤
│SELABEL_X_CLIENT │ client │
├───────────────────┼────────────────┤
│SELABEL_X_POLYPROP │ poly_property │
├───────────────────┼────────────────┤
│SELABEL_X_POLYSELN │ poly_selection │
└───────────────────┴────────────────┘
Формат файла (File format)
Each line within the X contexts file is as follows:
object_type object_name context
Where:
object_type
This is the string representation of the object
type shown in the Object Name String Values
section. There can be multiple lines with the same
object_type string that will form a block of
entries (each with a different object_name entry).
object_name
These are the object names of the specific X-server
resource such as PRIMARY, CUT_BUFFER0 etc. They are
generally defined in the X-server source code
(protocol.txt and BuiltInAtoms in the dix directory
of the xorg-server source package). The entry can
contain '*' for wildcard matching or '?' for
substitution. Note that if the '*' is used, then
be aware that the order of entries in the file is
important. The '*' on its own is used to ensure a
default fallback context is assigned and should be
the last entry in the object_type block.
context
The security context that will be applied to the
object.
Example 1:
# object_type object_name context
selection PRIMARY system_u:object_r:clipboard_xselection_t:s0
selection * system_u:object_r:xselection_t:s0
Example 2 - This example shows how a client entry can be
configured to ensure an entry is always found:
# object_type object_name context
client * system_u:object_r:remote_t:s0
Примечание (Note)
1. Properties and selections are marked as either
polyinstantiated or not. For these name types, the "POLY"
option searches only the names marked as being
polyinstantiated, while the other option searches only the
names marked as not being polyinstantiated. Users of the
interface should check both mappings, optionally taking
action based on the result (e.g. polyinstantiating the
object).
2. If contexts are to be validated, then the global option
SELABEL_OPT_VALIDATE must be set before calling
selabel_open(3). If this is not set, then it is possible for
an invalid context to be returned.
Смотри также (See also)
selinux(8), selabel_open(3), selabel_lookup(3), selabel_stats(3),
selabel_close(3), selinux_set_callback(3),
selinux_x_context_path(3), freecon(3), selinux_config(5)
