anders/SonicDE-rpmspecs
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Use with file context rules labeling plasmalogin binaries as xdm_exec_t instead
Some checks failed
Build RPMs / build (sonic-interface-libraries.spec) (push) Failing after 9s
Details
Build RPMs / build (sonic-win.spec) (push) Failing after 9s
Details
Build RPMs / build (sonic-workspace.spec) (push) Failing after 6s
Details

Browse source
This commit is contained in:
Anders da Silva Rytter Hansen 2026-06-30 17:16:16 -03:00
commit 4e91804f0a
4 changed files with 32 additions and 15 deletions
Download patch file Download diff file Expand all files Collapse all files

10
sonic-login-manager-selinux/plasmalogin-selinux.te
View file

@ -1,12 +1,10 @@
module plasmalogin-selinux 1.0;
require {
type unconfined_t;
type xdm_exec_t;
class file { entrypoint execute };
}
# Allow the plasmalogin process to execute the X11 user helper binary
# which is labeled as xdm_exec_t. This is needed when the plasmalogin
# daemon is not running in the xdm_t domain on SELinux enforcing systems.
allow unconfined_t xdm_exec_t:file { entrypoint execute };
# File context rules for plasmalogin binaries are defined in the
# accompanying .fc file. Labeling the daemon and helper binaries as
# xdm_exec_t lets systemd transition plasmalogin into the xdm_t domain,
# which already has the required permissions to run X11 user sessions.