Re: xserver policy

On 5/5/26 9:03 AM, Russell Coker wrote:
> type_transition user_t xserver_exec_t:process xserver_t;
> type_transition user_wm_t mono_exec_t:process mono_t;
> type_transition user_wm_t wine_exec_t:process wine_t;
> type_transition user_wm_t xserver_exec_t:process xserver_t;
>
> Currently in the Debian SE Linux policy (which I believe to be identical to
> upstream refpolicy in this regard) the above are the possible transitions from
> user_t to unconfined domains.
>
> The mono and wine modules can be removed for essentially identical
> functionality if you happen to not use mono or wine.
>
> Both GNOME and KDE are dropping support for X11.  If we don't drop policy
> support for X11 I think we should at least separate xdm and xserver into
> separate modules
I have no objections to this. There has been some work from the Gentoo 
team on a wayland policy too, but I'm unsure what state it is in (it's 
upstreamed).
>   so you can have XDM for Wayland without having an unconfined
> X server policy.  As an aside the current situation is that if you remove the
> unconfined module it will be impossible to login with any XDM program.
Thanks for looking into this. I didn't realize a confined xdm was having 
issues.

-- 
Chris PeBenito