xscreensaver: allow exec auth and systemd tools

Xscreensaver needs to be able to exec xscreensaver-auth to prompt for
the password.
xscreensaver-systemd locks during suspend and handles inhibiting through
the dbus interface.

Signed-off-by: Jason Zaman <perfinion@gentoo.org>

Author: perfinion

policy/modules/apps/xscreensaver.fc

@@ -4,4 +4,10 @@ HOME_DIR/\.xscreensaver		--	gen_context(system_u:object_r:xscreensaver_config_t,
 /usr/bin/xscreensaver-getimage.*	--	gen_context(system_u:object_r:xscreensaver_helper_exec_t,s0)
 /usr/bin/xscreensaver-gl-helper	--	gen_context(system_u:object_r:xscreensaver_helper_exec_t,s0)
 
-/usr/libexec/xscreensaver(/.*)?	--	gen_context(system_u:object_r:xscreensaver_helper_exec_t,s0)
+/usr/lib/misc/xscreensaver/xscreensaver-auth	--	gen_context(system_u:object_r:xscreensaver_exec_t,s0)
+/usr/lib/misc/xscreensaver/xscreensaver-systemd	--	gen_context(system_u:object_r:xscreensaver_exec_t,s0)
+/usr/lib/misc/xscreensaver/.*	--	gen_context(system_u:object_r:xscreensaver_helper_exec_t,s0)
+
+/usr/libexec/xscreensaver/xscreensaver-auth	--	gen_context(system_u:object_r:xscreensaver_exec_t,s0)
+/usr/libexec/xscreensaver/xscreensaver-systemd	--	gen_context(system_u:object_r:xscreensaver_exec_t,s0)
+/usr/libexec/xscreensaver/.*	--	gen_context(system_u:object_r:xscreensaver_helper_exec_t,s0)

policy/modules/apps/xscreensaver.if

@@ -49,6 +49,7 @@ template(`xscreensaver_role',`
 	allow $2 xscreensaver_tmpfs_t:file { manage_file_perms relabel_file_perms };
 
 	allow xscreensaver_helper_t $3:fd use;
+	allow xscreensaver_helper_t $3:fifo_file read_fifo_file_perms;
 
 	optional_policy(`
 		systemd_user_app_status($1, xscreensaver_t)

policy/modules/apps/xscreensaver.te

@@ -37,13 +37,15 @@ userdom_user_tmpfs_file(xscreensaver_tmpfs_t)
 #
 
 allow xscreensaver_t self:capability { setgid setuid };
-allow xscreensaver_t self:process { setsched signal sigstop };
+allow xscreensaver_t self:process { sigstop signal setsched setpgid };
 allow xscreensaver_t self:fifo_file rw_fifo_file_perms;
 
 allow xscreensaver_t xscreensaver_helper_t:process { signal sigstop };
 
 allow xscreensaver_t xscreensaver_config_t:file manage_file_perms;
 
+can_exec(xscreensaver_t, xscreensaver_exec_t)
+
 kernel_read_system_state(xscreensaver_t)
 
 files_read_usr_files(xscreensaver_t)
@@ -60,6 +62,7 @@ init_read_utmp(xscreensaver_t)
 logging_send_audit_msgs(xscreensaver_t)
 logging_send_syslog_msg(xscreensaver_t)
 
+miscfiles_read_fonts(xscreensaver_t)
 miscfiles_read_localization(xscreensaver_t)
 
 userdom_use_user_terminals(xscreensaver_t)
@@ -85,12 +88,16 @@ tunable_policy(`xscreensaver_read_generic_user_content',`
 	userdom_dontaudit_read_user_tmp_files(xscreensaver_t)
 ')
 
+optional_policy(`
+    dbus_all_session_bus_client(xscreensaver_t)
+')
+
 ########################################
 #
 # Helper local policy
 #
 
-allow xscreensaver_helper_t self:process { execmem signal };
+allow xscreensaver_helper_t self:process { execmem signal setsched };
 allow xscreensaver_helper_t self:fifo_file rw_fifo_file_perms;
 
 allow xscreensaver_helper_t xscreensaver_config_t:file manage_file_perms;