Add basic SELinux policy

This adds just enough for sys-gui-vnc to work, specifically to allow X
server access to /run/qubes/shm.id.0.

The actual GUI daemon remains unconfined at this time.

QubesOS/qubes-issues#9276

Makefile

@@ -31,10 +31,13 @@ help:
 	    echo "make clean                <--- clean all the binary files";\
 	    exit 0;
 
+selinux_policies ::= qubes-gui-daemon.pp
+
 all_targets := gui-daemon/qubes-guid gui-daemon/qubes-guid.1 \
      shmoverride/shmoverride.so \
      shmoverride/X-wrapper-qubes pulse/pacat-simple-vchan \
-     screen-layout-handler/watch-screen-layout-changes
+     screen-layout-handler/watch-screen-layout-changes \
+	 selinux/$(selinux_policies)
 
 all: $(all_targets)
 .PHONY: $(all_targets) install tar clean help
@@ -54,6 +57,9 @@ pulse/pacat-simple-vchan:
 screen-layout-handler/watch-screen-layout-changes:
 	$(MAKE) -C screen-layout-handler watch-screen-layout-changes
 
+selinux/$(selinux_policies):
+	$(MAKE) -C selinux -f /usr/share/selinux/devel/Makefile
+
 install:
 	install -D gui-daemon/qubes-guid $(DESTDIR)/usr/bin/qubes-guid
 	install -m 0644 -D gui-daemon/qubes-guid.1 $(DESTDIR)$(MANDIR)/man1/qubes-guid.1
@@ -68,6 +74,7 @@ install:
 	install -D screen-layout-handler/watch-screen-layout-changes $(DESTDIR)/usr/libexec/qubes/watch-screen-layout-changes
 	install -D -m 0644 screen-layout-handler/qubes-screen-layout-watches.desktop $(DESTDIR)/etc/xdg/autostart/qubes-screen-layout-watches.desktop
 	$(MAKE) -C window-icon-updater install
+	install -D -t $(DESTDIR)/usr/share/selinux/packages selinux/$(selinux_policies)
 
 tar:
 	git archive --format=tar --prefix=qubes-gui/ HEAD -o qubes-gui.tar

rpm_spec/gui-daemon.spec.in

@@ -41,6 +41,7 @@ Requires:	qubes-core-qrexec >= 4.1.5
 Requires:	python%{python3_pkgversion}-qubesimgconverter >= 4.1.4
 Requires:	socat
 Requires:	group(qubes)
+Requires:   (%{name}-selinux if selinux-policy)
 
 BuildRequires:	python%{python3_pkgversion}-devel
 BuildRequires:	python%{python3_pkgversion}-setuptools
@@ -63,6 +64,7 @@ BuildRequires:	qubes-core-libs
 BuildRequires:	qubes-gui-common-devel >= 3.2.0
 BuildRequires:	qubes-libvchan-@BACKEND_VMM@-devel
 BuildRequires:	qubes-utils-devel >= 4.2.10
+BuildRequires:  selinux-policy-devel
 
 Source0: %{name}-%{version}.tar.gz
 
@@ -110,6 +112,30 @@ Requires:   python%{python3_pkgversion}-setuptools
 Dom0 files for Qubes AUDIO virtualization. This include core-admin extension,
 policy files etc.
 
+%package selinux
+
+BuildRequires: selinux-policy
+%{?selinux_requires}
+
+Summary: SELinux policy for qubes-gui-daemon
+License: GPLv2+
+
+%description selinux
+SELinux policy for qubes-gui-daemon.  You need this package to run qubes-guid
+on a system where SELinux is in enforcing mode.
+
+%post selinux
+%selinux_modules_install %{_datadir}/selinux/packages/qubes-gui-daemon.pp || :
+
+%postun selinux
+if [ "$1" -eq 0 ]; then
+    %selinux_modules_uninstall %{_datadir}/selinux/packages/qubes-gui-daemon.pp
+fi || :
+
+%posttrans selinux
+%selinux_relabel_post
+exit 0
+
 %prep
 %setup -q
 
@@ -167,5 +193,8 @@ rm -f %{name}-%{version}
 %{python3_sitelib}/qubesguidaemon-*.egg-info
 %{python3_sitelib}/qubesguidaemon
 
+%files selinux
+%{_datadir}/selinux/packages/qubes-gui-daemon.pp
+
 %changelog
 @CHANGELOG@

selinux/qubes-gui-daemon.fc

@@ -0,0 +1,2 @@
+/run/qubes/shm\.id\.[0-9]+ -- gen_context(system_u:object_r:qubes_gui_shmid_t)
+/var/run/qubes/shm\.id\.[0-9]+ -- gen_context(system_u:object_r:qubes_gui_shmid_t)

selinux/qubes-gui-daemon.te

@@ -0,0 +1,17 @@
+policy_module(qubes-gui-daemon, 0.0.1)
+
+require {
+    type xdm_t, qubes_var_run_t;
+    type tmpfs_t;
+}
+
+type qubes_gui_shmid_t;
+
+# Allow /run/qubes/shm.id.*
+filetrans_pattern(xdm_t, qubes_var_run_t, qubes_gui_shmid_t, file, "shm.id.0")
+filetrans_pattern(xdm_t, qubes_var_run_t, qubes_gui_shmid_t, file, "shm.id.1")
+filetrans_pattern(xdm_t, qubes_var_run_t, qubes_gui_shmid_t, file, "shm.id.2")
+filetrans_pattern(xdm_t, qubes_var_run_t, qubes_gui_shmid_t, file, "shm.id.3")
+filetrans_pattern(xdm_t, qubes_var_run_t, qubes_gui_shmid_t, file, "shm.id.4")
+allow xdm_t qubes_gui_shmid_t:file { create lock open read write map unlink getattr setattr };
+allow qubes_gui_shmid_t tmpfs_t:filesystem { associate };