From: Nicolas Iooss <nicolas.iooss@m4x.org>
To: Petr Lautrbach <plautrba@redhat.com>
Cc: selinux@vger.kernel.org, Dan Walsh <dwalsh@redhat.com>
Subject: Re: [PATCH] dbus: Fix name of polkit function
Date: Wed, 6 Feb 2019 21:46:07 +0100 [thread overview]
Message-ID: <CAJfZ7=kYgvh3QeXBzWbMcjMuSKt1VaGkaxj=xiJ_0PFsihhPMQ@mail.gmail.com> (raw)
In-Reply-To: <20190131194208.3855-1-plautrba@redhat.com>
On Thu, Jan 31, 2019 at 8:42 PM Petr Lautrbach <plautrba@redhat.com> wrote:
>
> From: Dan Walsh <dwalsh@redhat.com>
>
> Signed-off-by: Petr Lautrbach <plautrba@redhat.com>
Hi,
As I am unfamiliar with D-Bus code, I try to understand what is the
nature of this change (is-it a bugfix, an improvement, something
else?). Here are the facts:
- Currently, dbus/selinux_server.py uses «
@slip.dbus.polkit.require_auth("org.selinux.change_default_mode") »
for function « change_default_mode ».
- "org.selinux.change_default_mode" does not exist, and I do not know
whether that means that some kind of default policykit policy gets
applied.
- "org.selinux.change_policy_type" is defined in
dbus/org.selinux.policy, without any user.
- The commit that introduced dbus/selinux_server.py (commit
e6a1298e5421 ("These are massive changes involved in building new
GUI.")) added a function named « change_default_mode », without any
specific policykit access checking.
- Commit e8718ef51463 ("Make sure we do the polkit check on all dbus
interfaces.") added «
@slip.dbus.polkit.require_auth("org.selinux.change_default_mode") » in
policycoreutils/sepolicy/selinux_server.py.
If I understand correctly, this last commit is buggy and should have
added "org.selinux.change_default_mode" to
policycoreutils/sepolicy/org.selinux.policy. Therefore this new patch
fixes a bug and removes an unused policykit action. Is this right? If
yes, I suggest adding this to the commit description:
Add missing action org.selinux.change_default_mode for
change_default_mode() and remove unused action
org.selinux.change_policy_type.
Fixes: e8718ef51463 ("Make sure we do the polkit check on all dbus
interfaces.")
Would this be acceptable?
Thanks,
Nicolas
> ---
> dbus/org.selinux.policy | 6 +++---
> 1 file changed, 3 insertions(+), 3 deletions(-)
>
> diff --git a/dbus/org.selinux.policy b/dbus/org.selinux.policy
> index 01266102..9772127b 100644
> --- a/dbus/org.selinux.policy
> +++ b/dbus/org.selinux.policy
> @@ -70,9 +70,9 @@
> <allow_active>auth_admin_keep</allow_active>
> </defaults>
> </action>
> - <action id="org.selinux.change_policy_type">
> - <description>SELinux write access</description>
> - <message>System policy prevents change_policy_type access to SELinux</message>
> + <action id="org.selinux.change_default_mode">
> + <description>Change SELinux default enforcing mode</description>
> + <message>System policy prevents change_default_policy access to SELinux</message>
> <defaults>
> <allow_any>no</allow_any>
> <allow_inactive>no</allow_inactive>
> --
> 2.20.1
>
next prev parent reply other threads:[~2019-02-06 20:46 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-01-31 19:42 [PATCH] dbus: Fix name of polkit function Petr Lautrbach
2019-02-06 20:46 ` Nicolas Iooss [this message]
2019-02-07 9:09 ` Petr Lautrbach
2019-02-07 9:18 ` [PATCH v2] " Petr Lautrbach
2019-02-07 21:04 ` Nicolas Iooss
2019-02-10 16:49 ` Nicolas Iooss
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='CAJfZ7=kYgvh3QeXBzWbMcjMuSKt1VaGkaxj=xiJ_0PFsihhPMQ@mail.gmail.com' \
--to=nicolas.iooss@m4x.org \
--cc=dwalsh@redhat.com \
--cc=plautrba@redhat.com \
--cc=selinux@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).