* [refpolicy] [PATCH] Update for the gnome policy and file contexts
@ 2016-08-13 14:45 Guido Trentalancia
2016-08-13 14:51 ` Dominick Grift
2016-08-15 21:33 ` [refpolicy] [PATCH v2] " Guido Trentalancia
0 siblings, 2 replies; 73+ messages in thread
From: Guido Trentalancia @ 2016-08-13 14:45 UTC (permalink / raw)
To: refpolicy
Update for the gnome module:
- a new gstreamer_orcexec_t type and file context is introduced
to support the OIL Runtime Compiler (ORC) optimized code
execution (used for example by pulseaudio);
- add support for more permissions needed in gconfd_t and gnome
keyring domains;
- add support for a few needed fs and kernel permissions.
This patch should be applied before applying the pulseaudio patch.
Signed-off-by: Guido Trentalancia <guido@trentalancia.net>
---
policy/modules/contrib/gnome.fc | 7 ++
policy/modules/contrib/gnome.if | 99 +++++++++++++++++++++++++++++++++++++++-
policy/modules/contrib/gnome.te | 8 +++
3 files changed, 112 insertions(+), 2 deletions(-)
--- refpolicy-git-06082016-orig/policy/modules/contrib/gnome.fc 2016-08-13 16:02:14.949814288 +0200
+++ refpolicy-git-06082016/policy/modules/contrib/gnome.fc 2016-08-13 16:30:32.175198600 +0200
@@ -4,6 +4,7 @@ HOME_DIR/\.gnome(/.*)? gen_context(syste
HOME_DIR/\.gnome2(/.*)? gen_context(system_u:object_r:gnome_home_t,s0)
HOME_DIR/\.gnome2/keyrings(/.*)? gen_context(system_u:object_r:gnome_keyring_home_t,s0)
HOME_DIR/\.gnome2_private(/.*)? gen_context(system_u:object_r:gnome_home_t,s0)
+HOME_DIR/orcexec\..* gen_context(system_u:object_r:gstreamer_orcexec_t,s0)
/etc/gconf(/.*)? gen_context(system_u:object_r:gconf_etc_t,s0)
@@ -13,4 +14,8 @@ HOME_DIR/\.gnome2_private(/.*)? gen_cont
/usr/bin/mate-keyring-daemon -- gen_context(system_u:object_r:gkeyringd_exec_t,s0)
/usr/lib/[^/]*/gconf/gconfd-2 -- gen_context(system_u:object_r:gconfd_exec_t,s0)
-/usr/libexec/gconfd-2 -- gen_context(system_u:object_r:gconfd_exec_t,s0)
+
+/usr/libexec/gconfd-2 -- gen_context(system_u:object_r:gconfd_exec_t,s0)
+
+/var/run/user/[^/]*/orcexec\..* gen_context(system_u:object_r:gstreamer_orcexec_t,s0)
+/var/run/user/%{USERID}/orcexec\..* gen_context(system_u:object_r:gstreamer_orcexec_t,s0)
--- refpolicy-git-06082016-orig/policy/modules/contrib/gnome.if 2016-08-13 16:02:14.950814302 +0200
+++ refpolicy-git-06082016/policy/modules/contrib/gnome.if 2016-08-13 00:55:24.980149003 +0200
@@ -1,4 +1,4 @@
-## <summary>GNU network object model environment.</summary>
+
########################################
## <summary>
@@ -100,9 +100,15 @@ template(`gnome_role_template',`
allow $3 gnome_keyring_tmp_t:sock_file { relabel_sock_file_perms manage_sock_file_perms };
+ userdom_manage_user_home_content_dirs($1_gkeyringd_t)
+ userdom_manage_user_home_content_files($1_gkeyringd_t)
+ userdom_manage_user_home_content_sockets($1_gkeyringd_t)
+
ps_process_pattern($3, $1_gkeyringd_t)
allow $3 $1_gkeyringd_t:process { ptrace signal_perms };
+ kernel_read_kernel_sysctls($1_gkeyringd_t)
+
corecmd_bin_domtrans($1_gkeyringd_t, $3)
corecmd_shell_domtrans($1_gkeyringd_t, $3)
@@ -569,6 +575,36 @@ interface(`gnome_home_filetrans_gnome_ho
########################################
## <summary>
+## Create objects in user home
+## directories with the gstreamer
+## orcexec type.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+## <param name="object_class">
+## <summary>
+## Class of the object being created.
+## </summary>
+## </param>
+## <param name="name" optional="true">
+## <summary>
+## The name of the object being created.
+## </summary>
+## </param>
+#
+interface(`gnome_home_filetrans_gstreamer_orcexec',`
+ gen_require(`
+ type gstreamer_orcexec_t;
+ ')
+
+ userdom_user_home_dir_filetrans($1, gstreamer_orcexec_t, $2, $3)
+')
+
+########################################
+## <summary>
## Create objects in gnome gconf home
## directories with a private type.
## </summary>
@@ -603,6 +639,67 @@ interface(`gnome_gconf_home_filetrans',`
')
########################################
+## <summary>
+## Create objects in the user
+## runtime directories with the
+## gstreamer orcexec type.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+## <param name="object_class">
+## <summary>
+## Class of the object being created.
+## </summary>
+## </param>
+## <param name="name" optional="true">
+## <summary>
+## The name of the object being created.
+## </summary>
+## </param>
+#
+interface(`gnome_user_runtime_filetrans_gstreamer_orcexec',`
+ gen_require(`
+ type gstreamer_orcexec_t;
+ ')
+
+ userdom_user_runtime_filetrans($1, gstreamer_orcexec_t, $2, $3)
+')
+
+
+########################################
+## <summary>
+## Create objects in the tmp
+## directories with the gstreamer
+## orcexec type.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+## <param name="object_class">
+## <summary>
+## Class of the object being created.
+## </summary>
+## </param>
+## <param name="name" optional="true">
+## <summary>
+## The name of the object being created.
+## </summary>
+## </param>
+#
+interface(`gnome_tmp_filetrans_gstreamer_orcexec',`
+ gen_require(`
+ type gstreamer_orcexec_t;
+ ')
+
+ files_tmp_filetrans($1, gstreamer_orcexec_t, $2, $3)
+')
+
+########################################
## <summary>
## Read generic gnome keyring home files.
## </summary>
--- refpolicy-git-06082016-orig/policy/modules/contrib/gnome.te 2016-08-13 16:02:14.951814316 +0200
+++ refpolicy-git-06082016/policy/modules/contrib/gnome.te 2016-08-13 13:45:54.704254788 +0200
@@ -46,6 +46,9 @@ userdom_user_home_content(gnome_keyring_
type gnome_keyring_tmp_t;
userdom_user_tmp_file(gnome_keyring_tmp_t)
+type gstreamer_orcexec_t;
+application_executable_file(gstreamer_orcexec_t)
+
##############################
#
# Common local Policy
@@ -87,8 +90,13 @@ manage_dirs_pattern(gconfd_t, gconf_tmp_
manage_files_pattern(gconfd_t, gconf_tmp_t, gconf_tmp_t)
userdom_user_tmp_filetrans(gconfd_t, gconf_tmp_t, { dir file })
+kernel_dontaudit_read_system_state(gconfd_t)
+
+fs_getattr_xattr_fs(gconfd_t)
+
userdom_manage_user_tmp_dirs(gconfd_t)
userdom_tmp_filetrans_user_tmp(gconfd_t, dir)
+userdom_manage_user_tmp_sockets(gconfd_t)
userdom_user_runtime_filetrans_user_tmp(gconfd_t, dir)
optional_policy(`
^ permalink raw reply [flat|nested] 73+ messages in thread* [refpolicy] [PATCH] Update for the gnome policy and file contexts 2016-08-13 14:45 [refpolicy] [PATCH] Update for the gnome policy and file contexts Guido Trentalancia @ 2016-08-13 14:51 ` Dominick Grift 2016-08-13 20:09 ` Guido Trentalancia ` (2 more replies) 2016-08-15 21:33 ` [refpolicy] [PATCH v2] " Guido Trentalancia 1 sibling, 3 replies; 73+ messages in thread From: Dominick Grift @ 2016-08-13 14:51 UTC (permalink / raw) To: refpolicy On 08/13/2016 04:45 PM, Guido Trentalancia wrote: > Update for the gnome module: > > - a new gstreamer_orcexec_t type and file context is introduced > to support the OIL Runtime Compiler (ORC) optimized code > execution (used for example by pulseaudio); > - add support for more permissions needed in gconfd_t and gnome > keyring domains; > - add support for a few needed fs and kernel permissions. > > This patch should be applied before applying the pulseaudio patch. > > Signed-off-by: Guido Trentalancia <guido@trentalancia.net> > --- > policy/modules/contrib/gnome.fc | 7 ++ > policy/modules/contrib/gnome.if | 99 +++++++++++++++++++++++++++++++++++++++- > policy/modules/contrib/gnome.te | 8 +++ > 3 files changed, 112 insertions(+), 2 deletions(-) > > --- refpolicy-git-06082016-orig/policy/modules/contrib/gnome.fc 2016-08-13 16:02:14.949814288 +0200 > +++ refpolicy-git-06082016/policy/modules/contrib/gnome.fc 2016-08-13 16:30:32.175198600 +0200 > @@ -4,6 +4,7 @@ HOME_DIR/\.gnome(/.*)? gen_context(syste > HOME_DIR/\.gnome2(/.*)? gen_context(system_u:object_r:gnome_home_t,s0) > HOME_DIR/\.gnome2/keyrings(/.*)? gen_context(system_u:object_r:gnome_keyring_home_t,s0) > HOME_DIR/\.gnome2_private(/.*)? gen_context(system_u:object_r:gnome_home_t,s0) > +HOME_DIR/orcexec\..* gen_context(system_u:object_r:gstreamer_orcexec_t,s0) > > /etc/gconf(/.*)? gen_context(system_u:object_r:gconf_etc_t,s0) > > @@ -13,4 +14,8 @@ HOME_DIR/\.gnome2_private(/.*)? gen_cont > /usr/bin/mate-keyring-daemon -- gen_context(system_u:object_r:gkeyringd_exec_t,s0) > > /usr/lib/[^/]*/gconf/gconfd-2 -- gen_context(system_u:object_r:gconfd_exec_t,s0) > -/usr/libexec/gconfd-2 -- gen_context(system_u:object_r:gconfd_exec_t,s0) > + > +/usr/libexec/gconfd-2 -- gen_context(system_u:object_r:gconfd_exec_t,s0) > + > +/var/run/user/[^/]*/orcexec\..* gen_context(system_u:object_r:gstreamer_orcexec_t,s0) > +/var/run/user/%{USERID}/orcexec\..* gen_context(system_u:object_r:gstreamer_orcexec_t,s0) these are files so you can be more specific about it: /var/run/user/[^/]*/orcexec\..* -- gen_context(system_u:object_r:gstreamer_orcexec_t,s0) /var/run/user/%{USERID}/orcexec\..* -- gen_context(system_u:object_r:gstreamer_orcexec_t,s0) > --- refpolicy-git-06082016-orig/policy/modules/contrib/gnome.if 2016-08-13 16:02:14.950814302 +0200 > +++ refpolicy-git-06082016/policy/modules/contrib/gnome.if 2016-08-13 00:55:24.980149003 +0200 > @@ -1,4 +1,4 @@ > -## <summary>GNU network object model environment.</summary> > + > > ######################################## > ## <summary> > @@ -100,9 +100,15 @@ template(`gnome_role_template',` > > allow $3 gnome_keyring_tmp_t:sock_file { relabel_sock_file_perms manage_sock_file_perms }; > > + userdom_manage_user_home_content_dirs($1_gkeyringd_t) > + userdom_manage_user_home_content_files($1_gkeyringd_t) > + userdom_manage_user_home_content_sockets($1_gkeyringd_t) > + I don't like this, and I dont understand it > ps_process_pattern($3, $1_gkeyringd_t) > allow $3 $1_gkeyringd_t:process { ptrace signal_perms }; > > + kernel_read_kernel_sysctls($1_gkeyringd_t) > + > corecmd_bin_domtrans($1_gkeyringd_t, $3) > corecmd_shell_domtrans($1_gkeyringd_t, $3) > > @@ -569,6 +575,36 @@ interface(`gnome_home_filetrans_gnome_ho > > ######################################## > ## <summary> > +## Create objects in user home > +## directories with the gstreamer > +## orcexec type. > +## </summary> > +## <param name="domain"> > +## <summary> > +## Domain allowed access. > +## </summary> > +## </param> > +## <param name="object_class"> > +## <summary> > +## Class of the object being created. > +## </summary> > +## </param> > +## <param name="name" optional="true"> > +## <summary> > +## The name of the object being created. > +## </summary> > +## </param> > +# > +interface(`gnome_home_filetrans_gstreamer_orcexec',` > + gen_require(` > + type gstreamer_orcexec_t; > + ') > + > + userdom_user_home_dir_filetrans($1, gstreamer_orcexec_t, $2, $3) > +') > + > +######################################## > +## <summary> > ## Create objects in gnome gconf home > ## directories with a private type. > ## </summary> > @@ -603,6 +639,67 @@ interface(`gnome_gconf_home_filetrans',` > ') > > ######################################## > +## <summary> > +## Create objects in the user > +## runtime directories with the > +## gstreamer orcexec type. > +## </summary> > +## <param name="domain"> > +## <summary> > +## Domain allowed access. > +## </summary> > +## </param> > +## <param name="object_class"> > +## <summary> > +## Class of the object being created. > +## </summary> > +## </param> > +## <param name="name" optional="true"> > +## <summary> > +## The name of the object being created. > +## </summary> > +## </param> > +# > +interface(`gnome_user_runtime_filetrans_gstreamer_orcexec',` > + gen_require(` > + type gstreamer_orcexec_t; > + ') > + > + userdom_user_runtime_filetrans($1, gstreamer_orcexec_t, $2, $3) > +') > + > + > +######################################## > +## <summary> > +## Create objects in the tmp > +## directories with the gstreamer > +## orcexec type. > +## </summary> > +## <param name="domain"> > +## <summary> > +## Domain allowed access. > +## </summary> > +## </param> > +## <param name="object_class"> > +## <summary> > +## Class of the object being created. > +## </summary> > +## </param> > +## <param name="name" optional="true"> > +## <summary> > +## The name of the object being created. > +## </summary> > +## </param> > +# > +interface(`gnome_tmp_filetrans_gstreamer_orcexec',` > + gen_require(` > + type gstreamer_orcexec_t; > + ') > + > + files_tmp_filetrans($1, gstreamer_orcexec_t, $2, $3) > +') > + If you're not going to support that file in /tmp then this is not needed > +######################################## > ## <summary> > ## Read generic gnome keyring home files. > ## </summary> > --- refpolicy-git-06082016-orig/policy/modules/contrib/gnome.te 2016-08-13 16:02:14.951814316 +0200 > +++ refpolicy-git-06082016/policy/modules/contrib/gnome.te 2016-08-13 13:45:54.704254788 +0200 > @@ -46,6 +46,9 @@ userdom_user_home_content(gnome_keyring_ > type gnome_keyring_tmp_t; > userdom_user_tmp_file(gnome_keyring_tmp_t) > > +type gstreamer_orcexec_t; > +application_executable_file(gstreamer_orcexec_t) it is not an applications executable file > + > ############################## > # > # Common local Policy > @@ -87,8 +90,13 @@ manage_dirs_pattern(gconfd_t, gconf_tmp_ > manage_files_pattern(gconfd_t, gconf_tmp_t, gconf_tmp_t) > userdom_user_tmp_filetrans(gconfd_t, gconf_tmp_t, { dir file }) > > +kernel_dontaudit_read_system_state(gconfd_t) > + > +fs_getattr_xattr_fs(gconfd_t) > + > userdom_manage_user_tmp_dirs(gconfd_t) > userdom_tmp_filetrans_user_tmp(gconfd_t, dir) > +userdom_manage_user_tmp_sockets(gconfd_t) What is going on there and why did you choose this? > userdom_user_runtime_filetrans_user_tmp(gconfd_t, dir) > > optional_policy(` > _______________________________________________ > refpolicy mailing list > refpolicy at oss.tresys.com > http://oss.tresys.com/mailman/listinfo/refpolicy > -- Key fingerprint = 5F4D 3CDB D3F8 3652 FBD8 02D5 3B6C 5F1D 2C7B 6B02 https://sks-keyservers.net/pks/lookup?op=get&search=0x3B6C5F1D2C7B6B02 Dominick Grift -------------- next part -------------- A non-text attachment was scrubbed... Name: signature.asc Type: application/pgp-signature Size: 648 bytes Desc: OpenPGP digital signature Url : http://oss.tresys.com/pipermail/refpolicy/attachments/20160813/d4f48b93/attachment.bin ^ permalink raw reply [flat|nested] 73+ messages in thread
* [refpolicy] [PATCH] Update for the gnome policy and file contexts 2016-08-13 14:51 ` Dominick Grift @ 2016-08-13 20:09 ` Guido Trentalancia 2016-08-13 20:20 ` Dominick Grift 2016-08-14 17:35 ` Guido Trentalancia 2016-08-14 21:14 ` Guido Trentalancia 2016-08-14 22:13 ` Guido Trentalancia 2 siblings, 2 replies; 73+ messages in thread From: Guido Trentalancia @ 2016-08-13 20:09 UTC (permalink / raw) To: refpolicy Hello Dominick, thanks for getting back on this. > On the 13th of August 2016 at 16.51 Dominick Grift <dac.override@gmail.com> > wrote: > > > On 08/13/2016 04:45 PM, Guido Trentalancia wrote: > > Update for the gnome module: > > > > - a new gstreamer_orcexec_t type and file context is introduced > > to support the OIL Runtime Compiler (ORC) optimized code > > execution (used for example by pulseaudio); > > - add support for more permissions needed in gconfd_t and gnome > > keyring domains; > > - add support for a few needed fs and kernel permissions. > > > > This patch should be applied before applying the pulseaudio patch. > > > > Signed-off-by: Guido Trentalancia <guido@trentalancia.net> > > --- > > policy/modules/contrib/gnome.fc | 7 ++ > > policy/modules/contrib/gnome.if | 99 > > +++++++++++++++++++++++++++++++++++++++- > > policy/modules/contrib/gnome.te | 8 +++ > > 3 files changed, 112 insertions(+), 2 deletions(-) > > > > --- refpolicy-git-06082016-orig/policy/modules/contrib/gnome.fc 2016-08-13 > > 16:02:14.949814288 +0200 > > +++ refpolicy-git-06082016/policy/modules/contrib/gnome.fc 2016-08-13 > > 16:30:32.175198600 +0200 > > @@ -4,6 +4,7 @@ HOME_DIR/\.gnome(/.*)? gen_context(syste > > HOME_DIR/\.gnome2(/.*)? gen_context(system_u:object_r:gnome_home_t,s0) > > HOME_DIR/\.gnome2/keyrings(/.*)? > > gen_context(system_u:object_r:gnome_keyring_home_t,s0) > > HOME_DIR/\.gnome2_private(/.*)? > > gen_context(system_u:object_r:gnome_home_t,s0) > > +HOME_DIR/orcexec\..* gen_context(system_u:object_r:gstreamer_orcexec_t,s0) > > > > /etc/gconf(/.*)? gen_context(system_u:object_r:gconf_etc_t,s0) > > > > @@ -13,4 +14,8 @@ HOME_DIR/\.gnome2_private(/.*)? gen_cont > > /usr/bin/mate-keyring-daemon -- > > gen_context(system_u:object_r:gkeyringd_exec_t,s0) > > > > /usr/lib/[^/]*/gconf/gconfd-2 -- > > gen_context(system_u:object_r:gconfd_exec_t,s0) > > -/usr/libexec/gconfd-2 -- gen_context(system_u:object_r:gconfd_exec_t,s0) > > + > > +/usr/libexec/gconfd-2 -- gen_context(system_u:object_r:gconfd_exec_t,s0) > > + > > +/var/run/user/[^/]*/orcexec\..* > > gen_context(system_u:object_r:gstreamer_orcexec_t,s0) > > +/var/run/user/%{USERID}/orcexec\..* > > gen_context(system_u:object_r:gstreamer_orcexec_t,s0) > > these are files so you can be more specific about it: > > /var/run/user/[^/]*/orcexec\..* -- > gen_context(system_u:object_r:gstreamer_orcexec_t,s0) > /var/run/user/%{USERID}/orcexec\..* -- > gen_context(system_u:object_r:gstreamer_orcexec_t,s0) Thanks for pointing it out, I have now amended it. > > --- refpolicy-git-06082016-orig/policy/modules/contrib/gnome.if 2016-08-13 > > 16:02:14.950814302 +0200 > > +++ refpolicy-git-06082016/policy/modules/contrib/gnome.if 2016-08-13 > > 00:55:24.980149003 +0200 > > @@ -1,4 +1,4 @@ > > -## <summary>GNU network object model environment.</summary> > > + > > > > ######################################## > > ## <summary> > > @@ -100,9 +100,15 @@ template(`gnome_role_template',` > > > > allow $3 gnome_keyring_tmp_t:sock_file { relabel_sock_file_perms > > manage_sock_file_perms }; > > > > + userdom_manage_user_home_content_dirs($1_gkeyringd_t) > > + userdom_manage_user_home_content_files($1_gkeyringd_t) > > + userdom_manage_user_home_content_sockets($1_gkeyringd_t) > > + > I don't like this, and I dont understand it I will double check it. Hopefully, I won't forget about that, with the many other modules that are being changed... > > ps_process_pattern($3, $1_gkeyringd_t) > > allow $3 $1_gkeyringd_t:process { ptrace signal_perms }; > > > > + kernel_read_kernel_sysctls($1_gkeyringd_t) > > + > > corecmd_bin_domtrans($1_gkeyringd_t, $3) > > corecmd_shell_domtrans($1_gkeyringd_t, $3) > > > > @@ -569,6 +575,36 @@ interface(`gnome_home_filetrans_gnome_ho > > > > ######################################## > > ## <summary> > > +## Create objects in user home > > +## directories with the gstreamer > > +## orcexec type. > > +## </summary> > > +## <param name="domain"> > > +## <summary> > > +## Domain allowed access. > > +## </summary> > > +## </param> > > +## <param name="object_class"> > > +## <summary> > > +## Class of the object being created. > > +## </summary> > > +## </param> > > +## <param name="name" optional="true"> > > +## <summary> > > +## The name of the object being created. > > +## </summary> > > +## </param> > > +# > > +interface(`gnome_home_filetrans_gstreamer_orcexec',` > > + gen_require(` > > + type gstreamer_orcexec_t; > > + ') > > + > > + userdom_user_home_dir_filetrans($1, gstreamer_orcexec_t, $2, $3) > > +') > > + > > +######################################## > > +## <summary> > > ## Create objects in gnome gconf home > > ## directories with a private type. > > ## </summary> > > @@ -603,6 +639,67 @@ interface(`gnome_gconf_home_filetrans',` > > ') > > > > ######################################## > > +## <summary> > > +## Create objects in the user > > +## runtime directories with the > > +## gstreamer orcexec type. > > +## </summary> > > +## <param name="domain"> > > +## <summary> > > +## Domain allowed access. > > +## </summary> > > +## </param> > > +## <param name="object_class"> > > +## <summary> > > +## Class of the object being created. > > +## </summary> > > +## </param> > > +## <param name="name" optional="true"> > > +## <summary> > > +## The name of the object being created. > > +## </summary> > > +## </param> > > +# > > +interface(`gnome_user_runtime_filetrans_gstreamer_orcexec',` > > + gen_require(` > > + type gstreamer_orcexec_t; > > + ') > > + > > + userdom_user_runtime_filetrans($1, gstreamer_orcexec_t, $2, $3) > > +') > > + > > + > > +######################################## > > +## <summary> > > +## Create objects in the tmp > > +## directories with the gstreamer > > +## orcexec type. > > +## </summary> > > +## <param name="domain"> > > +## <summary> > > +## Domain allowed access. > > +## </summary> > > +## </param> > > +## <param name="object_class"> > > +## <summary> > > +## Class of the object being created. > > +## </summary> > > +## </param> > > +## <param name="name" optional="true"> > > +## <summary> > > +## The name of the object being created. > > +## </summary> > > +## </param> > > +# > > +interface(`gnome_tmp_filetrans_gstreamer_orcexec',` > > + gen_require(` > > + type gstreamer_orcexec_t; > > + ') > > + > > + files_tmp_filetrans($1, gstreamer_orcexec_t, $2, $3) > > +') > > + > > If you're not going to support that file in /tmp then this is not needed Removed. > > +######################################## > > ## <summary> > > ## Read generic gnome keyring home files. > > ## </summary> > > --- refpolicy-git-06082016-orig/policy/modules/contrib/gnome.te 2016-08-13 > > 16:02:14.951814316 +0200 > > +++ refpolicy-git-06082016/policy/modules/contrib/gnome.te 2016-08-13 > > 13:45:54.704254788 +0200 > > @@ -46,6 +46,9 @@ userdom_user_home_content(gnome_keyring_ > > type gnome_keyring_tmp_t; > > userdom_user_tmp_file(gnome_keyring_tmp_t) > > > > +type gstreamer_orcexec_t; > > +application_executable_file(gstreamer_orcexec_t) > > it is not an applications executable file It's very similar to it or, in other words, it is equivalent to it. I could find a better interface to describe it. But if you have other constructive ideas, please let me know and I will test them out... > > + > > ############################## > > # > > # Common local Policy > > @@ -87,8 +90,13 @@ manage_dirs_pattern(gconfd_t, gconf_tmp_ > > manage_files_pattern(gconfd_t, gconf_tmp_t, gconf_tmp_t) > > userdom_user_tmp_filetrans(gconfd_t, gconf_tmp_t, { dir file }) > > > > +kernel_dontaudit_read_system_state(gconfd_t) > > + > > +fs_getattr_xattr_fs(gconfd_t) > > + > > userdom_manage_user_tmp_dirs(gconfd_t) > > userdom_tmp_filetrans_user_tmp(gconfd_t, dir) > > +userdom_manage_user_tmp_sockets(gconfd_t) > > What is going on there and why did you choose this? I think it's to support sockets in /tmp/orbit-USER/linc-.* They are created by ORBit2. It's a library and some gnome components are linked against it. I am now working on a new revised version of this patch which introduces specific support for ORBit temporary files. > > userdom_user_runtime_filetrans_user_tmp(gconfd_t, dir) > > > > optional_policy(` > > _______________________________________________ Best regards, Guido ^ permalink raw reply [flat|nested] 73+ messages in thread
* [refpolicy] [PATCH] Update for the gnome policy and file contexts 2016-08-13 20:09 ` Guido Trentalancia @ 2016-08-13 20:20 ` Dominick Grift 2016-08-14 17:35 ` Guido Trentalancia 1 sibling, 0 replies; 73+ messages in thread From: Dominick Grift @ 2016-08-13 20:20 UTC (permalink / raw) To: refpolicy On 08/13/2016 10:09 PM, Guido Trentalancia wrote: > Hello Dominick, > > thanks for getting back on this. > >> On the 13th of August 2016 at 16.51 Dominick Grift <dac.override@gmail.com> >> wrote: >> >> >> On 08/13/2016 04:45 PM, Guido Trentalancia wrote: >>> Update for the gnome module: >>> >>> - a new gstreamer_orcexec_t type and file context is introduced >>> to support the OIL Runtime Compiler (ORC) optimized code >>> execution (used for example by pulseaudio); >>> - add support for more permissions needed in gconfd_t and gnome >>> keyring domains; >>> - add support for a few needed fs and kernel permissions. >>> >>> This patch should be applied before applying the pulseaudio patch. >>> >>> Signed-off-by: Guido Trentalancia <guido@trentalancia.net> >>> --- >>> policy/modules/contrib/gnome.fc | 7 ++ >>> policy/modules/contrib/gnome.if | 99 >>> +++++++++++++++++++++++++++++++++++++++- >>> policy/modules/contrib/gnome.te | 8 +++ >>> 3 files changed, 112 insertions(+), 2 deletions(-) >>> >>> --- refpolicy-git-06082016-orig/policy/modules/contrib/gnome.fc 2016-08-13 >>> 16:02:14.949814288 +0200 >>> +++ refpolicy-git-06082016/policy/modules/contrib/gnome.fc 2016-08-13 >>> 16:30:32.175198600 +0200 >>> @@ -4,6 +4,7 @@ HOME_DIR/\.gnome(/.*)? gen_context(syste >>> HOME_DIR/\.gnome2(/.*)? gen_context(system_u:object_r:gnome_home_t,s0) >>> HOME_DIR/\.gnome2/keyrings(/.*)? >>> gen_context(system_u:object_r:gnome_keyring_home_t,s0) >>> HOME_DIR/\.gnome2_private(/.*)? >>> gen_context(system_u:object_r:gnome_home_t,s0) >>> +HOME_DIR/orcexec\..* gen_context(system_u:object_r:gstreamer_orcexec_t,s0) >>> >>> /etc/gconf(/.*)? gen_context(system_u:object_r:gconf_etc_t,s0) >>> >>> @@ -13,4 +14,8 @@ HOME_DIR/\.gnome2_private(/.*)? gen_cont >>> /usr/bin/mate-keyring-daemon -- >>> gen_context(system_u:object_r:gkeyringd_exec_t,s0) >>> >>> /usr/lib/[^/]*/gconf/gconfd-2 -- >>> gen_context(system_u:object_r:gconfd_exec_t,s0) >>> -/usr/libexec/gconfd-2 -- gen_context(system_u:object_r:gconfd_exec_t,s0) >>> + >>> +/usr/libexec/gconfd-2 -- gen_context(system_u:object_r:gconfd_exec_t,s0) >>> + >>> +/var/run/user/[^/]*/orcexec\..* >>> gen_context(system_u:object_r:gstreamer_orcexec_t,s0) >>> +/var/run/user/%{USERID}/orcexec\..* >>> gen_context(system_u:object_r:gstreamer_orcexec_t,s0) >> >> these are files so you can be more specific about it: >> >> /var/run/user/[^/]*/orcexec\..* -- >> gen_context(system_u:object_r:gstreamer_orcexec_t,s0) >> /var/run/user/%{USERID}/orcexec\..* -- >> gen_context(system_u:object_r:gstreamer_orcexec_t,s0) > > Thanks for pointing it out, I have now amended it. > >>> --- refpolicy-git-06082016-orig/policy/modules/contrib/gnome.if 2016-08-13 >>> 16:02:14.950814302 +0200 >>> +++ refpolicy-git-06082016/policy/modules/contrib/gnome.if 2016-08-13 >>> 00:55:24.980149003 +0200 >>> @@ -1,4 +1,4 @@ >>> -## <summary>GNU network object model environment.</summary> >>> + >>> >>> ######################################## >>> ## <summary> >>> @@ -100,9 +100,15 @@ template(`gnome_role_template',` >>> >>> allow $3 gnome_keyring_tmp_t:sock_file { relabel_sock_file_perms >>> manage_sock_file_perms }; >>> >>> + userdom_manage_user_home_content_dirs($1_gkeyringd_t) >>> + userdom_manage_user_home_content_files($1_gkeyringd_t) >>> + userdom_manage_user_home_content_sockets($1_gkeyringd_t) >>> + > >> I don't like this, and I dont understand it > > I will double check it. Hopefully, I won't forget about that, with the many > other modules that are being changed... > >>> ps_process_pattern($3, $1_gkeyringd_t) >>> allow $3 $1_gkeyringd_t:process { ptrace signal_perms }; >>> >>> + kernel_read_kernel_sysctls($1_gkeyringd_t) >>> + >>> corecmd_bin_domtrans($1_gkeyringd_t, $3) >>> corecmd_shell_domtrans($1_gkeyringd_t, $3) >>> >>> @@ -569,6 +575,36 @@ interface(`gnome_home_filetrans_gnome_ho >>> >>> ######################################## >>> ## <summary> >>> +## Create objects in user home >>> +## directories with the gstreamer >>> +## orcexec type. >>> +## </summary> >>> +## <param name="domain"> >>> +## <summary> >>> +## Domain allowed access. >>> +## </summary> >>> +## </param> >>> +## <param name="object_class"> >>> +## <summary> >>> +## Class of the object being created. >>> +## </summary> >>> +## </param> >>> +## <param name="name" optional="true"> >>> +## <summary> >>> +## The name of the object being created. >>> +## </summary> >>> +## </param> >>> +# >>> +interface(`gnome_home_filetrans_gstreamer_orcexec',` >>> + gen_require(` >>> + type gstreamer_orcexec_t; >>> + ') >>> + >>> + userdom_user_home_dir_filetrans($1, gstreamer_orcexec_t, $2, $3) >>> +') >>> + >>> +######################################## >>> +## <summary> >>> ## Create objects in gnome gconf home >>> ## directories with a private type. >>> ## </summary> >>> @@ -603,6 +639,67 @@ interface(`gnome_gconf_home_filetrans',` >>> ') >>> >>> ######################################## >>> +## <summary> >>> +## Create objects in the user >>> +## runtime directories with the >>> +## gstreamer orcexec type. >>> +## </summary> >>> +## <param name="domain"> >>> +## <summary> >>> +## Domain allowed access. >>> +## </summary> >>> +## </param> >>> +## <param name="object_class"> >>> +## <summary> >>> +## Class of the object being created. >>> +## </summary> >>> +## </param> >>> +## <param name="name" optional="true"> >>> +## <summary> >>> +## The name of the object being created. >>> +## </summary> >>> +## </param> >>> +# >>> +interface(`gnome_user_runtime_filetrans_gstreamer_orcexec',` >>> + gen_require(` >>> + type gstreamer_orcexec_t; >>> + ') >>> + >>> + userdom_user_runtime_filetrans($1, gstreamer_orcexec_t, $2, $3) >>> +') >>> + >>> + >>> +######################################## >>> +## <summary> >>> +## Create objects in the tmp >>> +## directories with the gstreamer >>> +## orcexec type. >>> +## </summary> >>> +## <param name="domain"> >>> +## <summary> >>> +## Domain allowed access. >>> +## </summary> >>> +## </param> >>> +## <param name="object_class"> >>> +## <summary> >>> +## Class of the object being created. >>> +## </summary> >>> +## </param> >>> +## <param name="name" optional="true"> >>> +## <summary> >>> +## The name of the object being created. >>> +## </summary> >>> +## </param> >>> +# >>> +interface(`gnome_tmp_filetrans_gstreamer_orcexec',` >>> + gen_require(` >>> + type gstreamer_orcexec_t; >>> + ') >>> + >>> + files_tmp_filetrans($1, gstreamer_orcexec_t, $2, $3) >>> +') >>> + >> >> If you're not going to support that file in /tmp then this is not needed > > Removed. > >>> +######################################## >>> ## <summary> >>> ## Read generic gnome keyring home files. >>> ## </summary> >>> --- refpolicy-git-06082016-orig/policy/modules/contrib/gnome.te 2016-08-13 >>> 16:02:14.951814316 +0200 >>> +++ refpolicy-git-06082016/policy/modules/contrib/gnome.te 2016-08-13 >>> 13:45:54.704254788 +0200 >>> @@ -46,6 +46,9 @@ userdom_user_home_content(gnome_keyring_ >>> type gnome_keyring_tmp_t; >>> userdom_user_tmp_file(gnome_keyring_tmp_t) >>> >>> +type gstreamer_orcexec_t; >>> +application_executable_file(gstreamer_orcexec_t) >> >> it is not an applications executable file > > It's very similar to it or, in other words, it is equivalent to it. I could find > a better interface to describe it. > > But if you have other constructive ideas, please let me know and I will test > them out... It is nothing like an "application executable file". This is a file that gets mmap'd it does not get "executed", its certainly not an application, and only liborc clients mmap this file. In my policy this is just a user temporary file, or alternatively user home content file (i only support this file in $XDG_RUNTIME_DIR and not in ~, so in my policy i can just get away with classifying it user tmp(fs) file) > >>> + >>> ############################## >>> # >>> # Common local Policy >>> @@ -87,8 +90,13 @@ manage_dirs_pattern(gconfd_t, gconf_tmp_ >>> manage_files_pattern(gconfd_t, gconf_tmp_t, gconf_tmp_t) >>> userdom_user_tmp_filetrans(gconfd_t, gconf_tmp_t, { dir file }) >>> >>> +kernel_dontaudit_read_system_state(gconfd_t) >>> + >>> +fs_getattr_xattr_fs(gconfd_t) >>> + >>> userdom_manage_user_tmp_dirs(gconfd_t) >>> userdom_tmp_filetrans_user_tmp(gconfd_t, dir) >>> +userdom_manage_user_tmp_sockets(gconfd_t) >> >> What is going on there and why did you choose this? > > I think it's to support sockets in /tmp/orbit-USER/linc-.* > > They are created by ORBit2. It's a library and some gnome components are linked > against it. > > I am now working on a new revised version of this patch which introduces > specific support for ORBit temporary files. > I see. for Mate i suppose. >>> userdom_user_runtime_filetrans_user_tmp(gconfd_t, dir) >>> >>> optional_policy(` >>> _______________________________________________ > > Best regards, > > Guido > -- Key fingerprint = 5F4D 3CDB D3F8 3652 FBD8 02D5 3B6C 5F1D 2C7B 6B02 https://sks-keyservers.net/pks/lookup?op=get&search=0x3B6C5F1D2C7B6B02 Dominick Grift -------------- next part -------------- A non-text attachment was scrubbed... Name: signature.asc Type: application/pgp-signature Size: 648 bytes Desc: OpenPGP digital signature Url : http://oss.tresys.com/pipermail/refpolicy/attachments/20160813/279d0f2c/attachment.bin ^ permalink raw reply [flat|nested] 73+ messages in thread
* [refpolicy] [PATCH] Update for the gnome policy and file contexts 2016-08-13 20:09 ` Guido Trentalancia 2016-08-13 20:20 ` Dominick Grift @ 2016-08-14 17:35 ` Guido Trentalancia 2016-08-14 17:45 ` Dominick Grift 1 sibling, 1 reply; 73+ messages in thread From: Guido Trentalancia @ 2016-08-14 17:35 UTC (permalink / raw) To: refpolicy Hello Dominick. I have done some further testing and there are some problems... Please read on... On Sat, 13/08/2016 at 22.09 +0200, Guido Trentalancia wrote: > > On 08/13/2016 04:45 PM, Guido Trentalancia wrote: [....] > > > + > > > ?############################## > > > ?# > > > ?# Common local Policy > > > @@ -87,8 +90,13 @@ manage_dirs_pattern(gconfd_t, gconf_tmp_ > > > ?manage_files_pattern(gconfd_t, gconf_tmp_t, gconf_tmp_t) > > > ?userdom_user_tmp_filetrans(gconfd_t, gconf_tmp_t, { dir file }) > > > ? > > > +kernel_dontaudit_read_system_state(gconfd_t) > > > + > > > +fs_getattr_xattr_fs(gconfd_t) > > > + > > > ?userdom_manage_user_tmp_dirs(gconfd_t) > > > ?userdom_tmp_filetrans_user_tmp(gconfd_t, dir) > > > +userdom_manage_user_tmp_sockets(gconfd_t) > > > > What is going on there and why did you choose this? > > I think it's to support sockets in /tmp/orbit-USER/linc-.* > > They are created by ORBit2. It's a library and some gnome components > are linked > against it. > > I am now working on a new revised version of this patch which > introduces > specific support for ORBit temporary files. I have tested the above but met the following problem: the /tmp/orbit- USER directory is shared with other applications that run in the generic user domain ! So, if I change the type of the /tmp/orbit-USER directory to a newly created gnome_orbit_tmp_t type, then the other applications cannot access it... So, perhaps, the previous implementation which leads to userdom_manage_user_tmp_sockets(gconfd_t)?is the only way. What do you say ? Regards, Guido ^ permalink raw reply [flat|nested] 73+ messages in thread
* [refpolicy] [PATCH] Update for the gnome policy and file contexts 2016-08-14 17:35 ` Guido Trentalancia @ 2016-08-14 17:45 ` Dominick Grift 0 siblings, 0 replies; 73+ messages in thread From: Dominick Grift @ 2016-08-14 17:45 UTC (permalink / raw) To: refpolicy On 08/14/2016 07:35 PM, Guido Trentalancia wrote: > Hello Dominick. > > I have done some further testing and there are some problems... > > Please read on... > > On Sat, 13/08/2016 at 22.09 +0200, Guido Trentalancia wrote: >>> On 08/13/2016 04:45 PM, Guido Trentalancia wrote: > > [....] > >>>> + >>>> ############################## >>>> # >>>> # Common local Policy >>>> @@ -87,8 +90,13 @@ manage_dirs_pattern(gconfd_t, gconf_tmp_ >>>> manage_files_pattern(gconfd_t, gconf_tmp_t, gconf_tmp_t) >>>> userdom_user_tmp_filetrans(gconfd_t, gconf_tmp_t, { dir file }) >>>> >>>> +kernel_dontaudit_read_system_state(gconfd_t) >>>> + >>>> +fs_getattr_xattr_fs(gconfd_t) >>>> + >>>> userdom_manage_user_tmp_dirs(gconfd_t) >>>> userdom_tmp_filetrans_user_tmp(gconfd_t, dir) >>>> +userdom_manage_user_tmp_sockets(gconfd_t) >>> >>> What is going on there and why did you choose this? >> >> I think it's to support sockets in /tmp/orbit-USER/linc-.* >> >> They are created by ORBit2. It's a library and some gnome components >> are linked >> against it. >> >> I am now working on a new revised version of this patch which >> introduces >> specific support for ORBit temporary files. > > I have tested the above but met the following problem: the /tmp/orbit- > USER directory is shared with other applications that run in the > generic user domain ! Yes > > So, if I change the type of the /tmp/orbit-USER directory to a newly > created gnome_orbit_tmp_t type, then the other applications cannot > access it... You don't have to change the type of the /tmp/orbit-USER directory Instead just make gconfd_t create sockets in user_tmp_t dirs with an automatic type transition to the existing gconfd_tmp_t type: manage_sock_files_pattern(gconfd_t, gconf_tmp_t, gconf_tmp_t) userdom_user_tmp_filetrans(gconfd_t, gconf_tmp_t, sock_file) > > So, perhaps, the previous implementation which leads to > userdom_manage_user_tmp_sockets(gconfd_t) is the only way. I doubt that > > What do you say ? > > Regards, > > Guido > -- Key fingerprint = 5F4D 3CDB D3F8 3652 FBD8 02D5 3B6C 5F1D 2C7B 6B02 https://sks-keyservers.net/pks/lookup?op=get&search=0x3B6C5F1D2C7B6B02 Dominick Grift -------------- next part -------------- A non-text attachment was scrubbed... Name: signature.asc Type: application/pgp-signature Size: 648 bytes Desc: OpenPGP digital signature Url : http://oss.tresys.com/pipermail/refpolicy/attachments/20160814/582be4ce/attachment.bin ^ permalink raw reply [flat|nested] 73+ messages in thread
* [refpolicy] [PATCH] Update for the gnome policy and file contexts 2016-08-13 14:51 ` Dominick Grift 2016-08-13 20:09 ` Guido Trentalancia @ 2016-08-14 21:14 ` Guido Trentalancia 2016-08-14 21:19 ` Dominick Grift 2016-08-14 22:13 ` Guido Trentalancia 2 siblings, 1 reply; 73+ messages in thread From: Guido Trentalancia @ 2016-08-14 21:14 UTC (permalink / raw) To: refpolicy Hello Dominick ! Finally I am able to clarify one of the two open questions about the gnome module... > On the 13th of August 2016 at 16.51 Dominick Grift <dac.override@gmail.com> > wrote: > > > On 08/13/2016 04:45 PM, Guido Trentalancia wrote: > > Update for the gnome module: > > > > - a new gstreamer_orcexec_t type and file context is introduced > > to support the OIL Runtime Compiler (ORC) optimized code > > execution (used for example by pulseaudio); > > - add support for more permissions needed in gconfd_t and gnome > > keyring domains; > > - add support for a few needed fs and kernel permissions. > > > > This patch should be applied before applying the pulseaudio patch. > > > > Signed-off-by: Guido Trentalancia <guido@trentalancia.net> > > --- > > policy/modules/contrib/gnome.fc | 7 ++ > > policy/modules/contrib/gnome.if | 99 > > +++++++++++++++++++++++++++++++++++++++- > > policy/modules/contrib/gnome.te | 8 +++ > > 3 files changed, 112 insertions(+), 2 deletions(-) [...] > > --- refpolicy-git-06082016-orig/policy/modules/contrib/gnome.if 2016-08-13 > > 16:02:14.950814302 +0200 > > +++ refpolicy-git-06082016/policy/modules/contrib/gnome.if 2016-08-13 > > 00:55:24.980149003 +0200 > > @@ -1,4 +1,4 @@ > > -## <summary>GNU network object model environment.</summary> > > + > > > > ######################################## > > ## <summary> > > @@ -100,9 +100,15 @@ template(`gnome_role_template',` > > > > allow $3 gnome_keyring_tmp_t:sock_file { relabel_sock_file_perms > > manage_sock_file_perms }; > > > > + userdom_manage_user_home_content_dirs($1_gkeyringd_t) > > + userdom_manage_user_home_content_files($1_gkeyringd_t) > > + userdom_manage_user_home_content_sockets($1_gkeyringd_t) > > + > > I don't like this, and I dont understand it It's needed to write .xsession-errors and the .cache subdirectory in the user home. It is quite important, as the latter is used, amongst other things, to store user credentials: for example, when the user enters the password in the evolution mail client to retrieve his/her mail, then the password entered is stored in the cache and the user does not need to enter the password again when the mail is received again periodically later. I hope this clarifies the matter. I am checking the other issue (socket creation in /tmp) by testing the policy you suggested but unfortunately, I can anticipate that there are issues. Will let you know more precisely when I have finished testing it. Regards, Guido ^ permalink raw reply [flat|nested] 73+ messages in thread
* [refpolicy] [PATCH] Update for the gnome policy and file contexts 2016-08-14 21:14 ` Guido Trentalancia @ 2016-08-14 21:19 ` Dominick Grift 2016-08-14 21:33 ` Guido Trentalancia 0 siblings, 1 reply; 73+ messages in thread From: Dominick Grift @ 2016-08-14 21:19 UTC (permalink / raw) To: refpolicy On 08/14/2016 11:14 PM, Guido Trentalancia wrote: > Hello Dominick ! > > Finally I am able to clarify one of the two open questions about the gnome > module... > >> On the 13th of August 2016 at 16.51 Dominick Grift <dac.override@gmail.com> >> wrote: >> >> >> On 08/13/2016 04:45 PM, Guido Trentalancia wrote: >>> Update for the gnome module: >>> >>> - a new gstreamer_orcexec_t type and file context is introduced >>> to support the OIL Runtime Compiler (ORC) optimized code >>> execution (used for example by pulseaudio); >>> - add support for more permissions needed in gconfd_t and gnome >>> keyring domains; >>> - add support for a few needed fs and kernel permissions. >>> >>> This patch should be applied before applying the pulseaudio patch. >>> >>> Signed-off-by: Guido Trentalancia <guido@trentalancia.net> >>> --- >>> policy/modules/contrib/gnome.fc | 7 ++ >>> policy/modules/contrib/gnome.if | 99 >>> +++++++++++++++++++++++++++++++++++++++- >>> policy/modules/contrib/gnome.te | 8 +++ >>> 3 files changed, 112 insertions(+), 2 deletions(-) > > [...] > >>> --- refpolicy-git-06082016-orig/policy/modules/contrib/gnome.if 2016-08-13 >>> 16:02:14.950814302 +0200 >>> +++ refpolicy-git-06082016/policy/modules/contrib/gnome.if 2016-08-13 >>> 00:55:24.980149003 +0200 >>> @@ -1,4 +1,4 @@ >>> -## <summary>GNU network object model environment.</summary> >>> + >>> >>> ######################################## >>> ## <summary> >>> @@ -100,9 +100,15 @@ template(`gnome_role_template',` >>> >>> allow $3 gnome_keyring_tmp_t:sock_file { relabel_sock_file_perms >>> manage_sock_file_perms }; >>> >>> + userdom_manage_user_home_content_dirs($1_gkeyringd_t) >>> + userdom_manage_user_home_content_files($1_gkeyringd_t) >>> + userdom_manage_user_home_content_sockets($1_gkeyringd_t) >>> + >> >> I don't like this, and I dont understand it > > It's needed to write .xsession-errors and the .cache subdirectory in the user > home. > > It is quite important, as the latter is used, amongst other things, to store > user credentials: for example, when the user enters the password in the > evolution mail client to retrieve his/her mail, then the password entered is > stored in the cache and the user does not need to enter the password again when > the mail is received again periodically later. > And the .xsessions_errors file is not mislabeled? (e.g. is that supposed to be user_home_t?) As for ~/.cache issue. Probably best to hold on to that for now as chances are that refpolicy will soon associate a different type with that directory. Thus that scenario might change again soon. You did not clarify the userdom_manage_user_home_content_sockets($1_gkeyringd_t) But i am pretty sure that this socket should not be user_home_t. > I hope this clarifies the matter. > > I am checking the other issue (socket creation in /tmp) by testing the policy > you suggested but unfortunately, I can anticipate that there are issues. Will > let you know more precisely when I have finished testing it. > > Regards, > > Guido > -- Key fingerprint = 5F4D 3CDB D3F8 3652 FBD8 02D5 3B6C 5F1D 2C7B 6B02 https://sks-keyservers.net/pks/lookup?op=get&search=0x3B6C5F1D2C7B6B02 Dominick Grift -------------- next part -------------- A non-text attachment was scrubbed... Name: signature.asc Type: application/pgp-signature Size: 648 bytes Desc: OpenPGP digital signature Url : http://oss.tresys.com/pipermail/refpolicy/attachments/20160814/6cf053ca/attachment.bin ^ permalink raw reply [flat|nested] 73+ messages in thread
* [refpolicy] [PATCH] Update for the gnome policy and file contexts 2016-08-14 21:19 ` Dominick Grift @ 2016-08-14 21:33 ` Guido Trentalancia 2016-08-14 21:35 ` Dominick Grift 0 siblings, 1 reply; 73+ messages in thread From: Guido Trentalancia @ 2016-08-14 21:33 UTC (permalink / raw) To: refpolicy Hello Dominick. > On 08/14/2016 11:14 PM, Guido Trentalancia wrote: > > Hello Dominick ! > > > > Finally I am able to clarify one of the two open questions about the gnome > > module... > > > >> On the 13th of August 2016 at 16.51 Dominick Grift <dac.override@gmail.com> > >> wrote: > >> > >> > >> On 08/13/2016 04:45 PM, Guido Trentalancia wrote: > >>> Update for the gnome module: > >>> > >>> - a new gstreamer_orcexec_t type and file context is introduced > >>> to support the OIL Runtime Compiler (ORC) optimized code > >>> execution (used for example by pulseaudio); > >>> - add support for more permissions needed in gconfd_t and gnome > >>> keyring domains; > >>> - add support for a few needed fs and kernel permissions. > >>> > >>> This patch should be applied before applying the pulseaudio patch. > >>> > >>> Signed-off-by: Guido Trentalancia <guido@trentalancia.net> > >>> --- > >>> policy/modules/contrib/gnome.fc | 7 ++ > >>> policy/modules/contrib/gnome.if | 99 > >>> +++++++++++++++++++++++++++++++++++++++- > >>> policy/modules/contrib/gnome.te | 8 +++ > >>> 3 files changed, 112 insertions(+), 2 deletions(-) > > > > [...] > > > >>> --- refpolicy-git-06082016-orig/policy/modules/contrib/gnome.if 2016-08-13 > >>> 16:02:14.950814302 +0200 > >>> +++ refpolicy-git-06082016/policy/modules/contrib/gnome.if 2016-08-13 > >>> 00:55:24.980149003 +0200 > >>> @@ -1,4 +1,4 @@ > >>> -## <summary>GNU network object model environment.</summary> > >>> + > >>> > >>> ######################################## > >>> ## <summary> > >>> @@ -100,9 +100,15 @@ template(`gnome_role_template',` > >>> > >>> allow $3 gnome_keyring_tmp_t:sock_file { relabel_sock_file_perms > >>> manage_sock_file_perms }; > >>> > >>> + userdom_manage_user_home_content_dirs($1_gkeyringd_t) > >>> + userdom_manage_user_home_content_files($1_gkeyringd_t) > >>> + userdom_manage_user_home_content_sockets($1_gkeyringd_t) > >>> + > >> > >> I don't like this, and I dont understand it > > > > It's needed to write .xsession-errors and the .cache subdirectory in the > > user > > home. > > > > It is quite important, as the latter is used, amongst other things, to store > > user credentials: for example, when the user enters the password in the > > evolution mail client to retrieve his/her mail, then the password entered is > > stored in the cache and the user does not need to enter the password again > > when > > the mail is received again periodically later. > > > > And the .xsessions_errors file is not mislabeled? (e.g. is that supposed > to be user_home_t?) > > As for ~/.cache issue. Probably best to hold on to that for now as > chances are that refpolicy will soon associate a different type with > that directory. Thus that scenario might change again soon. > > You did not clarify the > userdom_manage_user_home_content_sockets($1_gkeyringd_t) > > But i am pretty sure that this socket should not be user_home_t. Might be sensitive sockets, they are named "control", "pkcs11", "ssh", "gpg" and are located in .cache/keyring-*/ They are currently labeled user_home_t. What do you suggest to do ? > > I hope this clarifies the matter. > > > > I am checking the other issue (socket creation in /tmp) by testing the > > policy > > you suggested but unfortunately, I can anticipate that there are issues. > > Will > > let you know more precisely when I have finished testing it. Best regards, Guido ^ permalink raw reply [flat|nested] 73+ messages in thread
* [refpolicy] [PATCH] Update for the gnome policy and file contexts 2016-08-14 21:33 ` Guido Trentalancia @ 2016-08-14 21:35 ` Dominick Grift 0 siblings, 0 replies; 73+ messages in thread From: Dominick Grift @ 2016-08-14 21:35 UTC (permalink / raw) To: refpolicy On 08/14/2016 11:33 PM, Guido Trentalancia wrote: > Hello Dominick. > >> On 08/14/2016 11:14 PM, Guido Trentalancia wrote: >>> Hello Dominick ! >>> >>> Finally I am able to clarify one of the two open questions about the gnome >>> module... >>> >>>> On the 13th of August 2016 at 16.51 Dominick Grift <dac.override@gmail.com> >>>> wrote: >>>> >>>> >>>> On 08/13/2016 04:45 PM, Guido Trentalancia wrote: >>>>> Update for the gnome module: >>>>> >>>>> - a new gstreamer_orcexec_t type and file context is introduced >>>>> to support the OIL Runtime Compiler (ORC) optimized code >>>>> execution (used for example by pulseaudio); >>>>> - add support for more permissions needed in gconfd_t and gnome >>>>> keyring domains; >>>>> - add support for a few needed fs and kernel permissions. >>>>> >>>>> This patch should be applied before applying the pulseaudio patch. >>>>> >>>>> Signed-off-by: Guido Trentalancia <guido@trentalancia.net> >>>>> --- >>>>> policy/modules/contrib/gnome.fc | 7 ++ >>>>> policy/modules/contrib/gnome.if | 99 >>>>> +++++++++++++++++++++++++++++++++++++++- >>>>> policy/modules/contrib/gnome.te | 8 +++ >>>>> 3 files changed, 112 insertions(+), 2 deletions(-) >>> >>> [...] >>> >>>>> --- refpolicy-git-06082016-orig/policy/modules/contrib/gnome.if 2016-08-13 >>>>> 16:02:14.950814302 +0200 >>>>> +++ refpolicy-git-06082016/policy/modules/contrib/gnome.if 2016-08-13 >>>>> 00:55:24.980149003 +0200 >>>>> @@ -1,4 +1,4 @@ >>>>> -## <summary>GNU network object model environment.</summary> >>>>> + >>>>> >>>>> ######################################## >>>>> ## <summary> >>>>> @@ -100,9 +100,15 @@ template(`gnome_role_template',` >>>>> >>>>> allow $3 gnome_keyring_tmp_t:sock_file { relabel_sock_file_perms >>>>> manage_sock_file_perms }; >>>>> >>>>> + userdom_manage_user_home_content_dirs($1_gkeyringd_t) >>>>> + userdom_manage_user_home_content_files($1_gkeyringd_t) >>>>> + userdom_manage_user_home_content_sockets($1_gkeyringd_t) >>>>> + >>>> >>>> I don't like this, and I dont understand it >>> >>> It's needed to write .xsession-errors and the .cache subdirectory in the >>> user >>> home. >>> >>> It is quite important, as the latter is used, amongst other things, to store >>> user credentials: for example, when the user enters the password in the >>> evolution mail client to retrieve his/her mail, then the password entered is >>> stored in the cache and the user does not need to enter the password again >>> when >>> the mail is received again periodically later. >>> >> >> And the .xsessions_errors file is not mislabeled? (e.g. is that supposed >> to be user_home_t?) >> >> As for ~/.cache issue. Probably best to hold on to that for now as >> chances are that refpolicy will soon associate a different type with >> that directory. Thus that scenario might change again soon. >> >> You did not clarify the >> userdom_manage_user_home_content_sockets($1_gkeyringd_t) >> >> But i am pretty sure that this socket should not be user_home_t. > > Might be sensitive sockets, they are named "control", "pkcs11", "ssh", "gpg" and > are located in .cache/keyring-*/ > > They are currently labeled user_home_t. > > What do you suggest to do ? > I would hold off on this until the XDG spec types are implemented (~/.cache) then create a private gkeyring_cache_home_t type for ~/.cache/keyring >>> I hope this clarifies the matter. >>> >>> I am checking the other issue (socket creation in /tmp) by testing the >>> policy >>> you suggested but unfortunately, I can anticipate that there are issues. >>> Will >>> let you know more precisely when I have finished testing it. > > Best regards, > > Guido > -- Key fingerprint = 5F4D 3CDB D3F8 3652 FBD8 02D5 3B6C 5F1D 2C7B 6B02 https://sks-keyservers.net/pks/lookup?op=get&search=0x3B6C5F1D2C7B6B02 Dominick Grift -------------- next part -------------- A non-text attachment was scrubbed... Name: signature.asc Type: application/pgp-signature Size: 648 bytes Desc: OpenPGP digital signature Url : http://oss.tresys.com/pipermail/refpolicy/attachments/20160814/b2191f47/attachment-0001.bin ^ permalink raw reply [flat|nested] 73+ messages in thread
* [refpolicy] [PATCH] Update for the gnome policy and file contexts 2016-08-13 14:51 ` Dominick Grift 2016-08-13 20:09 ` Guido Trentalancia 2016-08-14 21:14 ` Guido Trentalancia @ 2016-08-14 22:13 ` Guido Trentalancia 2016-08-15 6:00 ` Dominick Grift 2 siblings, 1 reply; 73+ messages in thread From: Guido Trentalancia @ 2016-08-14 22:13 UTC (permalink / raw) To: refpolicy Hello Dominick ! > On 08/13/2016 04:45 PM, Guido Trentalancia wrote: > > Update for the gnome module: > > > > - a new gstreamer_orcexec_t type and file context is introduced > > to support the OIL Runtime Compiler (ORC) optimized code > > execution (used for example by pulseaudio); > > - add support for more permissions needed in gconfd_t and gnome > > keyring domains; > > - add support for a few needed fs and kernel permissions. > > > > This patch should be applied before applying the pulseaudio patch. > > > > Signed-off-by: Guido Trentalancia <guido@trentalancia.net> > > --- > > policy/modules/contrib/gnome.fc | 7 ++ > > policy/modules/contrib/gnome.if | 99 > > +++++++++++++++++++++++++++++++++++++++- > > policy/modules/contrib/gnome.te | 8 +++ > > 3 files changed, 112 insertions(+), 2 deletions(-) [...] > > + > > ############################## > > # > > # Common local Policy > > @@ -87,8 +90,13 @@ manage_dirs_pattern(gconfd_t, gconf_tmp_ > > manage_files_pattern(gconfd_t, gconf_tmp_t, gconf_tmp_t) > > userdom_user_tmp_filetrans(gconfd_t, gconf_tmp_t, { dir file }) > > > > +kernel_dontaudit_read_system_state(gconfd_t) > > + > > +fs_getattr_xattr_fs(gconfd_t) > > + > > userdom_manage_user_tmp_dirs(gconfd_t) > > userdom_tmp_filetrans_user_tmp(gconfd_t, dir) > > +userdom_manage_user_tmp_sockets(gconfd_t) > > What is going on there and why did you choose this? Other applications (such as firefox) need to write those sockets, therefore the policy you suggested in a previous message is not feasible. In other words those sockets should be created as user_tmp_t and not as a private gconf_tmp_t. > > userdom_user_runtime_filetrans_user_tmp(gconfd_t, dir) > > > > optional_policy(` Regards, Guido ^ permalink raw reply [flat|nested] 73+ messages in thread
* [refpolicy] [PATCH] Update for the gnome policy and file contexts 2016-08-14 22:13 ` Guido Trentalancia @ 2016-08-15 6:00 ` Dominick Grift 2016-08-15 8:29 ` Dominick Grift 0 siblings, 1 reply; 73+ messages in thread From: Dominick Grift @ 2016-08-15 6:00 UTC (permalink / raw) To: refpolicy On 08/15/2016 12:13 AM, Guido Trentalancia wrote: > Hello Dominick ! > >> On 08/13/2016 04:45 PM, Guido Trentalancia wrote: >>> Update for the gnome module: >>> >>> - a new gstreamer_orcexec_t type and file context is introduced >>> to support the OIL Runtime Compiler (ORC) optimized code >>> execution (used for example by pulseaudio); >>> - add support for more permissions needed in gconfd_t and gnome >>> keyring domains; >>> - add support for a few needed fs and kernel permissions. >>> >>> This patch should be applied before applying the pulseaudio patch. >>> >>> Signed-off-by: Guido Trentalancia <guido@trentalancia.net> >>> --- >>> policy/modules/contrib/gnome.fc | 7 ++ >>> policy/modules/contrib/gnome.if | 99 >>> +++++++++++++++++++++++++++++++++++++++- >>> policy/modules/contrib/gnome.te | 8 +++ >>> 3 files changed, 112 insertions(+), 2 deletions(-) > > [...] > >>> + >>> ############################## >>> # >>> # Common local Policy >>> @@ -87,8 +90,13 @@ manage_dirs_pattern(gconfd_t, gconf_tmp_ >>> manage_files_pattern(gconfd_t, gconf_tmp_t, gconf_tmp_t) >>> userdom_user_tmp_filetrans(gconfd_t, gconf_tmp_t, { dir file }) >>> >>> +kernel_dontaudit_read_system_state(gconfd_t) >>> + >>> +fs_getattr_xattr_fs(gconfd_t) >>> + >>> userdom_manage_user_tmp_dirs(gconfd_t) >>> userdom_tmp_filetrans_user_tmp(gconfd_t, dir) >>> +userdom_manage_user_tmp_sockets(gconfd_t) >> >> What is going on there and why did you choose this? > > Other applications (such as firefox) need to write those sockets, therefore the > policy you suggested in a previous message is not feasible. > How do you figure that? > In other words those sockets should be created as user_tmp_t and not as a > private gconf_tmp_t. > >>> userdom_user_runtime_filetrans_user_tmp(gconfd_t, dir) >>> >>> optional_policy(` > > Regards, > > Guido > -- Key fingerprint = 5F4D 3CDB D3F8 3652 FBD8 02D5 3B6C 5F1D 2C7B 6B02 https://sks-keyservers.net/pks/lookup?op=get&search=0x3B6C5F1D2C7B6B02 Dominick Grift -------------- next part -------------- A non-text attachment was scrubbed... Name: signature.asc Type: application/pgp-signature Size: 648 bytes Desc: OpenPGP digital signature Url : http://oss.tresys.com/pipermail/refpolicy/attachments/20160815/fbf3e512/attachment.bin ^ permalink raw reply [flat|nested] 73+ messages in thread
* [refpolicy] [PATCH] Update for the gnome policy and file contexts 2016-08-15 6:00 ` Dominick Grift @ 2016-08-15 8:29 ` Dominick Grift 2016-08-16 19:26 ` Guido Trentalancia 0 siblings, 1 reply; 73+ messages in thread From: Dominick Grift @ 2016-08-15 8:29 UTC (permalink / raw) To: refpolicy On 08/15/2016 08:00 AM, Dominick Grift wrote: > On 08/15/2016 12:13 AM, Guido Trentalancia wrote: >> Hello Dominick ! >> >>> On 08/13/2016 04:45 PM, Guido Trentalancia wrote: >>>> Update for the gnome module: >>>> >>>> - a new gstreamer_orcexec_t type and file context is introduced >>>> to support the OIL Runtime Compiler (ORC) optimized code >>>> execution (used for example by pulseaudio); >>>> - add support for more permissions needed in gconfd_t and gnome >>>> keyring domains; >>>> - add support for a few needed fs and kernel permissions. >>>> >>>> This patch should be applied before applying the pulseaudio patch. >>>> >>>> Signed-off-by: Guido Trentalancia <guido@trentalancia.net> >>>> --- >>>> policy/modules/contrib/gnome.fc | 7 ++ >>>> policy/modules/contrib/gnome.if | 99 >>>> +++++++++++++++++++++++++++++++++++++++- >>>> policy/modules/contrib/gnome.te | 8 +++ >>>> 3 files changed, 112 insertions(+), 2 deletions(-) >> >> [...] >> >>>> + >>>> ############################## >>>> # >>>> # Common local Policy >>>> @@ -87,8 +90,13 @@ manage_dirs_pattern(gconfd_t, gconf_tmp_ >>>> manage_files_pattern(gconfd_t, gconf_tmp_t, gconf_tmp_t) >>>> userdom_user_tmp_filetrans(gconfd_t, gconf_tmp_t, { dir file }) >>>> >>>> +kernel_dontaudit_read_system_state(gconfd_t) >>>> + >>>> +fs_getattr_xattr_fs(gconfd_t) >>>> + >>>> userdom_manage_user_tmp_dirs(gconfd_t) >>>> userdom_tmp_filetrans_user_tmp(gconfd_t, dir) >>>> +userdom_manage_user_tmp_sockets(gconfd_t) >>> >>> What is going on there and why did you choose this? >> >> Other applications (such as firefox) need to write those sockets, therefore the >> policy you suggested in a previous message is not feasible. >> > > How do you figure that? > Let me just expand on this a little. I might be wrong on some of the following but i have in the past targeted gnome2 so i do have a little experience with dealing with orbit There are many sockets in orbit-USER. Every application that relies on that functionality maintains its own socket in there. It is the PRE-dbus way of communications. gconfd maintains a socket in there. It was in the past decided to target gconfd. We should now also be consistent and just finish what we started. Besides even if you leave that socket type user_tmp_t that still will leave you with the "gconfd_t:unix_stream_socket connectto" since the gconfd process does have a private type. If you start saying we will target this part of gconfd but not the other part of gconfd then you might as well not target it at all. It may not be as black-and-white as that, but it essentially boils down to that. Also beware to not let your desire to "make things work" make you forget about why were doing this in the first place: to enforce integrity. Things like these are essentially why I can't use refpolicy. Because there are too many compromises like these in there. Where it was forgotten what the purpose is of confined user domains, and where the desire to just produce something that "works" basically blurred our vision. >> In other words those sockets should be created as user_tmp_t and not as a >> private gconf_tmp_t. >> >>>> userdom_user_runtime_filetrans_user_tmp(gconfd_t, dir) >>>> >>>> optional_policy(` >> >> Regards, >> >> Guido >> > > -- Key fingerprint = 5F4D 3CDB D3F8 3652 FBD8 02D5 3B6C 5F1D 2C7B 6B02 https://sks-keyservers.net/pks/lookup?op=get&search=0x3B6C5F1D2C7B6B02 Dominick Grift -------------- next part -------------- A non-text attachment was scrubbed... Name: signature.asc Type: application/pgp-signature Size: 648 bytes Desc: OpenPGP digital signature Url : http://oss.tresys.com/pipermail/refpolicy/attachments/20160815/ab0b2be7/attachment.bin ^ permalink raw reply [flat|nested] 73+ messages in thread
* [refpolicy] [PATCH] Update for the gnome policy and file contexts 2016-08-15 8:29 ` Dominick Grift @ 2016-08-16 19:26 ` Guido Trentalancia 2016-08-16 19:30 ` Dominick Grift 0 siblings, 1 reply; 73+ messages in thread From: Guido Trentalancia @ 2016-08-16 19:26 UTC (permalink / raw) To: refpolicy Hello Dominick. Late reply to this... On Mon, 15/08/2016 at 10.29 +0200, Dominick Grift wrote: > On 08/15/2016 08:00 AM, Dominick Grift wrote: > > On 08/15/2016 12:13 AM, Guido Trentalancia wrote: > > > Hello Dominick ! > > > > > > > On 08/13/2016 04:45 PM, Guido Trentalancia wrote: > > > > > Update for the gnome module: > > > > > > > > > > - a new gstreamer_orcexec_t type and file context is > > > > > introduced > > > > > ? to support the OIL Runtime Compiler (ORC) optimized code > > > > > ? execution (used for example by pulseaudio); > > > > > - add support for more permissions needed in gconfd_t and > > > > > gnome > > > > > ? keyring domains; > > > > > - add support for a few needed fs and kernel permissions.? > > > > > > > > > > This patch should be applied before applying the pulseaudio > > > > > patch. > > > > > > > > > > Signed-off-by: Guido Trentalancia <guido@trentalancia.net> > > > > > --- > > > > > ?policy/modules/contrib/gnome.fc |????7 ++ > > > > > ?policy/modules/contrib/gnome.if |???99 > > > > > +++++++++++++++++++++++++++++++++++++++- > > > > > ?policy/modules/contrib/gnome.te |????8 +++ > > > > > ?3 files changed, 112 insertions(+), 2 deletions(-) > > > > > > [...] > > > > > > > > + > > > > > ?############################## > > > > > ?# > > > > > ?# Common local Policy > > > > > @@ -87,8 +90,13 @@ manage_dirs_pattern(gconfd_t, gconf_tmp_ > > > > > ?manage_files_pattern(gconfd_t, gconf_tmp_t, gconf_tmp_t) > > > > > ?userdom_user_tmp_filetrans(gconfd_t, gconf_tmp_t, { dir file > > > > > }) > > > > > ? > > > > > +kernel_dontaudit_read_system_state(gconfd_t) > > > > > + > > > > > +fs_getattr_xattr_fs(gconfd_t) > > > > > + > > > > > ?userdom_manage_user_tmp_dirs(gconfd_t) > > > > > ?userdom_tmp_filetrans_user_tmp(gconfd_t, dir) > > > > > +userdom_manage_user_tmp_sockets(gconfd_t) > > > > > > > > What is going on there and why did you choose this? > > > > > > Other applications (such as firefox) need to write those sockets, > > > therefore the > > > policy you suggested in a previous message is not feasible. > > > > > > > How do you figure that? > > > > Let me just expand on this a little. I might be wrong on some of the > following but i have in the past targeted gnome2 so i do have a > little > experience with dealing with orbit > > There are many sockets in orbit-USER. Every application that relies > on > that functionality maintains its own socket in there. It is the PRE- > dbus > way of communications. I have now dropped the support for ORBit-2 in the latest version of this patch. At the end, it is an obsolete library/framework. Sooner or later, we shall remove any remaining support for GConf and the rest of the Gnome2 file contexts and stuff. It's pointless and risky to keep obsolete stuff for long. In general, security goes hand in hand with keeping software up to date. > gconfd maintains a socket in there. It was in the past decided to > target > gconfd. We should now also be consistent and just finish what we > started. > > Besides even if you leave that socket type user_tmp_t that still will > leave you with the "gconfd_t:unix_stream_socket connectto" since the > gconfd process does have a private type. > > If you start saying we will target this part of gconfd but not the > other > part of gconfd then you might as well not target it at all. It may > not > be as black-and-white as that, but it essentially boils down to that. > > Also beware to not let your desire to "make things work" make you > forget > about why were doing this in the first place: to enforce integrity. > > Things like these are essentially why I can't use refpolicy. Because > there are too many compromises like these in there. Where it was I am not following you anymore... What compromises are you talking about ? The system needs to be usable, at least to a minimum level. Otherwise, the policy itself is useless. If there are permissions or interfaces that are dangerous from a security standpoint and removing them does not affect a minimum level of usability, then we should surely make any effort to remove them from the policy ! Please be more specific ! If there is something that is of your concern in the actual policy, please let me know and I will try to test if removing it affects usability, then we can proceed to get rid of it. This is very important. We need an updated tight policy that provides a minimum (eventually tunable) level of usability. > forgotten what the purpose is of confined user domains, and where the > desire to just produce something that "works" basically blurred our > vision. Well, it needs to work in the first place, otherwise there is no point of supporting a given module, we can just remove the support instead of providing a broken one. Something of my concern, for example, is too much unnecessary freedom for applications to read or manage the user_home_t files when they can be assigned their own private types instead (see for example, my recent pulseaudio patch). What specifically concerns you most ? > > > In other words those sockets should be created as user_tmp_t and > > > not as a > > > private gconf_tmp_t. > > > > > > > > ?userdom_user_runtime_filetrans_user_tmp(gconfd_t, dir) > > > > > ? > > > > > ?optional_policy(` Regards, Guido ^ permalink raw reply [flat|nested] 73+ messages in thread
* [refpolicy] [PATCH] Update for the gnome policy and file contexts 2016-08-16 19:26 ` Guido Trentalancia @ 2016-08-16 19:30 ` Dominick Grift 0 siblings, 0 replies; 73+ messages in thread From: Dominick Grift @ 2016-08-16 19:30 UTC (permalink / raw) To: refpolicy On 08/16/2016 09:26 PM, Guido Trentalancia wrote: > Hello Dominick. > > Late reply to this... > > On Mon, 15/08/2016 at 10.29 +0200, Dominick Grift wrote: >> On 08/15/2016 08:00 AM, Dominick Grift wrote: >>> On 08/15/2016 12:13 AM, Guido Trentalancia wrote: >>>> Hello Dominick ! >>>> >>>>> On 08/13/2016 04:45 PM, Guido Trentalancia wrote: >>>>>> Update for the gnome module: >>>>>> >>>>>> - a new gstreamer_orcexec_t type and file context is >>>>>> introduced >>>>>> to support the OIL Runtime Compiler (ORC) optimized code >>>>>> execution (used for example by pulseaudio); >>>>>> - add support for more permissions needed in gconfd_t and >>>>>> gnome >>>>>> keyring domains; >>>>>> - add support for a few needed fs and kernel permissions. >>>>>> >>>>>> This patch should be applied before applying the pulseaudio >>>>>> patch. >>>>>> >>>>>> Signed-off-by: Guido Trentalancia <guido@trentalancia.net> >>>>>> --- >>>>>> policy/modules/contrib/gnome.fc | 7 ++ >>>>>> policy/modules/contrib/gnome.if | 99 >>>>>> +++++++++++++++++++++++++++++++++++++++- >>>>>> policy/modules/contrib/gnome.te | 8 +++ >>>>>> 3 files changed, 112 insertions(+), 2 deletions(-) >>>> >>>> [...] >>>> >>>>>> + >>>>>> ############################## >>>>>> # >>>>>> # Common local Policy >>>>>> @@ -87,8 +90,13 @@ manage_dirs_pattern(gconfd_t, gconf_tmp_ >>>>>> manage_files_pattern(gconfd_t, gconf_tmp_t, gconf_tmp_t) >>>>>> userdom_user_tmp_filetrans(gconfd_t, gconf_tmp_t, { dir file >>>>>> }) >>>>>> >>>>>> +kernel_dontaudit_read_system_state(gconfd_t) >>>>>> + >>>>>> +fs_getattr_xattr_fs(gconfd_t) >>>>>> + >>>>>> userdom_manage_user_tmp_dirs(gconfd_t) >>>>>> userdom_tmp_filetrans_user_tmp(gconfd_t, dir) >>>>>> +userdom_manage_user_tmp_sockets(gconfd_t) >>>>> >>>>> What is going on there and why did you choose this? >>>> >>>> Other applications (such as firefox) need to write those sockets, >>>> therefore the >>>> policy you suggested in a previous message is not feasible. >>>> >>> >>> How do you figure that? >>> >> >> Let me just expand on this a little. I might be wrong on some of the >> following but i have in the past targeted gnome2 so i do have a >> little >> experience with dealing with orbit >> >> There are many sockets in orbit-USER. Every application that relies >> on >> that functionality maintains its own socket in there. It is the PRE- >> dbus >> way of communications. > > I have now dropped the support for ORBit-2 in the latest version of > this patch. At the end, it is an obsolete library/framework. > > Sooner or later, we shall remove any remaining support for GConf and > the rest of the Gnome2 file contexts and stuff. It's pointless and > risky to keep obsolete stuff for long. In general, security goes hand > in hand with keeping software up to date. > >> gconfd maintains a socket in there. It was in the past decided to >> target >> gconfd. We should now also be consistent and just finish what we >> started. >> >> Besides even if you leave that socket type user_tmp_t that still will >> leave you with the "gconfd_t:unix_stream_socket connectto" since the >> gconfd process does have a private type. >> >> If you start saying we will target this part of gconfd but not the >> other >> part of gconfd then you might as well not target it at all. It may >> not >> be as black-and-white as that, but it essentially boils down to that. >> >> Also beware to not let your desire to "make things work" make you >> forget >> about why were doing this in the first place: to enforce integrity. >> >> Things like these are essentially why I can't use refpolicy. Because >> there are too many compromises like these in there. Where it was > > I am not following you anymore... > > What compromises are you talking about ? The system needs to be usable, > at least to a minimum level. Otherwise, the policy itself is useless. > > If there are permissions or interfaces that are dangerous from a > security standpoint and removing them does not affect a minimum level > of usability, then we should surely make any effort to remove them from > the policy ! > > Please be more specific ! > > If there is something that is of your concern in the actual policy, > please let me know and I will try to test if removing it affects > usability, then we can proceed to get rid of it. This is very > important. We need an updated tight policy that provides a minimum > (eventually tunable) level of usability. > >> forgotten what the purpose is of confined user domains, and where the >> desire to just produce something that "works" basically blurred our >> vision. > > Well, it needs to work in the first place, otherwise there is no point > of supporting a given module, we can just remove the support instead of > providing a broken one. > > Something of my concern, for example, is too much unnecessary freedom > for applications to read or manage the user_home_t files when they can > be assigned their own private types instead (see for example, my recent > pulseaudio patch). > > What specifically concerns you most ? > I can't be much more specific. I think that allowing a process associated with type gconfd_t to maintain a socket with type user_tmp_t is a bad idea. Anyway's, I will leave this to others to decide. >>>> In other words those sockets should be created as user_tmp_t and >>>> not as a >>>> private gconf_tmp_t. >>>> >>>>>> userdom_user_runtime_filetrans_user_tmp(gconfd_t, dir) >>>>>> >>>>>> optional_policy(` > > Regards, > > Guido > -- Key fingerprint = 5F4D 3CDB D3F8 3652 FBD8 02D5 3B6C 5F1D 2C7B 6B02 https://sks-keyservers.net/pks/lookup?op=get&search=0x3B6C5F1D2C7B6B02 Dominick Grift -------------- next part -------------- A non-text attachment was scrubbed... Name: signature.asc Type: application/pgp-signature Size: 648 bytes Desc: OpenPGP digital signature Url : http://oss.tresys.com/pipermail/refpolicy/attachments/20160816/73f3ff93/attachment.bin ^ permalink raw reply [flat|nested] 73+ messages in thread
* [refpolicy] [PATCH v2] Update for the gnome policy and file contexts 2016-08-13 14:45 [refpolicy] [PATCH] Update for the gnome policy and file contexts Guido Trentalancia 2016-08-13 14:51 ` Dominick Grift @ 2016-08-15 21:33 ` Guido Trentalancia 2016-08-15 20:08 ` Chris PeBenito 2016-08-20 14:52 ` [refpolicy] [PATCH v3] " Guido Trentalancia 1 sibling, 2 replies; 73+ messages in thread From: Guido Trentalancia @ 2016-08-15 21:33 UTC (permalink / raw) To: refpolicy Update for the gnome module: - a new gstreamer_orcexec_t type and file context is introduced to support the OIL Runtime Compiler (ORC) optimized code execution (used for example by pulseaudio); - add support for more permissions needed in gconfd_t and gnome keyring domains; - add support for chat over dbus in the gconfd domain; - add support for a few needed fs and kernel permissions. Compared to the previous version of this patch, the support for Gnome2/ORBit-2 has been dropped. Recent changes to the pulseaudio module depends on this patch ! Signed-off-by: Guido Trentalancia <guido@trentalancia.net> --- policy/modules/contrib/gnome.fc | 9 +++ policy/modules/contrib/gnome.if | 100 +++++++++++++++++++++++++++++++++++++++- policy/modules/contrib/gnome.te | 12 ++++ 3 files changed, 118 insertions(+), 3 deletions(-) --- refpolicy-git-06082016-orig/policy/modules/contrib/gnome.fc 2016-08-06 21:27:11.354094337 +0200 +++ refpolicy-git-06082016/policy/modules/contrib/gnome.fc 2016-08-15 17:06:46.933458938 +0200 @@ -4,6 +4,9 @@ HOME_DIR/\.gnome(/.*)? gen_context(syste HOME_DIR/\.gnome2(/.*)? gen_context(system_u:object_r:gnome_home_t,s0) HOME_DIR/\.gnome2/keyrings(/.*)? gen_context(system_u:object_r:gnome_keyring_home_t,s0) HOME_DIR/\.gnome2_private(/.*)? gen_context(system_u:object_r:gnome_home_t,s0) +HOME_DIR/\.cache/keyring[^/]+(/.*)? gen_context(system_u:object_r:gnome_keyring_cache_home_t,s0) + +HOME_DIR/orcexec\..* gen_context(system_u:object_r:gstreamer_orcexec_t,s0) /etc/gconf(/.*)? gen_context(system_u:object_r:gconf_etc_t,s0) @@ -13,4 +16,8 @@ HOME_DIR/\.gnome2_private(/.*)? gen_cont /usr/bin/mate-keyring-daemon -- gen_context(system_u:object_r:gkeyringd_exec_t,s0) /usr/lib/[^/]*/gconf/gconfd-2 -- gen_context(system_u:object_r:gconfd_exec_t,s0) -/usr/libexec/gconfd-2 -- gen_context(system_u:object_r:gconfd_exec_t,s0) + +/usr/libexec/gconfd-2 -- gen_context(system_u:object_r:gconfd_exec_t,s0) + +/var/run/user/[^/]*/orcexec\..* -- gen_context(system_u:object_r:gstreamer_orcexec_t,s0) +/var/run/user/%{USERID}/orcexec\..* -- gen_context(system_u:object_r:gstreamer_orcexec_t,s0) --- refpolicy-git-06082016-orig/policy/modules/contrib/gnome.if 2016-08-06 21:27:11.354094337 +0200 +++ refpolicy-git-06082016/policy/modules/contrib/gnome.if 2016-08-15 19:18:12.011401521 +0200 @@ -1,4 +1,4 @@ -## <summary>GNU network object model environment.</summary> + ######################################## ## <summary> @@ -44,7 +44,7 @@ template(`gnome_role_template',` gen_require(` attribute gnomedomain, gkeyringd_domain; attribute_role gconfd_roles; - type gkeyringd_exec_t, gnome_keyring_home_t, gnome_keyring_tmp_t; + type gkeyringd_exec_t, gnome_keyring_home_t, gnome_keyring_cache_home_t, gnome_keyring_tmp_t; type gconfd_t, gconfd_exec_t, gconf_tmp_t; type gconf_home_t; ') @@ -100,9 +100,23 @@ template(`gnome_role_template',` allow $3 gnome_keyring_tmp_t:sock_file { relabel_sock_file_perms manage_sock_file_perms }; + userdom_manage_user_home_content_dirs($1_gkeyringd_t) + userdom_manage_user_home_content_files($1_gkeyringd_t) + + manage_dirs_pattern($1_gkeyringd_t, gnome_keyring_cache_home_t, gnome_keyring_cache_home_t) + userdom_user_home_content_filetrans($1_gkeyringd_t, gnome_keyring_cache_home_t, dir) + + manage_sock_files_pattern($1_gkeyringd_t, gnome_keyring_cache_home_t, gnome_keyring_cache_home_t) + userdom_user_home_content_filetrans($1_gkeyringd_t, gnome_keyring_cache_home_t, sock_file, "control") + userdom_user_home_content_filetrans($1_gkeyringd_t, gnome_keyring_cache_home_t, sock_file, "gpg") + userdom_user_home_content_filetrans($1_gkeyringd_t, gnome_keyring_cache_home_t, sock_file, "pkcs11") + userdom_user_home_content_filetrans($1_gkeyringd_t, gnome_keyring_cache_home_t, sock_file, "ssh") + ps_process_pattern($3, $1_gkeyringd_t) allow $3 $1_gkeyringd_t:process { ptrace signal_perms }; + kernel_read_kernel_sysctls($1_gkeyringd_t) + corecmd_bin_domtrans($1_gkeyringd_t, $3) corecmd_shell_domtrans($1_gkeyringd_t, $3) @@ -112,6 +126,7 @@ template(`gnome_role_template',` dbus_spec_session_domain($1, $1_gkeyringd_t, gkeyringd_exec_t) optional_policy(` + gnome_dbus_chat_gconfd($3) gnome_dbus_chat_gkeyringd($1, $3) ') ') @@ -569,6 +584,36 @@ interface(`gnome_home_filetrans_gnome_ho ######################################## ## <summary> +## Create objects in user home +## directories with the gstreamer +## orcexec type. +## </summary> +## <param name="domain"> +## <summary> +## Domain allowed access. +## </summary> +## </param> +## <param name="object_class"> +## <summary> +## Class of the object being created. +## </summary> +## </param> +## <param name="name" optional="true"> +## <summary> +## The name of the object being created. +## </summary> +## </param> +# +interface(`gnome_home_filetrans_gstreamer_orcexec',` + gen_require(` + type gstreamer_orcexec_t; + ') + + userdom_user_home_dir_filetrans($1, gstreamer_orcexec_t, $2, $3) +') + +######################################## +## <summary> ## Create objects in gnome gconf home ## directories with a private type. ## </summary> @@ -604,6 +649,36 @@ interface(`gnome_gconf_home_filetrans',` ######################################## ## <summary> +## Create objects in the user +## runtime directories with the +## gstreamer orcexec type. +## </summary> +## <param name="domain"> +## <summary> +## Domain allowed access. +## </summary> +## </param> +## <param name="object_class"> +## <summary> +## Class of the object being created. +## </summary> +## </param> +## <param name="name" optional="true"> +## <summary> +## The name of the object being created. +## </summary> +## </param> +# +interface(`gnome_user_runtime_filetrans_gstreamer_orcexec',` + gen_require(` + type gstreamer_orcexec_t; + ') + + userdom_user_runtime_filetrans($1, gstreamer_orcexec_t, $2, $3) +') + +######################################## +## <summary> ## Read generic gnome keyring home files. ## </summary> ## <param name="domain"> @@ -622,6 +697,27 @@ interface(`gnome_read_keyring_home_files ') ######################################## +## <summary> +## Send and receive messages from +## the gconf daemon over dbus. +## </summary> +## <param name="domain"> +## <summary> +## Domain allowed access. +## </summary> +## </param> +# +interface(`gnome_dbus_chat_gconfd',` + gen_require(` + type gconfd_t; + class dbus send_msg; + ') + + allow $1 gconfd_t:dbus send_msg; + allow gconfd_t $1:dbus send_msg; +') + +######################################## ## <summary> ## Send and receive messages from ## gnome keyring daemon over dbus. --- refpolicy-git-06082016-orig/policy/modules/contrib/gnome.te 2016-08-06 21:27:11.354094337 +0200 +++ refpolicy-git-06082016/policy/modules/contrib/gnome.te 2016-08-15 21:09:21.914336714 +0200 @@ -43,9 +43,15 @@ application_executable_file(gkeyringd_ex type gnome_keyring_home_t; userdom_user_home_content(gnome_keyring_home_t) +type gnome_keyring_cache_home_t; +userdom_user_home_content(gnome_keyring_cache_home_t) + type gnome_keyring_tmp_t; userdom_user_tmp_file(gnome_keyring_tmp_t) +type gstreamer_orcexec_t; +application_executable_file(gstreamer_orcexec_t) + ############################## # # Common local Policy @@ -87,6 +93,12 @@ manage_dirs_pattern(gconfd_t, gconf_tmp_ manage_files_pattern(gconfd_t, gconf_tmp_t, gconf_tmp_t) userdom_user_tmp_filetrans(gconfd_t, gconf_tmp_t, { dir file }) +kernel_dontaudit_read_system_state(gconfd_t) + +files_search_tmp(gconfd_t) + +fs_getattr_xattr_fs(gconfd_t) + userdom_manage_user_tmp_dirs(gconfd_t) userdom_tmp_filetrans_user_tmp(gconfd_t, dir) userdom_user_runtime_filetrans_user_tmp(gconfd_t, dir) ^ permalink raw reply [flat|nested] 73+ messages in thread
* [refpolicy] [PATCH v2] Update for the gnome policy and file contexts 2016-08-15 21:33 ` [refpolicy] [PATCH v2] " Guido Trentalancia @ 2016-08-15 20:08 ` Chris PeBenito 2016-08-20 14:52 ` [refpolicy] [PATCH v3] " Guido Trentalancia 1 sibling, 0 replies; 73+ messages in thread From: Chris PeBenito @ 2016-08-15 20:08 UTC (permalink / raw) To: refpolicy On 08/15/16 17:33, Guido Trentalancia wrote: > Update for the gnome module: > > - a new gstreamer_orcexec_t type and file context is introduced > to support the OIL Runtime Compiler (ORC) optimized code > execution (used for example by pulseaudio); > - add support for more permissions needed in gconfd_t and gnome > keyring domains; > - add support for chat over dbus in the gconfd domain; > - add support for a few needed fs and kernel permissions. > > Compared to the previous version of this patch, the support for > Gnome2/ORBit-2 has been dropped. > > Recent changes to the pulseaudio module depends on this patch ! [...] > --- refpolicy-git-06082016-orig/policy/modules/contrib/gnome.if 2016-08-06 21:27:11.354094337 +0200 > +++ refpolicy-git-06082016/policy/modules/contrib/gnome.if 2016-08-15 19:18:12.011401521 +0200 > @@ -1,4 +1,4 @@ > -## <summary>GNU network object model environment.</summary> > + This was probably a mistake, but please don't remove the XML. > ######################################## > ## <summary> > @@ -44,7 +44,7 @@ template(`gnome_role_template',` > gen_require(` > attribute gnomedomain, gkeyringd_domain; > attribute_role gconfd_roles; > - type gkeyringd_exec_t, gnome_keyring_home_t, gnome_keyring_tmp_t; > + type gkeyringd_exec_t, gnome_keyring_home_t, gnome_keyring_cache_home_t, gnome_keyring_tmp_t; > type gconfd_t, gconfd_exec_t, gconf_tmp_t; > type gconf_home_t; > ') > @@ -100,9 +100,23 @@ template(`gnome_role_template',` > > allow $3 gnome_keyring_tmp_t:sock_file { relabel_sock_file_perms manage_sock_file_perms }; > > + userdom_manage_user_home_content_dirs($1_gkeyringd_t) > + userdom_manage_user_home_content_files($1_gkeyringd_t) This is discussed in another thread, I am concerned about these permissions for the same reason Dominick is. > + manage_dirs_pattern($1_gkeyringd_t, gnome_keyring_cache_home_t, gnome_keyring_cache_home_t) > + userdom_user_home_content_filetrans($1_gkeyringd_t, gnome_keyring_cache_home_t, dir) > + > + manage_sock_files_pattern($1_gkeyringd_t, gnome_keyring_cache_home_t, gnome_keyring_cache_home_t) > + userdom_user_home_content_filetrans($1_gkeyringd_t, gnome_keyring_cache_home_t, sock_file, "control") > + userdom_user_home_content_filetrans($1_gkeyringd_t, gnome_keyring_cache_home_t, sock_file, "gpg") > + userdom_user_home_content_filetrans($1_gkeyringd_t, gnome_keyring_cache_home_t, sock_file, "pkcs11") > + userdom_user_home_content_filetrans($1_gkeyringd_t, gnome_keyring_cache_home_t, sock_file, "ssh") I suspect putting the socket names is unnecessary. It doesn't appear to create different types of sockets in the same directory. > ps_process_pattern($3, $1_gkeyringd_t) > allow $3 $1_gkeyringd_t:process { ptrace signal_perms }; > > + kernel_read_kernel_sysctls($1_gkeyringd_t) > + > corecmd_bin_domtrans($1_gkeyringd_t, $3) > corecmd_shell_domtrans($1_gkeyringd_t, $3) > > @@ -112,6 +126,7 @@ template(`gnome_role_template',` > dbus_spec_session_domain($1, $1_gkeyringd_t, gkeyringd_exec_t) > > optional_policy(` > + gnome_dbus_chat_gconfd($3) > gnome_dbus_chat_gkeyringd($1, $3) > ') > ') > @@ -569,6 +584,36 @@ interface(`gnome_home_filetrans_gnome_ho > > ######################################## > ## <summary> > +## Create objects in user home > +## directories with the gstreamer > +## orcexec type. > +## </summary> > +## <param name="domain"> > +## <summary> > +## Domain allowed access. > +## </summary> > +## </param> > +## <param name="object_class"> > +## <summary> > +## Class of the object being created. > +## </summary> > +## </param> > +## <param name="name" optional="true"> > +## <summary> > +## The name of the object being created. > +## </summary> > +## </param> > +# > +interface(`gnome_home_filetrans_gstreamer_orcexec',` This should be gnome_user_home_dir_filetrans_orcexec() or gnome_user_home_dir_filetrans_gstreamer() orcexec [...] > +interface(`gnome_user_runtime_filetrans_gstreamer_orcexec',` > + gen_require(` > + type gstreamer_orcexec_t; > + ') > + > + userdom_user_runtime_filetrans($1, gstreamer_orcexec_t, $2, $3) > +') Right naming scheme, but if you drop the "gstreamer" out of the previous interface name, do the same here. -- Chris PeBenito ^ permalink raw reply [flat|nested] 73+ messages in thread
* [refpolicy] [PATCH v3] Update for the gnome policy and file contexts 2016-08-15 21:33 ` [refpolicy] [PATCH v2] " Guido Trentalancia 2016-08-15 20:08 ` Chris PeBenito @ 2016-08-20 14:52 ` Guido Trentalancia 2016-08-21 18:49 ` Dominick Grift 2016-08-22 19:39 ` [refpolicy] [PATCH v4] " Guido Trentalancia 1 sibling, 2 replies; 73+ messages in thread From: Guido Trentalancia @ 2016-08-20 14:52 UTC (permalink / raw) To: refpolicy Update for the gnome module: - target the dconf daemon, the gsettings user application, the gnome-settings-daemon and the at-spi daemon with all the needed domain transitions; - a new gstreamer_orcexec_t type and file context is introduced to support the OIL Runtime Compiler (ORC) optimized code execution (used for example by pulseaudio); - add support for more permissions needed in gconfd_t and gnome keyring domains; - add support for chat over dbus in the gconfd domain and in the new domains (dconf, gsettings, etc); - add support for a few needed fs and kernel permissions. - add support for reading the colord related files in the home directories (such as the ICC EDID profiles): requires the recent colord patch; - add support for for reading the colord related files in the home directories in the common user domain template; - add support for a new mime_info_t type to be used in the home directories; - includes minor modifications to the consolekit, dbus and policykit modules to support the new targeted gnome daemons and applications; - modifies the pulseaudio module to introduce new interfaces to read and write pulseaudio tmpfs files and to use the pulseaudio file descriptor. The support for Gnome2/ORBit-2 (version 2) has been dropped. This patch depends on the recent colord patch. Recent changes to the pulseaudio module depends on this patch ! Signed-off-by: Guido Trentalancia <guido@trentalancia.net> --- policy/modules/contrib/colord.if | 41 +++ policy/modules/contrib/colord.te | 4 policy/modules/contrib/consolekit.te | 4 policy/modules/contrib/dbus.te | 9 policy/modules/contrib/gnome.fc | 19 + policy/modules/contrib/gnome.if | 426 ++++++++++++++++++++++++++++++++++- policy/modules/contrib/gnome.te | 267 +++++++++++++++++++++ policy/modules/contrib/policykit.fc | 2 policy/modules/contrib/policykit.if | 20 + policy/modules/contrib/policykit.te | 1 policy/modules/contrib/pulseaudio.if | 77 ++++++ policy/modules/contrib/pulseaudio.te | 5 policy/modules/system/userdomain.if | 4 13 files changed, 876 insertions(+), 3 deletions(-) --- refpolicy-git-06082016-orig/policy/modules/contrib/colord.if 2016-08-06 21:27:11.338094155 +0200 +++ refpolicy-git-06082016/policy/modules/contrib/colord.if 2016-08-19 23:13:27.765740337 +0200 @@ -58,3 +58,44 @@ interface(`colord_read_lib_files',` files_search_var_lib($1) read_files_pattern($1, colord_var_lib_t, colord_var_lib_t) ') + +###################################### +## <summary> +## Read colord home files. +## </summary> +## <param name="domain"> +## <summary> +## Domain allowed access. +## </summary> +## </param> +# +interface(`colord_read_home_files',` + gen_require(` + type colord_home_t; + ') + + userdom_search_user_home_dirs($1) + userdom_list_user_home_content($1) + read_files_pattern($1, colord_home_t, colord_home_t) +') + +###################################### +## <summary> +## Create, read, write, and delete +## colord home content. +## </summary> +## <param name="domain"> +## <summary> +## Domain allowed access. +## </summary> +## </param> +# +interface(`colord_manage_home_files',` + gen_require(` + type colord_home_t; + ') + + userdom_search_user_home_dirs($1) + userdom_list_user_home_content($1) + manage_files_pattern($1, colord_home_t, colord_home_t) +') --- refpolicy-git-14082016/policy/modules/contrib/colord.te 2016-08-14 21:28:11.468519205 +0200 +++ refpolicy-git-06082016/policy/modules/contrib/colord.te 2016-08-20 00:21:47.786192022 +0200 @@ -123,6 +136,10 @@ optional_policy(` ') optional_policy(` + gnome_settings_daemon_use_fds(colord_t) +') + +optional_policy(` policykit_dbus_chat(colord_t) policykit_domtrans_auth(colord_t) policykit_read_lib(colord_t)--- refpolicy-git-06082016-orig/policy/modules/contrib/consolekit.te 2016-08-07 23:05:57.060018494 +0200 +++ refpolicy-git-06082016/policy/modules/contrib/consolekit.te 2016-08-19 22:13:01.508709501 +0200 @@ -104,6 +101,10 @@ tunable_policy(`use_samba_home_dirs',` ') optional_policy(` + gnome_read_settings_daemon_files(consolekit_t) +') + +optional_policy(` dbus_read_lib_files(consolekit_t) dbus_system_domain(consolekit_t, consolekit_exec_t) --- refpolicy-git-06082016-orig/policy/modules/contrib/dbus.te 2016-08-06 21:27:11.344094223 +0200 +++ refpolicy-git-06082016/policy/modules/contrib/dbus.te 2016-08-20 00:27:48.730380843 +0200 @@ -148,6 +148,15 @@ optional_policy(` ') optional_policy(` + colord_read_home_files(system_dbusd_t) +') + +optional_policy(` + gnome_read_settings_daemon_files(system_dbusd_t) + gnome_settings_daemon_use_fds(system_dbusd_t) +') + +optional_policy(` policykit_read_lib(system_dbusd_t) ') --- refpolicy-git-06082016-orig/policy/modules/contrib/gnome.fc 2016-08-06 21:27:11.354094337 +0200 +++ refpolicy-git-06082016/policy/modules/contrib/gnome.fc 2016-08-19 23:26:12.625475184 +0200 @@ -1,16 +1,33 @@ +HOME_DIR/\.cache/dconf(/.*)? gen_context(system_u:object_r:dconf_home_t,s0) +HOME_DIR/\.cache/keyring[^/]+(/.*)? gen_context(system_u:object_r:gnome_keyring_cache_home_t,s0) +HOME_DIR/\.config/dconf(/.*)? gen_context(system_u:object_r:dconf_home_t,s0) HOME_DIR/\.gconf(/.*)? gen_context(system_u:object_r:gconf_home_t,s0) HOME_DIR/\.gconfd(/.*)? gen_context(system_u:object_r:gconf_home_t,s0) HOME_DIR/\.gnome(/.*)? gen_context(system_u:object_r:gnome_home_t,s0) HOME_DIR/\.gnome2(/.*)? gen_context(system_u:object_r:gnome_home_t,s0) HOME_DIR/\.gnome2/keyrings(/.*)? gen_context(system_u:object_r:gnome_keyring_home_t,s0) HOME_DIR/\.gnome2_private(/.*)? gen_context(system_u:object_r:gnome_home_t,s0) +HOME_DIR/\.local/share/mime(/.*)? gen_context(system_u:object_r:mime_info_t,s0) + +HOME_DIR/orcexec\..* gen_context(system_u:object_r:gstreamer_orcexec_t,s0) /etc/gconf(/.*)? gen_context(system_u:object_r:gconf_etc_t,s0) /tmp/gconfd-USER/.* -- gen_context(system_u:object_r:gconf_tmp_t,s0) /usr/bin/gnome-keyring-daemon -- gen_context(system_u:object_r:gkeyringd_exec_t,s0) +/usr/bin/gsettings -- gen_context(system_u:object_r:gnome_settings_exec_t,s0) /usr/bin/mate-keyring-daemon -- gen_context(system_u:object_r:gkeyringd_exec_t,s0) /usr/lib/[^/]*/gconf/gconfd-2 -- gen_context(system_u:object_r:gconfd_exec_t,s0) -/usr/libexec/gconfd-2 -- gen_context(system_u:object_r:gconfd_exec_t,s0) + +/usr/libexec/at-spi-bus-launcher -- gen_context(system_u:object_r:at_spi_exec_t,s0) +/usr/libexec/dconf-service -- gen_context(system_u:object_r:dconf_exec_t,s0) +/usr/libexec/gconfd-2 -- gen_context(system_u:object_r:gconfd_exec_t,s0) +/usr/libexec/gnome-settings-daemon -- gen_context(system_u:object_r:gnome_settings_daemon_exec_t,s0) +/usr/libexec/gsd-[^/]* -- gen_context(system_u:object_r:gnome_settings_daemon_exec_t,s0) + +/usr/share/glib-[^/]*/schemas(/.*)? gen_context(system_u:object_r:gnome_settings_schemas_t,s0) + +/var/run/user/[^/]*/orcexec\..* -- gen_context(system_u:object_r:gstreamer_orcexec_t,s0) +/var/run/user/%{USERID}/orcexec\..* -- gen_context(system_u:object_r:gstreamer_orcexec_t,s0) --- refpolicy-git-06082016-orig/policy/modules/contrib/gnome.if 2016-08-06 21:27:11.354094337 +0200 +++ refpolicy-git-06082016/policy/modules/contrib/gnome.if 2016-08-20 03:27:52.570896165 +0200 @@ -43,14 +43,40 @@ interface(`gnome_role',` template(`gnome_role_template',` gen_require(` attribute gnomedomain, gkeyringd_domain; + attribute_role dconf_roles; + attribute_role at_spi_roles; attribute_role gconfd_roles; - type gkeyringd_exec_t, gnome_keyring_home_t, gnome_keyring_tmp_t; + attribute_role gnome_settings_roles; + attribute_role gnome_settings_daemon_roles; + type dconf_t, dconf_exec_t, dconf_home_t; + type at_spi_t, at_spi_exec_t; type gconfd_t, gconfd_exec_t, gconf_tmp_t; type gconf_home_t; + type gnome_settings_t, gnome_settings_exec_t; + type gnome_settings_daemon_t, gnome_settings_daemon_exec_t; + type gnome_settings_schemas_t; + type gkeyringd_exec_t, gnome_keyring_home_t, gnome_keyring_cache_home_t, gnome_keyring_tmp_t; + type mime_info_t; + type user_dbusd_t; + type dbusd_exec_t; ') ######################################## # + # Dconf declarations + # + + roleattribute $2 dconf_roles; + + ######################################## + # + # At-spi declarations + # + + roleattribute $2 at_spi_roles; + + ######################################## + # # Gconf declarations # @@ -58,6 +84,20 @@ template(`gnome_role_template',` ######################################## # + # Gnome-settings declarations + # + + roleattribute $2 gnome_settings_roles; + + ######################################## + # + # Gnome-settings-daemon declarations + # + + roleattribute $2 gnome_settings_daemon_roles; + + ######################################## + # # Gkeyringd declarations # @@ -69,6 +109,70 @@ template(`gnome_role_template',` ######################################## # + # Common policy + # + + allow $3 dconf_home_t:dir manage_dir_perms; + allow $3 dconf_home_t:file manage_file_perms; + allow $3 dconf_home_t:lnk_file manage_lnk_file_perms; + + allow $3 gnome_settings_schemas_t:dir list_dir_perms; + allow $3 gnome_settings_schemas_t:file read_file_perms; + allow $3 gnome_settings_schemas_t:lnk_file read_lnk_file_perms; + + allow $3 mime_info_t:dir list_dir_perms; + allow $3 mime_info_t:file read_file_perms; + + allow at_spi_t user_dbusd_t:process signal; + + allow user_dbusd_t self:process signal; + + allow user_dbusd_t bin_t:file entrypoint; + + allow user_dbusd_t dbusd_exec_t:file exec_file_perms; + + gnome_read_settings_files(user_dbusd_t) + gnome_read_settings_daemon_files(user_dbusd_t) + + files_read_usr_files($3) + + kernel_read_system_state(user_dbusd_t) + + optional_policy(` + xserver_read_user_xauth(user_dbusd_t) + xserver_stream_connect(user_dbusd_t) + ') + + ######################################## + # + # Dconf policy + # + + allow dconf_t user_dbusd_t:unix_stream_socket connectto; + + allow user_dbusd_t dconf_exec_t:file { entrypoint exec_file_perms }; + + domtrans_pattern(user_dbusd_t, dconf_exec_t, dconf_t) + + ######################################## + # + # At-spi policy + # + + allow at_spi_t user_dbusd_t:unix_stream_socket connectto; + + allow at_spi_t dbusd_exec_t:file { entrypoint exec_file_perms }; + + allow user_dbusd_t at_spi_exec_t:file { entrypoint exec_file_perms }; + + allow $3 at_spi_t:fd use; + + domtrans_pattern(at_spi_t, dbusd_exec_t, user_dbusd_t) + + domtrans_pattern(user_dbusd_t, at_spi_exec_t, at_spi_t) + + ######################################## + # # Gconf policy # @@ -84,6 +188,38 @@ template(`gnome_role_template',` ######################################## # + # Gnome-settings policy + # + + domtrans_pattern($3, gnome_settings_exec_t, gnome_settings_t) + + allow $3 gnome_settings_t:process { ptrace signal_perms }; + ps_process_pattern($3, gnome_settings_t) + + allow gnome_settings_t user_dbusd_t:unix_stream_socket connectto; + + allow gnome_settings_t bin_t:file entrypoint; + allow gnome_settings_t dbusd_exec_t:file { entrypoint exec_file_perms }; + + # for dbus-launch + corecmd_bin_domtrans(gnome_settings_t, user_dbusd_t) + + domtrans_pattern(gnome_settings_t, dbusd_exec_t, user_dbusd_t) + + ######################################## + # + # Gnome-settings-daemon policy + # + + domtrans_pattern($3, gnome_settings_daemon_exec_t, gnome_settings_daemon_t) + + allow gnome_settings_daemon_t user_dbusd_t:unix_stream_socket connectto; + + allow $3 gnome_settings_daemon_t:process { ptrace signal_perms }; + ps_process_pattern($3, gnome_settings_daemon_t) + + ######################################## + # # Gkeyringd policy # @@ -100,23 +236,85 @@ template(`gnome_role_template',` allow $3 gnome_keyring_tmp_t:sock_file { relabel_sock_file_perms manage_sock_file_perms }; + userdom_manage_user_home_content_dirs($1_gkeyringd_t) + userdom_manage_user_home_content_files($1_gkeyringd_t) + + manage_dirs_pattern($1_gkeyringd_t, gnome_keyring_cache_home_t, gnome_keyring_cache_home_t) + userdom_user_home_content_filetrans($1_gkeyringd_t, gnome_keyring_cache_home_t, dir) + + manage_sock_files_pattern($1_gkeyringd_t, gnome_keyring_cache_home_t, gnome_keyring_cache_home_t) + userdom_user_home_content_filetrans($1_gkeyringd_t, gnome_keyring_cache_home_t, sock_file) + ps_process_pattern($3, $1_gkeyringd_t) allow $3 $1_gkeyringd_t:process { ptrace signal_perms }; + kernel_read_kernel_sysctls($1_gkeyringd_t) + corecmd_bin_domtrans($1_gkeyringd_t, $3) corecmd_shell_domtrans($1_gkeyringd_t, $3) gnome_stream_connect_gkeyringd($1, $3) optional_policy(` + dbus_connect_spec_session_bus(user, dconf_t) + dbus_connect_spec_session_bus(user, at_spi_t) + dbus_connect_spec_session_bus(user, gnome_settings_daemon_t) + dbus_connect_system_bus(gnome_settings_daemon_t) + dbus_send_spec_session_bus(user, dconf_t) + dbus_send_spec_session_bus(user, at_spi_t) + dbus_send_spec_session_bus(user, gnome_settings_daemon_t) dbus_spec_session_domain($1, $1_gkeyringd_t, gkeyringd_exec_t) optional_policy(` + gnome_dbus_chat_dconf($3) + gnome_dbus_chat_dconf(gnome_settings_t) + gnome_dbus_chat_at_spi($3) + gnome_dbus_chat_gconfd($3) + gnome_dbus_chat_gnome_settings(user_dbusd_t) + gnome_dbus_chat_gnome_settings_daemon($3) + gnome_dbus_chat_gnome_settings_daemon(at_spi_t) gnome_dbus_chat_gkeyringd($1, $3) ') ') ') +####################################### +## <summary> +## Read gnome-settings files. +## </summary> +## <param name="domain"> +## <summary> +## Domain allowed access. +## </summary> +## </param> +# +interface(`gnome_read_settings_files',` + gen_require(` + type gnome_settings_t; + ') + + read_files_pattern($1, gnome_settings_t, gnome_settings_t) +') + +####################################### +## <summary> +## Read gnome-settings-daemon +## files. +## </summary> +## <param name="domain"> +## <summary> +## Domain allowed access. +## </summary> +## </param> +# +interface(`gnome_read_settings_daemon_files',` + gen_require(` + type gnome_settings_daemon_t; + ') + + read_files_pattern($1, gnome_settings_daemon_t, gnome_settings_daemon_t) +') + ######################################## ## <summary> ## Execute gconf in the caller domain. @@ -569,6 +767,36 @@ interface(`gnome_home_filetrans_gnome_ho ######################################## ## <summary> +## Create objects in user home +## directories with the gstreamer +## orcexec type. +## </summary> +## <param name="domain"> +## <summary> +## Domain allowed access. +## </summary> +## </param> +## <param name="object_class"> +## <summary> +## Class of the object being created. +## </summary> +## </param> +## <param name="name" optional="true"> +## <summary> +## The name of the object being created. +## </summary> +## </param> +# +interface(`gnome_user_home_dir_filetrans_gstreamer_orcexec',` + gen_require(` + type gstreamer_orcexec_t; + ') + + userdom_user_home_dir_filetrans($1, gstreamer_orcexec_t, $2, $3) +') + +######################################## +## <summary> ## Create objects in gnome gconf home ## directories with a private type. ## </summary> @@ -604,6 +832,36 @@ interface(`gnome_gconf_home_filetrans',` ######################################## ## <summary> +## Create objects in the user +## runtime directories with the +## gstreamer orcexec type. +## </summary> +## <param name="domain"> +## <summary> +## Domain allowed access. +## </summary> +## </param> +## <param name="object_class"> +## <summary> +## Class of the object being created. +## </summary> +## </param> +## <param name="name" optional="true"> +## <summary> +## The name of the object being created. +## </summary> +## </param> +# +interface(`gnome_user_runtime_filetrans_gstreamer_orcexec',` + gen_require(` + type gstreamer_orcexec_t; + ') + + userdom_user_runtime_filetrans($1, gstreamer_orcexec_t, $2, $3) +') + +######################################## +## <summary> ## Read generic gnome keyring home files. ## </summary> ## <param name="domain"> @@ -623,6 +881,133 @@ interface(`gnome_read_keyring_home_files ######################################## ## <summary> +## Read mime info files in the home +## directory. +## </summary> +## <param name="domain"> +## <summary> +## Domain allowed access. +## </summary> +## </param> +# +interface(`gnome_read_mime_info_home_files',` + gen_require(` + type mime_info_t; + ') + + userdom_search_user_home_dirs($1) + userdom_list_user_home_content($1) + read_files_pattern($1, mime_info_t, mime_info_t) +') + +######################################## +## <summary> +## Send and receive messages from +## the dconf daemon over dbus. +## </summary> +## <param name="domain"> +## <summary> +## Domain allowed access. +## </summary> +## </param> +# +interface(`gnome_dbus_chat_dconf',` + gen_require(` + type dconf_t; + class dbus send_msg; + ') + + allow $1 dconf_t:dbus send_msg; + allow dconf_t $1:dbus send_msg; +') + +######################################## +## <summary> +## Send and receive messages from +## the at-spi daemon over dbus. +## </summary> +## <param name="domain"> +## <summary> +## Domain allowed access. +## </summary> +## </param> +# +interface(`gnome_dbus_chat_at_spi',` + gen_require(` + type at_spi_t; + class dbus send_msg; + ') + + allow $1 at_spi_t:dbus send_msg; + allow at_spi_t $1:dbus send_msg; +') + +######################################## +## <summary> +## Send and receive messages from +## the gconf daemon over dbus. +## </summary> +## <param name="domain"> +## <summary> +## Domain allowed access. +## </summary> +## </param> +# +interface(`gnome_dbus_chat_gconfd',` + gen_require(` + type gconfd_t; + class dbus send_msg; + ') + + allow $1 gconfd_t:dbus send_msg; + allow gconfd_t $1:dbus send_msg; +') + +######################################## +## <summary> +## Send and receive messages from +## gnome-settings over dbus. +## </summary> +## <param name="domain"> +## <summary> +## Domain allowed access. +## </summary> +## </param> +# +interface(`gnome_dbus_chat_gnome_settings',` + gen_require(` + type gnome_settings_t; + class dbus send_msg; + ') + + allow $1 gnome_settings_t:dbus send_msg; + allow gnome_settings_t $1:dbus send_msg; +') + +######################################## +## <summary> +## Send and receive messages from +## the gnome-settings-daemon over +## dbus. +## </summary> +## <param name="domain"> +## <summary> +## Domain allowed access. +## </summary> +## </param> +# +interface(`gnome_dbus_chat_gnome_settings_daemon',` + gen_require(` + type gnome_settings_daemon_t; + class dbus send_msg; + ') + + allow $1 gnome_settings_daemon_t:dbus send_msg; + allow gnome_settings_daemon_t $1:dbus send_msg; +') + +######################################## +## <summary> ## Send and receive messages from ## gnome keyring daemon over dbus. ## </summary> @@ -735,3 +1120,42 @@ interface(`gnome_stream_connect_all_gkey files_search_tmp($1) stream_connect_pattern($1, gnome_keyring_tmp_t, gnome_keyring_tmp_t, gkeyringd_domain) ') + +######################################## +## <summary> +## Use file descriptors for +## the gnome settings daemon. +## </summary> +## <param name="domain"> +## <summary> +## Domain allowed access. +## </summary> +## </param> +# +interface(`gnome_settings_daemon_use_fds',` + gen_require(` + type gnome_settings_daemon_t; + ') + + allow $1 gnome_settings_daemon_t:fd use; +') + +######################################## +## <summary> +## Do not audit attempts to use the +## file descriptors for the gnome +## settings daemon. +## </summary> +## <param name="domain"> +## <summary> +## Domain allowed access. +## </summary> +## </param> +# +interface(`gnome_dontaudit_settings_daemon_use_fds',` + gen_require(` + type gnome_settings_daemon_t; + ') + + dontaudit $1 gnome_settings_daemon_t:fd use; +') --- refpolicy-git-06082016-orig/policy/modules/contrib/gnome.te 2016-08-06 21:27:11.354094337 +0200 +++ refpolicy-git-06082016/policy/modules/contrib/gnome.te 2016-08-20 01:27:16.464669503 +0200 @@ -7,7 +7,24 @@ policy_module(gnome, 2.5.1) attribute gkeyringd_domain; attribute gnomedomain; +attribute_role dconf_roles; +attribute_role at_spi_roles; attribute_role gconfd_roles; +attribute_role gnome_settings_roles; +attribute_role gnome_settings_daemon_roles; + +type dconf_t; +type dconf_exec_t; +userdom_user_application_domain(dconf_t, dconf_exec_t) +role dconf_roles types dconf_t; + +type dconf_home_t; +userdom_user_home_content(dconf_home_t) + +type at_spi_t; +type at_spi_exec_t; +userdom_user_application_domain(at_spi_t, at_spi_exec_t) +role at_spi_roles types at_spi_t; type gconf_etc_t; files_config_file(gconf_etc_t) @@ -31,6 +48,19 @@ typealias gconfd_t alias { auditadm_gcon userdom_user_application_domain(gconfd_t, gconfd_exec_t) role gconfd_roles types gconfd_t; +type gnome_settings_t; +type gnome_settings_exec_t; +userdom_user_application_domain(gnome_settings_exec_t, gnome_settings_exec_t) +role gnome_settings_roles types gnome_settings_t; + +type gnome_settings_daemon_t; +type gnome_settings_daemon_exec_t; +userdom_user_application_domain(gnome_settings_daemon_exec_t, gnome_settings_daemon_exec_t) +role gnome_settings_daemon_roles types gnome_settings_daemon_t; + +type gnome_settings_schemas_t; +files_config_file(gnome_settings_schemas_t) + type gnome_home_t; typealias gnome_home_t alias { user_gnome_home_t staff_gnome_home_t sysadm_gnome_home_t }; typealias gnome_home_t alias { auditadm_gnome_home_t secadm_gnome_home_t }; @@ -43,9 +73,18 @@ application_executable_file(gkeyringd_ex type gnome_keyring_home_t; userdom_user_home_content(gnome_keyring_home_t) +type gnome_keyring_cache_home_t; +userdom_user_home_content(gnome_keyring_cache_home_t) + type gnome_keyring_tmp_t; userdom_user_tmp_file(gnome_keyring_tmp_t) +type mime_info_t; +files_config_file(mime_info_t) + +type gstreamer_orcexec_t; +application_executable_file(gstreamer_orcexec_t) + ############################## # # Common local Policy @@ -73,7 +112,62 @@ optional_policy(` ############################## # -# Conf daemon local Policy +# DConf daemon local policy (Gnome3) +# + +allow dconf_t self:process signal; + +allow dconf_t dconf_home_t:dir manage_dir_perms; +allow dconf_t dconf_home_t:file manage_file_perms; +allow dconf_t dconf_home_t:lnk_file manage_lnk_file_perms; + +userdom_search_user_home_content(dconf_t) + +fs_getattr_xattr_fs(dconf_t) + +kernel_read_system_state(dconf_t) + +selinux_getattr_fs(dconf_t) + +############################## +# +# At-spi local policy +# + +allow at_spi_t self:process signal; + +allow at_spi_t dconf_home_t:dir manage_dir_perms; +allow at_spi_t dconf_home_t:file manage_file_perms; +allow at_spi_t dconf_home_t:lnk_file manage_lnk_file_perms; + +allow at_spi_t gnome_settings_schemas_t:dir list_dir_perms; +allow at_spi_t gnome_settings_schemas_t:file read_file_perms; +allow at_spi_t gnome_settings_schemas_t:lnk_file read_lnk_file_perms; + +rw_fifo_files_pattern(at_spi_t, at_spi_t, at_spi_t) + +corecmd_search_bin(at_spi_t) + +files_read_usr_files(at_spi_t) + +fs_getattr_xattr_fs(at_spi_t) + +kernel_read_system_state(at_spi_t) + +selinux_getattr_fs(at_spi_t) + +# search in .cache +userdom_search_user_home_dirs(at_spi_t) +userdom_search_user_home_content(at_spi_t) + +optional_policy(` + xserver_read_user_xauth(at_spi_t) + xserver_stream_connect(at_spi_t) +') + +############################## +# +# GConf daemon local Policy (Gnome2) # allow gconfd_t gconf_etc_t:dir list_dir_perms; @@ -87,6 +181,12 @@ manage_dirs_pattern(gconfd_t, gconf_tmp_ manage_files_pattern(gconfd_t, gconf_tmp_t, gconf_tmp_t) userdom_user_tmp_filetrans(gconfd_t, gconf_tmp_t, { dir file }) +kernel_dontaudit_read_system_state(gconfd_t) + +files_search_tmp(gconfd_t) + +fs_getattr_xattr_fs(gconfd_t) + userdom_manage_user_tmp_dirs(gconfd_t) userdom_tmp_filetrans_user_tmp(gconfd_t, dir) userdom_user_runtime_filetrans_user_tmp(gconfd_t, dir) @@ -102,6 +202,171 @@ optional_policy(` ') ############################## +# +# Gnome-settings local policy +# + +allow gnome_settings_t self:dir list_dir_perms; +allow gnome_settings_t self:file rw_file_perms; +allow gnome_settings_t self:process { fork sigchld }; +allow gnome_settings_t self:unix_stream_socket create_stream_socket_perms; + +allow gnome_settings_t dconf_home_t:dir manage_dir_perms; +allow gnome_settings_t dconf_home_t:file manage_file_perms; +allow gnome_settings_t dconf_home_t:lnk_file manage_lnk_file_perms; + +allow gnome_settings_t gnome_settings_schemas_t:dir list_dir_perms; +allow gnome_settings_t gnome_settings_schemas_t:file read_file_perms; +allow gnome_settings_t gnome_settings_schemas_t:lnk_file read_lnk_file_perms; + +allow gnome_settings_t gnome_settings_exec_t:file entrypoint; + +rw_fifo_files_pattern(gnome_settings_t, gnome_settings_t, gnome_settings_t) + +corecmd_exec_bin(gnome_settings_t) +corecmd_search_bin(gnome_settings_t) + +dev_dontaudit_search_sysfs(gnome_settings_t) +dev_list_all_dev_nodes(gnome_settings_t) +dev_rw_null(gnome_settings_t) +dev_search_sysfs(gnome_settings_t) + +files_list_root(gnome_settings_t) +files_read_etc_files(gnome_settings_t) +files_read_usr_files(gnome_settings_t) +files_search_pids(gnome_settings_t) + +fs_getattr_xattr_fs(gnome_settings_t) + +init_sigchld(gnome_settings_t) + +kernel_read_system_state(gnome_settings_t) + +libs_use_ld_so(gnome_settings_t) +libs_use_shared_libs(gnome_settings_t) + +miscfiles_read_localization(gnome_settings_t) + +selinux_getattr_fs(gnome_settings_t) +selinux_dontaudit_search_fs(gnome_settings_t) + +### should create an xserver interface for writing .xsession-errors +userdom_dontaudit_write_user_home_content_files(gnome_settings_t) + +# search in .cache +userdom_search_user_home_dirs(gnome_settings_t) +userdom_search_user_home_content(gnome_settings_t) + +optional_policy(` + dbus_read_lib_files(gnome_settings_t) +') + +optional_policy(` + xserver_use_xdm_fds(gnome_settings_t) +') + +############################## +# +# Gnome-settings-daemon local policy +# + +allow gnome_settings_daemon_t self:dir list_dir_perms; +allow gnome_settings_daemon_t self:file rw_file_perms; +allow gnome_settings_daemon_t self:lnk_file read_lnk_file_perms; + +allow gnome_settings_daemon_t self:process { fork sigchld signal }; +allow gnome_settings_daemon_t self:unix_stream_socket create_stream_socket_perms; +allow gnome_settings_daemon_t self:netlink_kobject_uevent_socket create_socket_perms; + +allow gnome_settings_daemon_t dconf_home_t:dir manage_dir_perms; +allow gnome_settings_daemon_t dconf_home_t:file manage_file_perms; +allow gnome_settings_daemon_t dconf_home_t:lnk_file manage_lnk_file_perms; + +allow gnome_settings_daemon_t gnome_settings_schemas_t:dir list_dir_perms; +allow gnome_settings_daemon_t gnome_settings_schemas_t:file read_file_perms; +allow gnome_settings_daemon_t gnome_settings_schemas_t:lnk_file read_lnk_file_perms; + +allow gnome_settings_daemon_t gnome_settings_daemon_exec_t:file { entrypoint exec_file_perms }; + +rw_fifo_files_pattern(gnome_settings_daemon_t, gnome_settings_daemon_t, gnome_settings_daemon_t) + +read_files_pattern(gnome_settings_daemon_t, mime_info_t, mime_info_t) + +cups_read_config(gnome_settings_daemon_t) +cups_stream_connect(gnome_settings_daemon_t) + +dev_dontaudit_search_sysfs(gnome_settings_daemon_t) +dev_read_urand(gnome_settings_daemon_t) +dev_read_sysfs(gnome_settings_daemon_t) +dev_rw_null(gnome_settings_daemon_t) + +files_list_root(gnome_settings_daemon_t) +files_list_tmp(gnome_settings_daemon_t) +files_read_etc_files(gnome_settings_daemon_t) +files_read_usr_files(gnome_settings_daemon_t) +files_search_tmp(gnome_settings_daemon_t) + +fs_getattr_tmpfs(gnome_settings_daemon_t) +fs_getattr_xattr_fs(gnome_settings_daemon_t) +fs_list_tmpfs(gnome_settings_daemon_t) +fs_rw_tmpfs_files(gnome_settings_daemon_t) + +init_sigchld(gnome_settings_daemon_t) + +kernel_read_system_state(gnome_settings_daemon_t) + +libs_use_ld_so(gnome_settings_daemon_t) +libs_use_shared_libs(gnome_settings_daemon_t) + +logging_search_logs(gnome_settings_daemon_t) + +miscfiles_read_fonts(gnome_settings_daemon_t) +miscfiles_read_generic_certs(gnome_settings_daemon_t) +miscfiles_read_localization(gnome_settings_daemon_t) + +selinux_getattr_fs(gnome_settings_daemon_t) +selinux_dontaudit_search_fs(gnome_settings_daemon_t) + +### should create an xserver interface for writing .xsession-errors +userdom_dontaudit_write_user_home_content_files(gnome_settings_daemon_t) + +userdom_list_user_home_dirs(gnome_settings_daemon_t) +userdom_list_user_tmp(gnome_settings_daemon_t) +userdom_search_user_home_dirs(gnome_settings_daemon_t) +userdom_search_user_home_content(gnome_settings_daemon_t) + +optional_policy(` + colord_dbus_chat(gnome_settings_daemon_t) + colord_manage_home_files(gnome_settings_daemon_t) +') + +optional_policy(` + dbus_system_bus_client(gnome_settings_daemon_t) +') + +optional_policy(` + devicekit_dbus_chat_power(gnome_settings_daemon_t) +') + +optional_policy(` + policykit_dbus_chat(gnome_settings_daemon_t) + policykit_domtrans(gnome_settings_daemon_t) +') + +optional_policy(` + pulseaudio_read_home(gnome_settings_daemon_t) + pulseaudio_rw_tmpfs_files(gnome_settings_daemon_t) + pulseaudio_signull(gnome_settings_daemon_t) + pulseaudio_stream_connect(gnome_settings_daemon_t) + pulseaudio_use_fds(gnome_settings_daemon_t) +') + +optional_policy(` + xserver_read_user_xauth(gnome_settings_daemon_t) + xserver_stream_connect(gnome_settings_daemon_t) +') + +############################## # # Keyring-daemon local policy # --- refpolicy-git-06082016-orig/policy/modules/contrib/policykit.fc 2016-08-06 21:27:11.407094942 +0200 +++ refpolicy-git-06082016/policy/modules/contrib/policykit.fc 2016-08-20 01:03:29.139150710 +0200 @@ -1,3 +1,5 @@ +/usr/bin/pkexec -- gen_context(system_u:object_r:policykit_exec_t,s0) + /usr/lib/polkit-1/polkitd -- gen_context(system_u:object_r:policykit_exec_t,s0) /usr/lib/polkit-1/polkit-agent-helper-1 -- gen_context(system_u:object_r:policykit_auth_exec_t,s0) --- refpolicy-git-06082016-orig/policy/modules/contrib/policykit.if 2016-08-06 21:27:11.407094942 +0200 +++ refpolicy-git-06082016/policy/modules/contrib/policykit.if 2016-08-20 01:22:02.076149949 +0200 @@ -44,6 +44,26 @@ interface(`policykit_dbus_chat_auth',` ######################################## ## <summary> +## Execute a domain transition to +## run polkit. +## </summary> +## <param name="domain"> +## <summary> +## Domain allowed to transition. +## </summary> +## </param> +# +interface(`policykit_domtrans',` + gen_require(` + type policykit_t, policykit_exec_t; + ') + + corecmd_search_bin($1) + domtrans_pattern($1, policykit_exec_t, policykit_t) +') + +######################################## +## <summary> ## Execute a domain transition to run polkit_auth. ## </summary> ## <param name="domain"> --- refpolicy-git-06082016-orig/policy/modules/contrib/policykit.te 2016-08-06 21:27:11.408094953 +0200 +++ refpolicy-git-06082016/policy/modules/contrib/policykit.te 2016-08-19 22:14:15.581772016 +0200 @@ -117,6 +118,7 @@ optional_policy(` optional_policy(` gnome_read_generic_home_content(policykit_t) + gnome_read_settings_daemon_files(policykit_t) ') optional_policy(` --- refpolicy-git-06082016-orig/policy/modules/contrib/pulseaudio.if 2016-08-20 03:45:26.654959226 +0200 +++ refpolicy-git-06082016/policy/modules/contrib/pulseaudio.if 2016-08-20 00:25:39.112517500 +0200 @@ -347,3 +347,80 @@ interface(`pulseaudio_tmpfs_content',` typeattribute $1 pulseaudio_tmpfsfile; ') + +####################################### +## <summary> +## Read pulseaudio tmpfs files. +## </summary> +## <param name="domain"> +## <summary> +## Domain allowed access. +## </summary> +## </param> +# +interface(`pulseaudio_read_tmpfs_files',` + gen_require(` + type pulseaudio_tmpfs_t; + ') + + fs_search_tmpfs($1) + read_files_pattern($1, pulseaudio_tmpfs_t, pulseaudio_tmpfs_t) +') + +####################################### +## <summary> +## Read and write pulseaudio tmpfs +## files. +## </summary> +## <param name="domain"> +## <summary> +## Domain allowed access. +## </summary> +## </param> +# +interface(`pulseaudio_rw_tmpfs_files',` + gen_require(` + type pulseaudio_tmpfs_t; + ') + + fs_search_tmpfs($1) + rw_files_pattern($1, pulseaudio_tmpfs_t, pulseaudio_tmpfs_t) +') + +######################################## +## <summary> +## Use file descriptors for +## pulseaudio. +## </summary> +## <param name="domain"> +## <summary> +## Domain allowed access. +## </summary> +## </param> +# +interface(`pulseaudio_use_fds',` + gen_require(` + type pulseaudio_t; + ') + + allow $1 pulseaudio_t:fd use; +') + +######################################## +## <summary> +## Do not audit attempts to use the +## file descriptors for pulseaudio. +## </summary> +## <param name="domain"> +## <summary> +## Domain allowed access. +## </summary> +## </param> +# +interface(`pulseaudio_dontaudit_use_fds',` + gen_require(` + type pulseaudio_t; + ') + + dontaudit $1 pulseaudio_t:fd use; +') --- refpolicy-git-14082016/policy/modules/contrib/pulseaudio.te 2016-08-20 06:08:33.005716322 +0200 +++ refpolicy-git-06082016/policy/modules/contrib/pulseaudio.te 2016-08-18 18:23:19.470718028 +0200 @@ -193,6 +193,11 @@ optional_policy(` optional_policy(` gnome_stream_connect_gconf(pulseaudio_t) + + # OIL Runtime Compiler (ORC) optimized code execution + allow pulseaudio_t gstreamer_orcexec_t:file { manage_file_perms mmap_file_perms }; + gnome_user_runtime_filetrans_gstreamer_orcexec(pulseaudio_t, file) + gnome_user_home_dir_filetrans_gstreamer_orcexec(pulseaudio_t, file) ') optional_policy(`--- refpolicy-git-06082016-orig/policy/modules/system/userdomain.if 2016-08-20 04:02:51.687901531 +0200 +++ refpolicy-git-06082016/policy/modules/system/userdomain.if 2016-08-19 23:44:30.690540547 +0200 @@ -593,6 +593,10 @@ template(`userdom_common_user_template', ') optional_policy(` + colord_manage_home_files($1_t) + ') + + optional_policy(` dbus_system_bus_client($1_t) optional_policy(` ^ permalink raw reply [flat|nested] 73+ messages in thread
* [refpolicy] [PATCH v3] Update for the gnome policy and file contexts 2016-08-20 14:52 ` [refpolicy] [PATCH v3] " Guido Trentalancia @ 2016-08-21 18:49 ` Dominick Grift 2016-08-21 19:02 ` Guido Trentalancia 2016-08-22 19:39 ` [refpolicy] [PATCH v4] " Guido Trentalancia 1 sibling, 1 reply; 73+ messages in thread From: Dominick Grift @ 2016-08-21 18:49 UTC (permalink / raw) To: refpolicy On 08/20/2016 04:52 PM, Guido Trentalancia via refpolicy wrote: > Update for the gnome module: > > - target the dconf daemon, the gsettings user application, the > gnome-settings-daemon and the at-spi daemon with all the > needed domain transitions; > - a new gstreamer_orcexec_t type and file context is introduced > to support the OIL Runtime Compiler (ORC) optimized code > execution (used for example by pulseaudio); > - add support for more permissions needed in gconfd_t and gnome > keyring domains; > - add support for chat over dbus in the gconfd domain and in the > new domains (dconf, gsettings, etc); > - add support for a few needed fs and kernel permissions. > - add support for reading the colord related files in the home > directories (such as the ICC EDID profiles): requires the > recent colord patch; > - add support for for reading the colord related files in the home > directories in the common user domain template; > - add support for a new mime_info_t type to be used in the home > directories; > - includes minor modifications to the consolekit, dbus and > policykit modules to support the new targeted gnome daemons > and applications; > - modifies the pulseaudio module to introduce new interfaces to > read and write pulseaudio tmpfs files and to use the pulseaudio > file descriptor. > > The support for Gnome2/ORBit-2 (version 2) has been dropped. if you want me to review this then you have to split this patch into smaller patches > > This patch depends on the recent colord patch. > > Recent changes to the pulseaudio module depends on this patch ! > > Signed-off-by: Guido Trentalancia <guido@trentalancia.net> > --- > policy/modules/contrib/colord.if | 41 +++ > policy/modules/contrib/colord.te | 4 > policy/modules/contrib/consolekit.te | 4 > policy/modules/contrib/dbus.te | 9 > policy/modules/contrib/gnome.fc | 19 + > policy/modules/contrib/gnome.if | 426 ++++++++++++++++++++++++++++++++++- > policy/modules/contrib/gnome.te | 267 +++++++++++++++++++++ > policy/modules/contrib/policykit.fc | 2 > policy/modules/contrib/policykit.if | 20 + > policy/modules/contrib/policykit.te | 1 > policy/modules/contrib/pulseaudio.if | 77 ++++++ > policy/modules/contrib/pulseaudio.te | 5 > policy/modules/system/userdomain.if | 4 > 13 files changed, 876 insertions(+), 3 deletions(-) > > --- refpolicy-git-06082016-orig/policy/modules/contrib/colord.if 2016-08-06 21:27:11.338094155 +0200 > +++ refpolicy-git-06082016/policy/modules/contrib/colord.if 2016-08-19 23:13:27.765740337 +0200 > @@ -58,3 +58,44 @@ interface(`colord_read_lib_files',` > files_search_var_lib($1) > read_files_pattern($1, colord_var_lib_t, colord_var_lib_t) > ') > + > +###################################### > +## <summary> > +## Read colord home files. > +## </summary> > +## <param name="domain"> > +## <summary> > +## Domain allowed access. > +## </summary> > +## </param> > +# > +interface(`colord_read_home_files',` > + gen_require(` > + type colord_home_t; > + ') > + > + userdom_search_user_home_dirs($1) > + userdom_list_user_home_content($1) > + read_files_pattern($1, colord_home_t, colord_home_t) > +') > + > +###################################### > +## <summary> > +## Create, read, write, and delete > +## colord home content. > +## </summary> > +## <param name="domain"> > +## <summary> > +## Domain allowed access. > +## </summary> > +## </param> > +# > +interface(`colord_manage_home_files',` > + gen_require(` > + type colord_home_t; > + ') > + > + userdom_search_user_home_dirs($1) > + userdom_list_user_home_content($1) > + manage_files_pattern($1, colord_home_t, colord_home_t) > +') > --- refpolicy-git-14082016/policy/modules/contrib/colord.te 2016-08-14 21:28:11.468519205 +0200 > +++ refpolicy-git-06082016/policy/modules/contrib/colord.te 2016-08-20 00:21:47.786192022 +0200 > @@ -123,6 +136,10 @@ optional_policy(` > ') > > optional_policy(` > + gnome_settings_daemon_use_fds(colord_t) > +') > + > +optional_policy(` > policykit_dbus_chat(colord_t) > policykit_domtrans_auth(colord_t) > policykit_read_lib(colord_t)--- refpolicy-git-06082016-orig/policy/modules/contrib/consolekit.te 2016-08-07 23:05:57.060018494 +0200 > +++ refpolicy-git-06082016/policy/modules/contrib/consolekit.te 2016-08-19 22:13:01.508709501 +0200 > @@ -104,6 +101,10 @@ tunable_policy(`use_samba_home_dirs',` > ') > > optional_policy(` > + gnome_read_settings_daemon_files(consolekit_t) > +') > + > +optional_policy(` > dbus_read_lib_files(consolekit_t) > dbus_system_domain(consolekit_t, consolekit_exec_t) > > --- refpolicy-git-06082016-orig/policy/modules/contrib/dbus.te 2016-08-06 21:27:11.344094223 +0200 > +++ refpolicy-git-06082016/policy/modules/contrib/dbus.te 2016-08-20 00:27:48.730380843 +0200 > @@ -148,6 +148,15 @@ optional_policy(` > ') > > optional_policy(` > + colord_read_home_files(system_dbusd_t) > +') > + > +optional_policy(` > + gnome_read_settings_daemon_files(system_dbusd_t) > + gnome_settings_daemon_use_fds(system_dbusd_t) > +') > + > +optional_policy(` > policykit_read_lib(system_dbusd_t) > ') > > --- refpolicy-git-06082016-orig/policy/modules/contrib/gnome.fc 2016-08-06 21:27:11.354094337 +0200 > +++ refpolicy-git-06082016/policy/modules/contrib/gnome.fc 2016-08-19 23:26:12.625475184 +0200 > @@ -1,16 +1,33 @@ > +HOME_DIR/\.cache/dconf(/.*)? gen_context(system_u:object_r:dconf_home_t,s0) > +HOME_DIR/\.cache/keyring[^/]+(/.*)? gen_context(system_u:object_r:gnome_keyring_cache_home_t,s0) > +HOME_DIR/\.config/dconf(/.*)? gen_context(system_u:object_r:dconf_home_t,s0) > HOME_DIR/\.gconf(/.*)? gen_context(system_u:object_r:gconf_home_t,s0) > HOME_DIR/\.gconfd(/.*)? gen_context(system_u:object_r:gconf_home_t,s0) > HOME_DIR/\.gnome(/.*)? gen_context(system_u:object_r:gnome_home_t,s0) > HOME_DIR/\.gnome2(/.*)? gen_context(system_u:object_r:gnome_home_t,s0) > HOME_DIR/\.gnome2/keyrings(/.*)? gen_context(system_u:object_r:gnome_keyring_home_t,s0) > HOME_DIR/\.gnome2_private(/.*)? gen_context(system_u:object_r:gnome_home_t,s0) > +HOME_DIR/\.local/share/mime(/.*)? gen_context(system_u:object_r:mime_info_t,s0) > + > +HOME_DIR/orcexec\..* gen_context(system_u:object_r:gstreamer_orcexec_t,s0) > > /etc/gconf(/.*)? gen_context(system_u:object_r:gconf_etc_t,s0) > > /tmp/gconfd-USER/.* -- gen_context(system_u:object_r:gconf_tmp_t,s0) > > /usr/bin/gnome-keyring-daemon -- gen_context(system_u:object_r:gkeyringd_exec_t,s0) > +/usr/bin/gsettings -- gen_context(system_u:object_r:gnome_settings_exec_t,s0) > /usr/bin/mate-keyring-daemon -- gen_context(system_u:object_r:gkeyringd_exec_t,s0) > > /usr/lib/[^/]*/gconf/gconfd-2 -- gen_context(system_u:object_r:gconfd_exec_t,s0) > -/usr/libexec/gconfd-2 -- gen_context(system_u:object_r:gconfd_exec_t,s0) > + > +/usr/libexec/at-spi-bus-launcher -- gen_context(system_u:object_r:at_spi_exec_t,s0) > +/usr/libexec/dconf-service -- gen_context(system_u:object_r:dconf_exec_t,s0) > +/usr/libexec/gconfd-2 -- gen_context(system_u:object_r:gconfd_exec_t,s0) > +/usr/libexec/gnome-settings-daemon -- gen_context(system_u:object_r:gnome_settings_daemon_exec_t,s0) > +/usr/libexec/gsd-[^/]* -- gen_context(system_u:object_r:gnome_settings_daemon_exec_t,s0) > + > +/usr/share/glib-[^/]*/schemas(/.*)? gen_context(system_u:object_r:gnome_settings_schemas_t,s0) > + > +/var/run/user/[^/]*/orcexec\..* -- gen_context(system_u:object_r:gstreamer_orcexec_t,s0) > +/var/run/user/%{USERID}/orcexec\..* -- gen_context(system_u:object_r:gstreamer_orcexec_t,s0) > --- refpolicy-git-06082016-orig/policy/modules/contrib/gnome.if 2016-08-06 21:27:11.354094337 +0200 > +++ refpolicy-git-06082016/policy/modules/contrib/gnome.if 2016-08-20 03:27:52.570896165 +0200 > @@ -43,14 +43,40 @@ interface(`gnome_role',` > template(`gnome_role_template',` > gen_require(` > attribute gnomedomain, gkeyringd_domain; > + attribute_role dconf_roles; > + attribute_role at_spi_roles; > attribute_role gconfd_roles; > - type gkeyringd_exec_t, gnome_keyring_home_t, gnome_keyring_tmp_t; > + attribute_role gnome_settings_roles; > + attribute_role gnome_settings_daemon_roles; > + type dconf_t, dconf_exec_t, dconf_home_t; > + type at_spi_t, at_spi_exec_t; > type gconfd_t, gconfd_exec_t, gconf_tmp_t; > type gconf_home_t; > + type gnome_settings_t, gnome_settings_exec_t; > + type gnome_settings_daemon_t, gnome_settings_daemon_exec_t; > + type gnome_settings_schemas_t; > + type gkeyringd_exec_t, gnome_keyring_home_t, gnome_keyring_cache_home_t, gnome_keyring_tmp_t; > + type mime_info_t; > + type user_dbusd_t; > + type dbusd_exec_t; > ') > > ######################################## > # > + # Dconf declarations > + # > + > + roleattribute $2 dconf_roles; > + > + ######################################## > + # > + # At-spi declarations > + # > + > + roleattribute $2 at_spi_roles; > + > + ######################################## > + # > # Gconf declarations > # > > @@ -58,6 +84,20 @@ template(`gnome_role_template',` > > ######################################## > # > + # Gnome-settings declarations > + # > + > + roleattribute $2 gnome_settings_roles; > + > + ######################################## > + # > + # Gnome-settings-daemon declarations > + # > + > + roleattribute $2 gnome_settings_daemon_roles; > + > + ######################################## > + # > # Gkeyringd declarations > # > > @@ -69,6 +109,70 @@ template(`gnome_role_template',` > > ######################################## > # > + # Common policy > + # > + > + allow $3 dconf_home_t:dir manage_dir_perms; > + allow $3 dconf_home_t:file manage_file_perms; > + allow $3 dconf_home_t:lnk_file manage_lnk_file_perms; > + > + allow $3 gnome_settings_schemas_t:dir list_dir_perms; > + allow $3 gnome_settings_schemas_t:file read_file_perms; > + allow $3 gnome_settings_schemas_t:lnk_file read_lnk_file_perms; > + > + allow $3 mime_info_t:dir list_dir_perms; > + allow $3 mime_info_t:file read_file_perms; > + > + allow at_spi_t user_dbusd_t:process signal; > + > + allow user_dbusd_t self:process signal; > + > + allow user_dbusd_t bin_t:file entrypoint; > + > + allow user_dbusd_t dbusd_exec_t:file exec_file_perms; > + > + gnome_read_settings_files(user_dbusd_t) > + gnome_read_settings_daemon_files(user_dbusd_t) > + > + files_read_usr_files($3) > + > + kernel_read_system_state(user_dbusd_t) > + > + optional_policy(` > + xserver_read_user_xauth(user_dbusd_t) > + xserver_stream_connect(user_dbusd_t) > + ') > + > + ######################################## > + # > + # Dconf policy > + # > + > + allow dconf_t user_dbusd_t:unix_stream_socket connectto; > + > + allow user_dbusd_t dconf_exec_t:file { entrypoint exec_file_perms }; > + > + domtrans_pattern(user_dbusd_t, dconf_exec_t, dconf_t) > + > + ######################################## > + # > + # At-spi policy > + # > + > + allow at_spi_t user_dbusd_t:unix_stream_socket connectto; > + > + allow at_spi_t dbusd_exec_t:file { entrypoint exec_file_perms }; > + > + allow user_dbusd_t at_spi_exec_t:file { entrypoint exec_file_perms }; > + > + allow $3 at_spi_t:fd use; > + > + domtrans_pattern(at_spi_t, dbusd_exec_t, user_dbusd_t) > + > + domtrans_pattern(user_dbusd_t, at_spi_exec_t, at_spi_t) > + > + ######################################## > + # > # Gconf policy > # > > @@ -84,6 +188,38 @@ template(`gnome_role_template',` > > ######################################## > # > + # Gnome-settings policy > + # > + > + domtrans_pattern($3, gnome_settings_exec_t, gnome_settings_t) > + > + allow $3 gnome_settings_t:process { ptrace signal_perms }; > + ps_process_pattern($3, gnome_settings_t) > + > + allow gnome_settings_t user_dbusd_t:unix_stream_socket connectto; > + > + allow gnome_settings_t bin_t:file entrypoint; > + allow gnome_settings_t dbusd_exec_t:file { entrypoint exec_file_perms }; > + > + # for dbus-launch > + corecmd_bin_domtrans(gnome_settings_t, user_dbusd_t) > + > + domtrans_pattern(gnome_settings_t, dbusd_exec_t, user_dbusd_t) > + > + ######################################## > + # > + # Gnome-settings-daemon policy > + # > + > + domtrans_pattern($3, gnome_settings_daemon_exec_t, gnome_settings_daemon_t) > + > + allow gnome_settings_daemon_t user_dbusd_t:unix_stream_socket connectto; > + > + allow $3 gnome_settings_daemon_t:process { ptrace signal_perms }; > + ps_process_pattern($3, gnome_settings_daemon_t) > + > + ######################################## > + # > # Gkeyringd policy > # > > @@ -100,23 +236,85 @@ template(`gnome_role_template',` > > allow $3 gnome_keyring_tmp_t:sock_file { relabel_sock_file_perms manage_sock_file_perms }; > > + userdom_manage_user_home_content_dirs($1_gkeyringd_t) > + userdom_manage_user_home_content_files($1_gkeyringd_t) > + > + manage_dirs_pattern($1_gkeyringd_t, gnome_keyring_cache_home_t, gnome_keyring_cache_home_t) > + userdom_user_home_content_filetrans($1_gkeyringd_t, gnome_keyring_cache_home_t, dir) > + > + manage_sock_files_pattern($1_gkeyringd_t, gnome_keyring_cache_home_t, gnome_keyring_cache_home_t) > + userdom_user_home_content_filetrans($1_gkeyringd_t, gnome_keyring_cache_home_t, sock_file) > + > ps_process_pattern($3, $1_gkeyringd_t) > allow $3 $1_gkeyringd_t:process { ptrace signal_perms }; > > + kernel_read_kernel_sysctls($1_gkeyringd_t) > + > corecmd_bin_domtrans($1_gkeyringd_t, $3) > corecmd_shell_domtrans($1_gkeyringd_t, $3) > > gnome_stream_connect_gkeyringd($1, $3) > > optional_policy(` > + dbus_connect_spec_session_bus(user, dconf_t) > + dbus_connect_spec_session_bus(user, at_spi_t) > + dbus_connect_spec_session_bus(user, gnome_settings_daemon_t) > + dbus_connect_system_bus(gnome_settings_daemon_t) > + dbus_send_spec_session_bus(user, dconf_t) > + dbus_send_spec_session_bus(user, at_spi_t) > + dbus_send_spec_session_bus(user, gnome_settings_daemon_t) > dbus_spec_session_domain($1, $1_gkeyringd_t, gkeyringd_exec_t) > > optional_policy(` > + gnome_dbus_chat_dconf($3) > + gnome_dbus_chat_dconf(gnome_settings_t) > + gnome_dbus_chat_at_spi($3) > + gnome_dbus_chat_gconfd($3) > + gnome_dbus_chat_gnome_settings(user_dbusd_t) > + gnome_dbus_chat_gnome_settings_daemon($3) > + gnome_dbus_chat_gnome_settings_daemon(at_spi_t) > gnome_dbus_chat_gkeyringd($1, $3) > ') > ') > ') > > +####################################### > +## <summary> > +## Read gnome-settings files. > +## </summary> > +## <param name="domain"> > +## <summary> > +## Domain allowed access. > +## </summary> > +## </param> > +# > +interface(`gnome_read_settings_files',` > + gen_require(` > + type gnome_settings_t; > + ') > + > + read_files_pattern($1, gnome_settings_t, gnome_settings_t) > +') > + > +####################################### > +## <summary> > +## Read gnome-settings-daemon > +## files. > +## </summary> > +## <param name="domain"> > +## <summary> > +## Domain allowed access. > +## </summary> > +## </param> > +# > +interface(`gnome_read_settings_daemon_files',` > + gen_require(` > + type gnome_settings_daemon_t; > + ') > + > + read_files_pattern($1, gnome_settings_daemon_t, gnome_settings_daemon_t) > +') > + > ######################################## > ## <summary> > ## Execute gconf in the caller domain. > @@ -569,6 +767,36 @@ interface(`gnome_home_filetrans_gnome_ho > > ######################################## > ## <summary> > +## Create objects in user home > +## directories with the gstreamer > +## orcexec type. > +## </summary> > +## <param name="domain"> > +## <summary> > +## Domain allowed access. > +## </summary> > +## </param> > +## <param name="object_class"> > +## <summary> > +## Class of the object being created. > +## </summary> > +## </param> > +## <param name="name" optional="true"> > +## <summary> > +## The name of the object being created. > +## </summary> > +## </param> > +# > +interface(`gnome_user_home_dir_filetrans_gstreamer_orcexec',` > + gen_require(` > + type gstreamer_orcexec_t; > + ') > + > + userdom_user_home_dir_filetrans($1, gstreamer_orcexec_t, $2, $3) > +') > + > +######################################## > +## <summary> > ## Create objects in gnome gconf home > ## directories with a private type. > ## </summary> > @@ -604,6 +832,36 @@ interface(`gnome_gconf_home_filetrans',` > > ######################################## > ## <summary> > +## Create objects in the user > +## runtime directories with the > +## gstreamer orcexec type. > +## </summary> > +## <param name="domain"> > +## <summary> > +## Domain allowed access. > +## </summary> > +## </param> > +## <param name="object_class"> > +## <summary> > +## Class of the object being created. > +## </summary> > +## </param> > +## <param name="name" optional="true"> > +## <summary> > +## The name of the object being created. > +## </summary> > +## </param> > +# > +interface(`gnome_user_runtime_filetrans_gstreamer_orcexec',` > + gen_require(` > + type gstreamer_orcexec_t; > + ') > + > + userdom_user_runtime_filetrans($1, gstreamer_orcexec_t, $2, $3) > +') > + > +######################################## > +## <summary> > ## Read generic gnome keyring home files. > ## </summary> > ## <param name="domain"> > @@ -623,6 +881,133 @@ interface(`gnome_read_keyring_home_files > > ######################################## > ## <summary> > +## Read mime info files in the home > +## directory. > +## </summary> > +## <param name="domain"> > +## <summary> > +## Domain allowed access. > +## </summary> > +## </param> > +# > +interface(`gnome_read_mime_info_home_files',` > + gen_require(` > + type mime_info_t; > + ') > + > + userdom_search_user_home_dirs($1) > + userdom_list_user_home_content($1) > + read_files_pattern($1, mime_info_t, mime_info_t) > +') > + > +######################################## > +## <summary> > +## Send and receive messages from > +## the dconf daemon over dbus. > +## </summary> > +## <param name="domain"> > +## <summary> > +## Domain allowed access. > +## </summary> > +## </param> > +# > +interface(`gnome_dbus_chat_dconf',` > + gen_require(` > + type dconf_t; > + class dbus send_msg; > + ') > + > + allow $1 dconf_t:dbus send_msg; > + allow dconf_t $1:dbus send_msg; > +') > + > +######################################## > +## <summary> > +## Send and receive messages from > +## the at-spi daemon over dbus. > +## </summary> > +## <param name="domain"> > +## <summary> > +## Domain allowed access. > +## </summary> > +## </param> > +# > +interface(`gnome_dbus_chat_at_spi',` > + gen_require(` > + type at_spi_t; > + class dbus send_msg; > + ') > + > + allow $1 at_spi_t:dbus send_msg; > + allow at_spi_t $1:dbus send_msg; > +') > + > +######################################## > +## <summary> > +## Send and receive messages from > +## the gconf daemon over dbus. > +## </summary> > +## <param name="domain"> > +## <summary> > +## Domain allowed access. > +## </summary> > +## </param> > +# > +interface(`gnome_dbus_chat_gconfd',` > + gen_require(` > + type gconfd_t; > + class dbus send_msg; > + ') > + > + allow $1 gconfd_t:dbus send_msg; > + allow gconfd_t $1:dbus send_msg; > +') > + > +######################################## > +## <summary> > +## Send and receive messages from > +## gnome-settings over dbus. > +## </summary> > +## <param name="domain"> > +## <summary> > +## Domain allowed access. > +## </summary> > +## </param> > +# > +interface(`gnome_dbus_chat_gnome_settings',` > + gen_require(` > + type gnome_settings_t; > + class dbus send_msg; > + ') > + > + allow $1 gnome_settings_t:dbus send_msg; > + allow gnome_settings_t $1:dbus send_msg; > +') > + > +######################################## > +## <summary> > +## Send and receive messages from > +## the gnome-settings-daemon over > +## dbus. > +## </summary> > +## <param name="domain"> > +## <summary> > +## Domain allowed access. > +## </summary> > +## </param> > +# > +interface(`gnome_dbus_chat_gnome_settings_daemon',` > + gen_require(` > + type gnome_settings_daemon_t; > + class dbus send_msg; > + ') > + > + allow $1 gnome_settings_daemon_t:dbus send_msg; > + allow gnome_settings_daemon_t $1:dbus send_msg; > +') > + > +######################################## > +## <summary> > ## Send and receive messages from > ## gnome keyring daemon over dbus. > ## </summary> > @@ -735,3 +1120,42 @@ interface(`gnome_stream_connect_all_gkey > files_search_tmp($1) > stream_connect_pattern($1, gnome_keyring_tmp_t, gnome_keyring_tmp_t, gkeyringd_domain) > ') > + > +######################################## > +## <summary> > +## Use file descriptors for > +## the gnome settings daemon. > +## </summary> > +## <param name="domain"> > +## <summary> > +## Domain allowed access. > +## </summary> > +## </param> > +# > +interface(`gnome_settings_daemon_use_fds',` > + gen_require(` > + type gnome_settings_daemon_t; > + ') > + > + allow $1 gnome_settings_daemon_t:fd use; > +') > + > +######################################## > +## <summary> > +## Do not audit attempts to use the > +## file descriptors for the gnome > +## settings daemon. > +## </summary> > +## <param name="domain"> > +## <summary> > +## Domain allowed access. > +## </summary> > +## </param> > +# > +interface(`gnome_dontaudit_settings_daemon_use_fds',` > + gen_require(` > + type gnome_settings_daemon_t; > + ') > + > + dontaudit $1 gnome_settings_daemon_t:fd use; > +') > --- refpolicy-git-06082016-orig/policy/modules/contrib/gnome.te 2016-08-06 21:27:11.354094337 +0200 > +++ refpolicy-git-06082016/policy/modules/contrib/gnome.te 2016-08-20 01:27:16.464669503 +0200 > @@ -7,7 +7,24 @@ policy_module(gnome, 2.5.1) > > attribute gkeyringd_domain; > attribute gnomedomain; > +attribute_role dconf_roles; > +attribute_role at_spi_roles; > attribute_role gconfd_roles; > +attribute_role gnome_settings_roles; > +attribute_role gnome_settings_daemon_roles; > + > +type dconf_t; > +type dconf_exec_t; > +userdom_user_application_domain(dconf_t, dconf_exec_t) > +role dconf_roles types dconf_t; > + > +type dconf_home_t; > +userdom_user_home_content(dconf_home_t) > + > +type at_spi_t; > +type at_spi_exec_t; > +userdom_user_application_domain(at_spi_t, at_spi_exec_t) > +role at_spi_roles types at_spi_t; > > type gconf_etc_t; > files_config_file(gconf_etc_t) > @@ -31,6 +48,19 @@ typealias gconfd_t alias { auditadm_gcon > userdom_user_application_domain(gconfd_t, gconfd_exec_t) > role gconfd_roles types gconfd_t; > > +type gnome_settings_t; > +type gnome_settings_exec_t; > +userdom_user_application_domain(gnome_settings_exec_t, gnome_settings_exec_t) > +role gnome_settings_roles types gnome_settings_t; > + > +type gnome_settings_daemon_t; > +type gnome_settings_daemon_exec_t; > +userdom_user_application_domain(gnome_settings_daemon_exec_t, gnome_settings_daemon_exec_t) > +role gnome_settings_daemon_roles types gnome_settings_daemon_t; > + > +type gnome_settings_schemas_t; > +files_config_file(gnome_settings_schemas_t) > + > type gnome_home_t; > typealias gnome_home_t alias { user_gnome_home_t staff_gnome_home_t sysadm_gnome_home_t }; > typealias gnome_home_t alias { auditadm_gnome_home_t secadm_gnome_home_t }; > @@ -43,9 +73,18 @@ application_executable_file(gkeyringd_ex > type gnome_keyring_home_t; > userdom_user_home_content(gnome_keyring_home_t) > > +type gnome_keyring_cache_home_t; > +userdom_user_home_content(gnome_keyring_cache_home_t) > + > type gnome_keyring_tmp_t; > userdom_user_tmp_file(gnome_keyring_tmp_t) > > +type mime_info_t; > +files_config_file(mime_info_t) > + > +type gstreamer_orcexec_t; > +application_executable_file(gstreamer_orcexec_t) > + > ############################## > # > # Common local Policy > @@ -73,7 +112,62 @@ optional_policy(` > > ############################## > # > -# Conf daemon local Policy > +# DConf daemon local policy (Gnome3) > +# > + > +allow dconf_t self:process signal; > + > +allow dconf_t dconf_home_t:dir manage_dir_perms; > +allow dconf_t dconf_home_t:file manage_file_perms; > +allow dconf_t dconf_home_t:lnk_file manage_lnk_file_perms; > + > +userdom_search_user_home_content(dconf_t) > + > +fs_getattr_xattr_fs(dconf_t) > + > +kernel_read_system_state(dconf_t) > + > +selinux_getattr_fs(dconf_t) > + > +############################## > +# > +# At-spi local policy > +# > + > +allow at_spi_t self:process signal; > + > +allow at_spi_t dconf_home_t:dir manage_dir_perms; > +allow at_spi_t dconf_home_t:file manage_file_perms; > +allow at_spi_t dconf_home_t:lnk_file manage_lnk_file_perms; > + > +allow at_spi_t gnome_settings_schemas_t:dir list_dir_perms; > +allow at_spi_t gnome_settings_schemas_t:file read_file_perms; > +allow at_spi_t gnome_settings_schemas_t:lnk_file read_lnk_file_perms; > + > +rw_fifo_files_pattern(at_spi_t, at_spi_t, at_spi_t) > + > +corecmd_search_bin(at_spi_t) > + > +files_read_usr_files(at_spi_t) > + > +fs_getattr_xattr_fs(at_spi_t) > + > +kernel_read_system_state(at_spi_t) > + > +selinux_getattr_fs(at_spi_t) > + > +# search in .cache > +userdom_search_user_home_dirs(at_spi_t) > +userdom_search_user_home_content(at_spi_t) > + > +optional_policy(` > + xserver_read_user_xauth(at_spi_t) > + xserver_stream_connect(at_spi_t) > +') > + > +############################## > +# > +# GConf daemon local Policy (Gnome2) > # > > allow gconfd_t gconf_etc_t:dir list_dir_perms; > @@ -87,6 +181,12 @@ manage_dirs_pattern(gconfd_t, gconf_tmp_ > manage_files_pattern(gconfd_t, gconf_tmp_t, gconf_tmp_t) > userdom_user_tmp_filetrans(gconfd_t, gconf_tmp_t, { dir file }) > > +kernel_dontaudit_read_system_state(gconfd_t) > + > +files_search_tmp(gconfd_t) > + > +fs_getattr_xattr_fs(gconfd_t) > + > userdom_manage_user_tmp_dirs(gconfd_t) > userdom_tmp_filetrans_user_tmp(gconfd_t, dir) > userdom_user_runtime_filetrans_user_tmp(gconfd_t, dir) > @@ -102,6 +202,171 @@ optional_policy(` > ') > > ############################## > +# > +# Gnome-settings local policy > +# > + > +allow gnome_settings_t self:dir list_dir_perms; > +allow gnome_settings_t self:file rw_file_perms; > +allow gnome_settings_t self:process { fork sigchld }; > +allow gnome_settings_t self:unix_stream_socket create_stream_socket_perms; > + > +allow gnome_settings_t dconf_home_t:dir manage_dir_perms; > +allow gnome_settings_t dconf_home_t:file manage_file_perms; > +allow gnome_settings_t dconf_home_t:lnk_file manage_lnk_file_perms; > + > +allow gnome_settings_t gnome_settings_schemas_t:dir list_dir_perms; > +allow gnome_settings_t gnome_settings_schemas_t:file read_file_perms; > +allow gnome_settings_t gnome_settings_schemas_t:lnk_file read_lnk_file_perms; > + > +allow gnome_settings_t gnome_settings_exec_t:file entrypoint; > + > +rw_fifo_files_pattern(gnome_settings_t, gnome_settings_t, gnome_settings_t) > + > +corecmd_exec_bin(gnome_settings_t) > +corecmd_search_bin(gnome_settings_t) > + > +dev_dontaudit_search_sysfs(gnome_settings_t) > +dev_list_all_dev_nodes(gnome_settings_t) > +dev_rw_null(gnome_settings_t) > +dev_search_sysfs(gnome_settings_t) > + > +files_list_root(gnome_settings_t) > +files_read_etc_files(gnome_settings_t) > +files_read_usr_files(gnome_settings_t) > +files_search_pids(gnome_settings_t) > + > +fs_getattr_xattr_fs(gnome_settings_t) > + > +init_sigchld(gnome_settings_t) > + > +kernel_read_system_state(gnome_settings_t) > + > +libs_use_ld_so(gnome_settings_t) > +libs_use_shared_libs(gnome_settings_t) > + > +miscfiles_read_localization(gnome_settings_t) > + > +selinux_getattr_fs(gnome_settings_t) > +selinux_dontaudit_search_fs(gnome_settings_t) > + > +### should create an xserver interface for writing .xsession-errors > +userdom_dontaudit_write_user_home_content_files(gnome_settings_t) > + > +# search in .cache > +userdom_search_user_home_dirs(gnome_settings_t) > +userdom_search_user_home_content(gnome_settings_t) > + > +optional_policy(` > + dbus_read_lib_files(gnome_settings_t) > +') > + > +optional_policy(` > + xserver_use_xdm_fds(gnome_settings_t) > +') > + > +############################## > +# > +# Gnome-settings-daemon local policy > +# > + > +allow gnome_settings_daemon_t self:dir list_dir_perms; > +allow gnome_settings_daemon_t self:file rw_file_perms; > +allow gnome_settings_daemon_t self:lnk_file read_lnk_file_perms; > + > +allow gnome_settings_daemon_t self:process { fork sigchld signal }; > +allow gnome_settings_daemon_t self:unix_stream_socket create_stream_socket_perms; > +allow gnome_settings_daemon_t self:netlink_kobject_uevent_socket create_socket_perms; > + > +allow gnome_settings_daemon_t dconf_home_t:dir manage_dir_perms; > +allow gnome_settings_daemon_t dconf_home_t:file manage_file_perms; > +allow gnome_settings_daemon_t dconf_home_t:lnk_file manage_lnk_file_perms; > + > +allow gnome_settings_daemon_t gnome_settings_schemas_t:dir list_dir_perms; > +allow gnome_settings_daemon_t gnome_settings_schemas_t:file read_file_perms; > +allow gnome_settings_daemon_t gnome_settings_schemas_t:lnk_file read_lnk_file_perms; > + > +allow gnome_settings_daemon_t gnome_settings_daemon_exec_t:file { entrypoint exec_file_perms }; > + > +rw_fifo_files_pattern(gnome_settings_daemon_t, gnome_settings_daemon_t, gnome_settings_daemon_t) > + > +read_files_pattern(gnome_settings_daemon_t, mime_info_t, mime_info_t) > + > +cups_read_config(gnome_settings_daemon_t) > +cups_stream_connect(gnome_settings_daemon_t) > + > +dev_dontaudit_search_sysfs(gnome_settings_daemon_t) > +dev_read_urand(gnome_settings_daemon_t) > +dev_read_sysfs(gnome_settings_daemon_t) > +dev_rw_null(gnome_settings_daemon_t) > + > +files_list_root(gnome_settings_daemon_t) > +files_list_tmp(gnome_settings_daemon_t) > +files_read_etc_files(gnome_settings_daemon_t) > +files_read_usr_files(gnome_settings_daemon_t) > +files_search_tmp(gnome_settings_daemon_t) > + > +fs_getattr_tmpfs(gnome_settings_daemon_t) > +fs_getattr_xattr_fs(gnome_settings_daemon_t) > +fs_list_tmpfs(gnome_settings_daemon_t) > +fs_rw_tmpfs_files(gnome_settings_daemon_t) > + > +init_sigchld(gnome_settings_daemon_t) > + > +kernel_read_system_state(gnome_settings_daemon_t) > + > +libs_use_ld_so(gnome_settings_daemon_t) > +libs_use_shared_libs(gnome_settings_daemon_t) > + > +logging_search_logs(gnome_settings_daemon_t) > + > +miscfiles_read_fonts(gnome_settings_daemon_t) > +miscfiles_read_generic_certs(gnome_settings_daemon_t) > +miscfiles_read_localization(gnome_settings_daemon_t) > + > +selinux_getattr_fs(gnome_settings_daemon_t) > +selinux_dontaudit_search_fs(gnome_settings_daemon_t) > + > +### should create an xserver interface for writing .xsession-errors > +userdom_dontaudit_write_user_home_content_files(gnome_settings_daemon_t) > + > +userdom_list_user_home_dirs(gnome_settings_daemon_t) > +userdom_list_user_tmp(gnome_settings_daemon_t) > +userdom_search_user_home_dirs(gnome_settings_daemon_t) > +userdom_search_user_home_content(gnome_settings_daemon_t) > + > +optional_policy(` > + colord_dbus_chat(gnome_settings_daemon_t) > + colord_manage_home_files(gnome_settings_daemon_t) > +') > + > +optional_policy(` > + dbus_system_bus_client(gnome_settings_daemon_t) > +') > + > +optional_policy(` > + devicekit_dbus_chat_power(gnome_settings_daemon_t) > +') > + > +optional_policy(` > + policykit_dbus_chat(gnome_settings_daemon_t) > + policykit_domtrans(gnome_settings_daemon_t) > +') > + > +optional_policy(` > + pulseaudio_read_home(gnome_settings_daemon_t) > + pulseaudio_rw_tmpfs_files(gnome_settings_daemon_t) > + pulseaudio_signull(gnome_settings_daemon_t) > + pulseaudio_stream_connect(gnome_settings_daemon_t) > + pulseaudio_use_fds(gnome_settings_daemon_t) > +') > + > +optional_policy(` > + xserver_read_user_xauth(gnome_settings_daemon_t) > + xserver_stream_connect(gnome_settings_daemon_t) > +') > + > +############################## > # > # Keyring-daemon local policy > # > --- refpolicy-git-06082016-orig/policy/modules/contrib/policykit.fc 2016-08-06 21:27:11.407094942 +0200 > +++ refpolicy-git-06082016/policy/modules/contrib/policykit.fc 2016-08-20 01:03:29.139150710 +0200 > @@ -1,3 +1,5 @@ > +/usr/bin/pkexec -- gen_context(system_u:object_r:policykit_exec_t,s0) > + > /usr/lib/polkit-1/polkitd -- gen_context(system_u:object_r:policykit_exec_t,s0) > /usr/lib/polkit-1/polkit-agent-helper-1 -- gen_context(system_u:object_r:policykit_auth_exec_t,s0) > > --- refpolicy-git-06082016-orig/policy/modules/contrib/policykit.if 2016-08-06 21:27:11.407094942 +0200 > +++ refpolicy-git-06082016/policy/modules/contrib/policykit.if 2016-08-20 01:22:02.076149949 +0200 > @@ -44,6 +44,26 @@ interface(`policykit_dbus_chat_auth',` > > ######################################## > ## <summary> > +## Execute a domain transition to > +## run polkit. > +## </summary> > +## <param name="domain"> > +## <summary> > +## Domain allowed to transition. > +## </summary> > +## </param> > +# > +interface(`policykit_domtrans',` > + gen_require(` > + type policykit_t, policykit_exec_t; > + ') > + > + corecmd_search_bin($1) > + domtrans_pattern($1, policykit_exec_t, policykit_t) > +') > + > +######################################## > +## <summary> > ## Execute a domain transition to run polkit_auth. > ## </summary> > ## <param name="domain"> > --- refpolicy-git-06082016-orig/policy/modules/contrib/policykit.te 2016-08-06 21:27:11.408094953 +0200 > +++ refpolicy-git-06082016/policy/modules/contrib/policykit.te 2016-08-19 22:14:15.581772016 +0200 > @@ -117,6 +118,7 @@ optional_policy(` > > optional_policy(` > gnome_read_generic_home_content(policykit_t) > + gnome_read_settings_daemon_files(policykit_t) > ') > > optional_policy(` > --- refpolicy-git-06082016-orig/policy/modules/contrib/pulseaudio.if 2016-08-20 03:45:26.654959226 +0200 > +++ refpolicy-git-06082016/policy/modules/contrib/pulseaudio.if 2016-08-20 00:25:39.112517500 +0200 > @@ -347,3 +347,80 @@ interface(`pulseaudio_tmpfs_content',` > > typeattribute $1 pulseaudio_tmpfsfile; > ') > + > +####################################### > +## <summary> > +## Read pulseaudio tmpfs files. > +## </summary> > +## <param name="domain"> > +## <summary> > +## Domain allowed access. > +## </summary> > +## </param> > +# > +interface(`pulseaudio_read_tmpfs_files',` > + gen_require(` > + type pulseaudio_tmpfs_t; > + ') > + > + fs_search_tmpfs($1) > + read_files_pattern($1, pulseaudio_tmpfs_t, pulseaudio_tmpfs_t) > +') > + > +####################################### > +## <summary> > +## Read and write pulseaudio tmpfs > +## files. > +## </summary> > +## <param name="domain"> > +## <summary> > +## Domain allowed access. > +## </summary> > +## </param> > +# > +interface(`pulseaudio_rw_tmpfs_files',` > + gen_require(` > + type pulseaudio_tmpfs_t; > + ') > + > + fs_search_tmpfs($1) > + rw_files_pattern($1, pulseaudio_tmpfs_t, pulseaudio_tmpfs_t) > +') > + > +######################################## > +## <summary> > +## Use file descriptors for > +## pulseaudio. > +## </summary> > +## <param name="domain"> > +## <summary> > +## Domain allowed access. > +## </summary> > +## </param> > +# > +interface(`pulseaudio_use_fds',` > + gen_require(` > + type pulseaudio_t; > + ') > + > + allow $1 pulseaudio_t:fd use; > +') > + > +######################################## > +## <summary> > +## Do not audit attempts to use the > +## file descriptors for pulseaudio. > +## </summary> > +## <param name="domain"> > +## <summary> > +## Domain allowed access. > +## </summary> > +## </param> > +# > +interface(`pulseaudio_dontaudit_use_fds',` > + gen_require(` > + type pulseaudio_t; > + ') > + > + dontaudit $1 pulseaudio_t:fd use; > +') > --- refpolicy-git-14082016/policy/modules/contrib/pulseaudio.te 2016-08-20 06:08:33.005716322 +0200 > +++ refpolicy-git-06082016/policy/modules/contrib/pulseaudio.te 2016-08-18 18:23:19.470718028 +0200 > @@ -193,6 +193,11 @@ optional_policy(` > > optional_policy(` > gnome_stream_connect_gconf(pulseaudio_t) > + > + # OIL Runtime Compiler (ORC) optimized code execution > + allow pulseaudio_t gstreamer_orcexec_t:file { manage_file_perms mmap_file_perms }; > + gnome_user_runtime_filetrans_gstreamer_orcexec(pulseaudio_t, file) > + gnome_user_home_dir_filetrans_gstreamer_orcexec(pulseaudio_t, file) > ') > > optional_policy(`--- refpolicy-git-06082016-orig/policy/modules/system/userdomain.if 2016-08-20 04:02:51.687901531 +0200 > +++ refpolicy-git-06082016/policy/modules/system/userdomain.if 2016-08-19 23:44:30.690540547 +0200 > @@ -593,6 +593,10 @@ template(`userdom_common_user_template', > ') > > optional_policy(` > + colord_manage_home_files($1_t) > + ') > + > + optional_policy(` > dbus_system_bus_client($1_t) > > optional_policy(` > _______________________________________________ > refpolicy mailing list > refpolicy at oss.tresys.com > http://oss.tresys.com/mailman/listinfo/refpolicy > -- Key fingerprint = 5F4D 3CDB D3F8 3652 FBD8 02D5 3B6C 5F1D 2C7B 6B02 https://sks-keyservers.net/pks/lookup?op=get&search=0x3B6C5F1D2C7B6B02 Dominick Grift -------------- next part -------------- A non-text attachment was scrubbed... Name: signature.asc Type: application/pgp-signature Size: 648 bytes Desc: OpenPGP digital signature Url : http://oss.tresys.com/pipermail/refpolicy/attachments/20160821/4d08999f/attachment-0001.bin ^ permalink raw reply [flat|nested] 73+ messages in thread
* [refpolicy] [PATCH v3] Update for the gnome policy and file contexts 2016-08-21 18:49 ` Dominick Grift @ 2016-08-21 19:02 ` Guido Trentalancia 2016-08-21 19:05 ` Dominick Grift 0 siblings, 1 reply; 73+ messages in thread From: Guido Trentalancia @ 2016-08-21 19:02 UTC (permalink / raw) To: refpolicy Hello. On Sun, 21/08/2016 at 20.49 +0200, Dominick Grift via refpolicy wrote: > On 08/20/2016 04:52 PM, Guido Trentalancia via refpolicy wrote: > > > > Update for the gnome module: > > > > - target the dconf daemon, the gsettings user application, the > > ? gnome-settings-daemon and the at-spi daemon with all the > > ? needed domain transitions; > > - a new gstreamer_orcexec_t type and file context is introduced > > ? to support the OIL Runtime Compiler (ORC) optimized code > > ? execution (used for example by pulseaudio); > > - add support for more permissions needed in gconfd_t and gnome > > ? keyring domains; > > - add support for chat over dbus in the gconfd domain and in the > > ? new domains (dconf, gsettings, etc); > > - add support for a few needed fs and kernel permissions. > > - add support for reading the colord related files in the home > > ? directories (such as the ICC EDID profiles): requires the > > ? recent colord patch; > > - add support for for reading the colord related files in the home > > ? directories in the common user domain template; > > - add support for a new mime_info_t type to be used in the home > > ? directories; > > - includes minor modifications to the consolekit, dbus and > > ? policykit modules to support the new targeted gnome daemons > > ? and applications; > > - modifies the pulseaudio module to introduce new interfaces to > > ? read and write pulseaudio tmpfs files and to use the pulseaudio > > ? file descriptor. > > > > The support for Gnome2/ORBit-2 (version 2) has been dropped. > > if you want me to review this then you have to split this patch into > smaller patches You already reviewed the initial patch. However this new version is much different from it, so you might want to review it again. If you want, I can split it in separate patches, one for each module (colord, consolekit, dbus, gnome, policykit, pulseaudio and userdomain). However, they would be all interdependent, so I can't see much gain in doing that... Is that all right for you ? Regards, Guido ^ permalink raw reply [flat|nested] 73+ messages in thread
* [refpolicy] [PATCH v3] Update for the gnome policy and file contexts 2016-08-21 19:02 ` Guido Trentalancia @ 2016-08-21 19:05 ` Dominick Grift 2016-08-21 19:44 ` Guido Trentalancia 0 siblings, 1 reply; 73+ messages in thread From: Dominick Grift @ 2016-08-21 19:05 UTC (permalink / raw) To: refpolicy On 08/21/2016 09:02 PM, Guido Trentalancia wrote: > Hello. > > On Sun, 21/08/2016 at 20.49 +0200, Dominick Grift via refpolicy wrote: >> On 08/20/2016 04:52 PM, Guido Trentalancia via refpolicy wrote: >>> >>> Update for the gnome module: >>> >>> - target the dconf daemon, the gsettings user application, the >>> gnome-settings-daemon and the at-spi daemon with all the >>> needed domain transitions; >>> - a new gstreamer_orcexec_t type and file context is introduced >>> to support the OIL Runtime Compiler (ORC) optimized code >>> execution (used for example by pulseaudio); >>> - add support for more permissions needed in gconfd_t and gnome >>> keyring domains; >>> - add support for chat over dbus in the gconfd domain and in the >>> new domains (dconf, gsettings, etc); >>> - add support for a few needed fs and kernel permissions. >>> - add support for reading the colord related files in the home >>> directories (such as the ICC EDID profiles): requires the >>> recent colord patch; >>> - add support for for reading the colord related files in the home >>> directories in the common user domain template; >>> - add support for a new mime_info_t type to be used in the home >>> directories; >>> - includes minor modifications to the consolekit, dbus and >>> policykit modules to support the new targeted gnome daemons >>> and applications; >>> - modifies the pulseaudio module to introduce new interfaces to >>> read and write pulseaudio tmpfs files and to use the pulseaudio >>> file descriptor. >>> >>> The support for Gnome2/ORBit-2 (version 2) has been dropped. >> >> if you want me to review this then you have to split this patch into >> smaller patches > > You already reviewed the initial patch. However this new version is > much different from it, so you might want to review it again. > > If you want, I can split it in separate patches, one for each module > (colord, consolekit, dbus, gnome, policykit, pulseaudio and > userdomain). However, they would be all interdependent, so I can't see > much gain in doing that... > > Is that all right for you ? I can't review this as-is. So if you want my feedback then you will have to find a way to split this into smaller but sensible patches. > > Regards, > > Guido > -- Key fingerprint = 5F4D 3CDB D3F8 3652 FBD8 02D5 3B6C 5F1D 2C7B 6B02 https://sks-keyservers.net/pks/lookup?op=get&search=0x3B6C5F1D2C7B6B02 Dominick Grift -------------- next part -------------- A non-text attachment was scrubbed... Name: signature.asc Type: application/pgp-signature Size: 648 bytes Desc: OpenPGP digital signature Url : http://oss.tresys.com/pipermail/refpolicy/attachments/20160821/74ce28f6/attachment.bin ^ permalink raw reply [flat|nested] 73+ messages in thread
* [refpolicy] [PATCH v3] Update for the gnome policy and file contexts 2016-08-21 19:05 ` Dominick Grift @ 2016-08-21 19:44 ` Guido Trentalancia 0 siblings, 0 replies; 73+ messages in thread From: Guido Trentalancia @ 2016-08-21 19:44 UTC (permalink / raw) To: refpolicy On Sun, 21/08/2016 at 21.05 +0200, Dominick Grift wrote: > On 08/21/2016 09:02 PM, Guido Trentalancia wrote: > > > > Hello. > > > > On Sun, 21/08/2016 at 20.49 +0200, Dominick Grift via refpolicy > > wrote: > > > > > > On 08/20/2016 04:52 PM, Guido Trentalancia via refpolicy wrote: > > > > > > > > > > > > Update for the gnome module: > > > > > > > > - target the dconf daemon, the gsettings user application, the > > > > ? gnome-settings-daemon and the at-spi daemon with all the > > > > ? needed domain transitions; > > > > - a new gstreamer_orcexec_t type and file context is introduced > > > > ? to support the OIL Runtime Compiler (ORC) optimized code > > > > ? execution (used for example by pulseaudio); > > > > - add support for more permissions needed in gconfd_t and gnome > > > > ? keyring domains; > > > > - add support for chat over dbus in the gconfd domain and in > > > > the > > > > ? new domains (dconf, gsettings, etc); > > > > - add support for a few needed fs and kernel permissions. > > > > - add support for reading the colord related files in the home > > > > ? directories (such as the ICC EDID profiles): requires the > > > > ? recent colord patch; > > > > - add support for for reading the colord related files in the > > > > home > > > > ? directories in the common user domain template; > > > > - add support for a new mime_info_t type to be used in the home > > > > ? directories; > > > > - includes minor modifications to the consolekit, dbus and > > > > ? policykit modules to support the new targeted gnome daemons > > > > ? and applications; > > > > - modifies the pulseaudio module to introduce new interfaces to > > > > ? read and write pulseaudio tmpfs files and to use the > > > > pulseaudio > > > > ? file descriptor. > > > > > > > > The support for Gnome2/ORBit-2 (version 2) has been dropped. > > > > > > if you want me to review this then you have to split this patch > > > into > > > smaller patches > > > > You already reviewed the initial patch. However this new version is > > much different from it, so you might want to review it again. > > > > If you want, I can split it in separate patches, one for each > > module > > (colord, consolekit, dbus, gnome, policykit, pulseaudio and > > userdomain). However, they would be all interdependent, so I can't > > see > > much gain in doing that... > > > > Is that all right for you ? > > I can't review this as-is. So if you want my feedback then you will > have > to find a way to split this into smaller but sensible patches. It can't be really split. It doesn't matter, if you don't want or don't have time to review it... Regards, Guido ^ permalink raw reply [flat|nested] 73+ messages in thread
* [refpolicy] [PATCH v4] Update for the gnome policy and file contexts 2016-08-20 14:52 ` [refpolicy] [PATCH v3] " Guido Trentalancia 2016-08-21 18:49 ` Dominick Grift @ 2016-08-22 19:39 ` Guido Trentalancia 2016-08-23 1:15 ` Chris PeBenito 2016-09-01 4:20 ` Jason Zaman 1 sibling, 2 replies; 73+ messages in thread From: Guido Trentalancia @ 2016-08-22 19:39 UTC (permalink / raw) To: refpolicy Update for the gnome module: - target the dconf daemon, the gsettings user application, the gnome-settings-daemon and the at-spi daemon with all the needed domain transitions; - a new gstreamer_orcexec_t type and file context is introduced to support the OIL Runtime Compiler (ORC) optimized code execution (used for example by pulseaudio); - add support for more permissions needed in gconfd_t and gnome keyring domains; - add support for chat over dbus in the gconfd domain and in the new domains (dconf, gsettings, etc); - add support for a few needed fs and kernel permissions. - add support for reading the colord related files in the home directories (such as the ICC EDID profiles): requires the recent colord patch; - add support for for reading the colord related files in the home directories in the common user domain template; - add support for a new mime_info_t type to be used in the home directories; - includes minor modifications to the consolekit, dbus and policykit modules to support the new targeted gnome daemons and applications; - modifies the pulseaudio module to introduce new interfaces to read and write pulseaudio tmpfs files and to use the pulseaudio file descriptor; - provides better module encapsulation (i.e. dbus module). The support for Gnome2/ORBit-2 (version 2) has been dropped. This patch depends on the recent colord patch. Recent changes to the pulseaudio module depends on this patch ! Signed-off-by: Guido Trentalancia <guido@trentalancia.net> --- policy/modules/contrib/colord.if | 41 +++ policy/modules/contrib/colord.te | 4 policy/modules/contrib/consolekit.te | 4 policy/modules/contrib/dbus.if | 22 + policy/modules/contrib/dbus.te | 9 policy/modules/contrib/gnome.fc | 19 + policy/modules/contrib/gnome.if | 418 ++++++++++++++++++++++++++++++++++- policy/modules/contrib/gnome.te | 267 ++++++++++++++++++++++ policy/modules/contrib/policykit.fc | 2 policy/modules/contrib/policykit.if | 20 + policy/modules/contrib/policykit.te | 1 policy/modules/contrib/pulseaudio.if | 77 ++++++ policy/modules/contrib/pulseaudio.te | 5 policy/modules/system/userdomain.if | 4 14 files changed, 890 insertions(+), 3 deletions(-) --- refpolicy-git-06082016-orig/policy/modules/contrib/colord.if 2016-08-06 21:27:11.338094155 +0200 +++ refpolicy-git-06082016/policy/modules/contrib/colord.if 2016-08-19 23:13:27.765740337 +0200 @@ -58,3 +58,44 @@ interface(`colord_read_lib_files',` files_search_var_lib($1) read_files_pattern($1, colord_var_lib_t, colord_var_lib_t) ') + +###################################### +## <summary> +## Read colord home files. +## </summary> +## <param name="domain"> +## <summary> +## Domain allowed access. +## </summary> +## </param> +# +interface(`colord_read_home_files',` + gen_require(` + type colord_home_t; + ') + + userdom_search_user_home_dirs($1) + userdom_list_user_home_content($1) + read_files_pattern($1, colord_home_t, colord_home_t) +') + +###################################### +## <summary> +## Create, read, write, and delete +## colord home content. +## </summary> +## <param name="domain"> +## <summary> +## Domain allowed access. +## </summary> +## </param> +# +interface(`colord_manage_home_files',` + gen_require(` + type colord_home_t; + ') + + userdom_search_user_home_dirs($1) + userdom_list_user_home_content($1) + manage_files_pattern($1, colord_home_t, colord_home_t) +') --- refpolicy-git-14082016/policy/modules/contrib/colord.te 2016-08-14 21:28:11.468519205 +0200 +++ refpolicy-git-06082016/policy/modules/contrib/colord.te 2016-08-20 00:21:47.786192022 +0200 @@ -123,6 +136,10 @@ optional_policy(` ') optional_policy(` + gnome_settings_daemon_use_fds(colord_t) +') + +optional_policy(` policykit_dbus_chat(colord_t) policykit_domtrans_auth(colord_t) policykit_read_lib(colord_t)--- refpolicy-git-06082016-orig/policy/modules/contrib/consolekit.te 2016-08-07 23:05:57.060018494 +0200 +++ refpolicy-git-06082016/policy/modules/contrib/consolekit.te 2016-08-19 22:13:01.508709501 +0200 @@ -104,6 +101,10 @@ tunable_policy(`use_samba_home_dirs',` ') optional_policy(` + gnome_read_settings_daemon_files(consolekit_t) +') + +optional_policy(` dbus_read_lib_files(consolekit_t) dbus_system_domain(consolekit_t, consolekit_exec_t) --- refpolicy-git-06082016-orig/policy/modules/contrib/dbus.if 2016-08-06 21:27:11.344094223 +0200 +++ refpolicy-git-06082016/policy/modules/contrib/dbus.if 2016-08-22 21:16:25.424569109 +0200 @@ -626,3 +626,25 @@ interface(`dbus_unconfined',` typeattribute $1 dbusd_unconfined; ') + +######################################## +## <summary> +## Make a domain transition from a +## given source domain to another +## specified target domain using +## the DBUS executable file type. +## </summary> +## <param name="domain"> +## <summary> +## Source domain. +## </summary> +## </param> +# +interface(`dbus_domain_transition',` + gen_require(` + type dbusd_exec_t; + ') + + allow $1 dbusd_exec_t:file { entrypoint exec_file_perms }; + domtrans_pattern($1, dbusd_exec_t, $2) +')--- refpolicy-git-06082016-orig/policy/modules/contrib/dbus.te 2016-08-06 21:27:11.344094223 +0200 +++ refpolicy-git-06082016/policy/modules/contrib/dbus.te 2016-08-20 00:27:48.730380843 +0200 @@ -148,6 +148,15 @@ optional_policy(` ') optional_policy(` + colord_read_home_files(system_dbusd_t) +') + +optional_policy(` + gnome_read_settings_daemon_files(system_dbusd_t) + gnome_settings_daemon_use_fds(system_dbusd_t) +') + +optional_policy(` policykit_read_lib(system_dbusd_t) ') --- refpolicy-git-06082016-orig/policy/modules/contrib/gnome.fc 2016-08-06 21:27:11.354094337 +0200 +++ refpolicy-git-06082016/policy/modules/contrib/gnome.fc 2016-08-19 23:26:12.625475184 +0200 @@ -1,16 +1,33 @@ +HOME_DIR/\.cache/dconf(/.*)? gen_context(system_u:object_r:dconf_home_t,s0) +HOME_DIR/\.cache/keyring[^/]+(/.*)? gen_context(system_u:object_r:gnome_keyring_cache_home_t,s0) +HOME_DIR/\.config/dconf(/.*)? gen_context(system_u:object_r:dconf_home_t,s0) HOME_DIR/\.gconf(/.*)? gen_context(system_u:object_r:gconf_home_t,s0) HOME_DIR/\.gconfd(/.*)? gen_context(system_u:object_r:gconf_home_t,s0) HOME_DIR/\.gnome(/.*)? gen_context(system_u:object_r:gnome_home_t,s0) HOME_DIR/\.gnome2(/.*)? gen_context(system_u:object_r:gnome_home_t,s0) HOME_DIR/\.gnome2/keyrings(/.*)? gen_context(system_u:object_r:gnome_keyring_home_t,s0) HOME_DIR/\.gnome2_private(/.*)? gen_context(system_u:object_r:gnome_home_t,s0) +HOME_DIR/\.local/share/mime(/.*)? gen_context(system_u:object_r:mime_info_t,s0) + +HOME_DIR/orcexec\..* gen_context(system_u:object_r:gstreamer_orcexec_t,s0) /etc/gconf(/.*)? gen_context(system_u:object_r:gconf_etc_t,s0) /tmp/gconfd-USER/.* -- gen_context(system_u:object_r:gconf_tmp_t,s0) /usr/bin/gnome-keyring-daemon -- gen_context(system_u:object_r:gkeyringd_exec_t,s0) +/usr/bin/gsettings -- gen_context(system_u:object_r:gnome_settings_exec_t,s0) /usr/bin/mate-keyring-daemon -- gen_context(system_u:object_r:gkeyringd_exec_t,s0) /usr/lib/[^/]*/gconf/gconfd-2 -- gen_context(system_u:object_r:gconfd_exec_t,s0) -/usr/libexec/gconfd-2 -- gen_context(system_u:object_r:gconfd_exec_t,s0) + +/usr/libexec/at-spi-bus-launcher -- gen_context(system_u:object_r:at_spi_exec_t,s0) +/usr/libexec/dconf-service -- gen_context(system_u:object_r:dconf_exec_t,s0) +/usr/libexec/gconfd-2 -- gen_context(system_u:object_r:gconfd_exec_t,s0) +/usr/libexec/gnome-settings-daemon -- gen_context(system_u:object_r:gnome_settings_daemon_exec_t,s0) +/usr/libexec/gsd-[^/]* -- gen_context(system_u:object_r:gnome_settings_daemon_exec_t,s0) + +/usr/share/glib-[^/]*/schemas(/.*)? gen_context(system_u:object_r:gnome_settings_schemas_t,s0) + +/var/run/user/[^/]*/orcexec\..* -- gen_context(system_u:object_r:gstreamer_orcexec_t,s0) +/var/run/user/%{USERID}/orcexec\..* -- gen_context(system_u:object_r:gstreamer_orcexec_t,s0) --- refpolicy-git-06082016-orig/policy/modules/contrib/gnome.if 2016-08-06 21:27:11.354094337 +0200 +++ refpolicy-git-06082016/policy/modules/contrib/gnome.if 2016-08-22 21:24:49.634876147 +0200 @@ -43,14 +43,39 @@ interface(`gnome_role',` template(`gnome_role_template',` gen_require(` attribute gnomedomain, gkeyringd_domain; + attribute_role dconf_roles; + attribute_role at_spi_roles; attribute_role gconfd_roles; - type gkeyringd_exec_t, gnome_keyring_home_t, gnome_keyring_tmp_t; + attribute_role gnome_settings_roles; + attribute_role gnome_settings_daemon_roles; + type dconf_t, dconf_exec_t, dconf_home_t; + type at_spi_t, at_spi_exec_t; type gconfd_t, gconfd_exec_t, gconf_tmp_t; type gconf_home_t; + type gnome_settings_t, gnome_settings_exec_t; + type gnome_settings_daemon_t, gnome_settings_daemon_exec_t; + type gnome_settings_schemas_t; + type gkeyringd_exec_t, gnome_keyring_home_t, gnome_keyring_cache_home_t, gnome_keyring_tmp_t; + type mime_info_t; + type user_dbusd_t; ') ######################################## # + # Dconf declarations + # + + roleattribute $2 dconf_roles; + + ######################################## + # + # At-spi declarations + # + + roleattribute $2 at_spi_roles; + + ######################################## + # # Gconf declarations # @@ -58,6 +83,20 @@ template(`gnome_role_template',` ######################################## # + # Gnome-settings declarations + # + + roleattribute $2 gnome_settings_roles; + + ######################################## + # + # Gnome-settings-daemon declarations + # + + roleattribute $2 gnome_settings_daemon_roles; + + ######################################## + # # Gkeyringd declarations # @@ -69,6 +108,64 @@ template(`gnome_role_template',` ######################################## # + # Common policy + # + + allow $3 dconf_home_t:dir manage_dir_perms; + allow $3 dconf_home_t:file manage_file_perms; + allow $3 dconf_home_t:lnk_file manage_lnk_file_perms; + + allow $3 gnome_settings_schemas_t:dir list_dir_perms; + allow $3 gnome_settings_schemas_t:file read_file_perms; + allow $3 gnome_settings_schemas_t:lnk_file read_lnk_file_perms; + + allow $3 mime_info_t:dir list_dir_perms; + allow $3 mime_info_t:file read_file_perms; + + allow at_spi_t user_dbusd_t:process signal; + + allow user_dbusd_t self:process signal; + + allow user_dbusd_t bin_t:file entrypoint; + + gnome_read_settings_files(user_dbusd_t) + gnome_read_settings_daemon_files(user_dbusd_t) + + files_read_usr_files($3) + + kernel_read_system_state(user_dbusd_t) + + optional_policy(` + xserver_read_user_xauth(user_dbusd_t) + xserver_stream_connect(user_dbusd_t) + ') + + ######################################## + # + # Dconf policy + # + + allow dconf_t user_dbusd_t:unix_stream_socket connectto; + + allow user_dbusd_t dconf_exec_t:file { entrypoint exec_file_perms }; + + domtrans_pattern(user_dbusd_t, dconf_exec_t, dconf_t) + + ######################################## + # + # At-spi policy + # + + allow at_spi_t user_dbusd_t:unix_stream_socket connectto; + + allow user_dbusd_t at_spi_exec_t:file { entrypoint exec_file_perms }; + + allow $3 at_spi_t:fd use; + + domtrans_pattern(user_dbusd_t, at_spi_exec_t, at_spi_t) + + ######################################## + # # Gconf policy # @@ -84,6 +181,35 @@ template(`gnome_role_template',` ######################################## # + # Gnome-settings policy + # + + domtrans_pattern($3, gnome_settings_exec_t, gnome_settings_t) + + allow $3 gnome_settings_t:process { ptrace signal_perms }; + ps_process_pattern($3, gnome_settings_t) + + allow gnome_settings_t user_dbusd_t:unix_stream_socket connectto; + + allow gnome_settings_t bin_t:file entrypoint; + + # for dbus-launch + corecmd_bin_domtrans(gnome_settings_t, user_dbusd_t) + + ######################################## + # + # Gnome-settings-daemon policy + # + + domtrans_pattern($3, gnome_settings_daemon_exec_t, gnome_settings_daemon_t) + + allow gnome_settings_daemon_t user_dbusd_t:unix_stream_socket connectto; + + allow $3 gnome_settings_daemon_t:process { ptrace signal_perms }; + ps_process_pattern($3, gnome_settings_daemon_t) + + ######################################## + # # Gkeyringd policy # @@ -100,23 +226,87 @@ template(`gnome_role_template',` allow $3 gnome_keyring_tmp_t:sock_file { relabel_sock_file_perms manage_sock_file_perms }; + userdom_manage_user_home_content_dirs($1_gkeyringd_t) + userdom_manage_user_home_content_files($1_gkeyringd_t) + + manage_dirs_pattern($1_gkeyringd_t, gnome_keyring_cache_home_t, gnome_keyring_cache_home_t) + userdom_user_home_content_filetrans($1_gkeyringd_t, gnome_keyring_cache_home_t, dir) + + manage_sock_files_pattern($1_gkeyringd_t, gnome_keyring_cache_home_t, gnome_keyring_cache_home_t) + userdom_user_home_content_filetrans($1_gkeyringd_t, gnome_keyring_cache_home_t, sock_file) + ps_process_pattern($3, $1_gkeyringd_t) allow $3 $1_gkeyringd_t:process { ptrace signal_perms }; + kernel_read_kernel_sysctls($1_gkeyringd_t) + corecmd_bin_domtrans($1_gkeyringd_t, $3) corecmd_shell_domtrans($1_gkeyringd_t, $3) gnome_stream_connect_gkeyringd($1, $3) optional_policy(` + dbus_connect_spec_session_bus(user, dconf_t) + dbus_connect_spec_session_bus(user, at_spi_t) + dbus_connect_spec_session_bus(user, gnome_settings_daemon_t) + dbus_connect_system_bus(gnome_settings_daemon_t) + dbus_domain_transition(at_spi_t, user_dbusd_t) + dbus_domain_transition(gnome_settings_t, user_dbusd_t) + dbus_send_spec_session_bus(user, dconf_t) + dbus_send_spec_session_bus(user, at_spi_t) + dbus_send_spec_session_bus(user, gnome_settings_daemon_t) dbus_spec_session_domain($1, $1_gkeyringd_t, gkeyringd_exec_t) optional_policy(` + gnome_dbus_chat_dconf($3) + gnome_dbus_chat_dconf(gnome_settings_t) + gnome_dbus_chat_at_spi($3) + gnome_dbus_chat_gconfd($3) + gnome_dbus_chat_gnome_settings(user_dbusd_t) + gnome_dbus_chat_gnome_settings_daemon($3) + gnome_dbus_chat_gnome_settings_daemon(at_spi_t) gnome_dbus_chat_gkeyringd($1, $3) ') ') ') +####################################### +## <summary> +## Read gnome-settings files. +## </summary> +## <param name="domain"> +## <summary> +## Domain allowed access. +## </summary> +## </param> +# +interface(`gnome_read_settings_files',` + gen_require(` + type gnome_settings_t; + ') + + read_files_pattern($1, gnome_settings_t, gnome_settings_t) +') + +####################################### +## <summary> +## Read gnome-settings-daemon +## files. +## </summary> +## <param name="domain"> +## <summary> +## Domain allowed access. +## </summary> +## </param> +# +interface(`gnome_read_settings_daemon_files',` + gen_require(` + type gnome_settings_daemon_t; + ') + + read_files_pattern($1, gnome_settings_daemon_t, gnome_settings_daemon_t) +') + ######################################## ## <summary> ## Execute gconf in the caller domain. @@ -569,6 +759,36 @@ interface(`gnome_home_filetrans_gnome_ho ######################################## ## <summary> +## Create objects in user home +## directories with the gstreamer +## orcexec type. +## </summary> +## <param name="domain"> +## <summary> +## Domain allowed access. +## </summary> +## </param> +## <param name="object_class"> +## <summary> +## Class of the object being created. +## </summary> +## </param> +## <param name="name" optional="true"> +## <summary> +## The name of the object being created. +## </summary> +## </param> +# +interface(`gnome_user_home_dir_filetrans_gstreamer_orcexec',` + gen_require(` + type gstreamer_orcexec_t; + ') + + userdom_user_home_dir_filetrans($1, gstreamer_orcexec_t, $2, $3) +') + +######################################## +## <summary> ## Create objects in gnome gconf home ## directories with a private type. ## </summary> @@ -604,6 +824,36 @@ interface(`gnome_gconf_home_filetrans',` ######################################## ## <summary> +## Create objects in the user +## runtime directories with the +## gstreamer orcexec type. +## </summary> +## <param name="domain"> +## <summary> +## Domain allowed access. +## </summary> +## </param> +## <param name="object_class"> +## <summary> +## Class of the object being created. +## </summary> +## </param> +## <param name="name" optional="true"> +## <summary> +## The name of the object being created. +## </summary> +## </param> +# +interface(`gnome_user_runtime_filetrans_gstreamer_orcexec',` + gen_require(` + type gstreamer_orcexec_t; + ') + + userdom_user_runtime_filetrans($1, gstreamer_orcexec_t, $2, $3) +') + +######################################## +## <summary> ## Read generic gnome keyring home files. ## </summary> ## <param name="domain"> @@ -623,6 +873,133 @@ interface(`gnome_read_keyring_home_files ######################################## ## <summary> +## Read mime info files in the home +## directory. +## </summary> +## <param name="domain"> +## <summary> +## Domain allowed access. +## </summary> +## </param> +# +interface(`gnome_read_mime_info_home_files',` + gen_require(` + type mime_info_t; + ') + + userdom_search_user_home_dirs($1) + userdom_list_user_home_content($1) + read_files_pattern($1, mime_info_t, mime_info_t) +') + +######################################## +## <summary> +## Send and receive messages from +## the dconf daemon over dbus. +## </summary> +## <param name="domain"> +## <summary> +## Domain allowed access. +## </summary> +## </param> +# +interface(`gnome_dbus_chat_dconf',` + gen_require(` + type dconf_t; + class dbus send_msg; + ') + + allow $1 dconf_t:dbus send_msg; + allow dconf_t $1:dbus send_msg; +') + +######################################## +## <summary> +## Send and receive messages from +## the at-spi daemon over dbus. +## </summary> +## <param name="domain"> +## <summary> +## Domain allowed access. +## </summary> +## </param> +# +interface(`gnome_dbus_chat_at_spi',` + gen_require(` + type at_spi_t; + class dbus send_msg; + ') + + allow $1 at_spi_t:dbus send_msg; + allow at_spi_t $1:dbus send_msg; +') + +######################################## +## <summary> +## Send and receive messages from +## the gconf daemon over dbus. +## </summary> +## <param name="domain"> +## <summary> +## Domain allowed access. +## </summary> +## </param> +# +interface(`gnome_dbus_chat_gconfd',` + gen_require(` + type gconfd_t; + class dbus send_msg; + ') + + allow $1 gconfd_t:dbus send_msg; + allow gconfd_t $1:dbus send_msg; +') + +######################################## +## <summary> +## Send and receive messages from +## gnome-settings over dbus. +## </summary> +## <param name="domain"> +## <summary> +## Domain allowed access. +## </summary> +## </param> +# +interface(`gnome_dbus_chat_gnome_settings',` + gen_require(` + type gnome_settings_t; + class dbus send_msg; + ') + + allow $1 gnome_settings_t:dbus send_msg; + allow gnome_settings_t $1:dbus send_msg; +') + +######################################## +## <summary> +## Send and receive messages from +## the gnome-settings-daemon over +## dbus. +## </summary> +## <param name="domain"> +## <summary> +## Domain allowed access. +## </summary> +## </param> +# +interface(`gnome_dbus_chat_gnome_settings_daemon',` + gen_require(` + type gnome_settings_daemon_t; + class dbus send_msg; + ') + + allow $1 gnome_settings_daemon_t:dbus send_msg; + allow gnome_settings_daemon_t $1:dbus send_msg; +') + +######################################## +## <summary> ## Send and receive messages from ## gnome keyring daemon over dbus. ## </summary> @@ -735,3 +1112,42 @@ interface(`gnome_stream_connect_all_gkey files_search_tmp($1) stream_connect_pattern($1, gnome_keyring_tmp_t, gnome_keyring_tmp_t, gkeyringd_domain) ') + +######################################## +## <summary> +## Use file descriptors for +## the gnome settings daemon. +## </summary> +## <param name="domain"> +## <summary> +## Domain allowed access. +## </summary> +## </param> +# +interface(`gnome_settings_daemon_use_fds',` + gen_require(` + type gnome_settings_daemon_t; + ') + + allow $1 gnome_settings_daemon_t:fd use; +') + +######################################## +## <summary> +## Do not audit attempts to use the +## file descriptors for the gnome +## settings daemon. +## </summary> +## <param name="domain"> +## <summary> +## Domain allowed access. +## </summary> +## </param> +# +interface(`gnome_dontaudit_settings_daemon_use_fds',` + gen_require(` + type gnome_settings_daemon_t; + ') + + dontaudit $1 gnome_settings_daemon_t:fd use; +') --- refpolicy-git-06082016-orig/policy/modules/contrib/gnome.te 2016-08-06 21:27:11.354094337 +0200 +++ refpolicy-git-06082016/policy/modules/contrib/gnome.te 2016-08-22 21:04:17.942469224 +0200 @@ -7,7 +7,24 @@ policy_module(gnome, 2.5.1) attribute gkeyringd_domain; attribute gnomedomain; +attribute_role dconf_roles; +attribute_role at_spi_roles; attribute_role gconfd_roles; +attribute_role gnome_settings_roles; +attribute_role gnome_settings_daemon_roles; + +type dconf_t; +type dconf_exec_t; +userdom_user_application_domain(dconf_t, dconf_exec_t) +role dconf_roles types dconf_t; + +type dconf_home_t; +userdom_user_home_content(dconf_home_t) + +type at_spi_t; +type at_spi_exec_t; +userdom_user_application_domain(at_spi_t, at_spi_exec_t) +role at_spi_roles types at_spi_t; type gconf_etc_t; files_config_file(gconf_etc_t) @@ -31,6 +48,19 @@ typealias gconfd_t alias { auditadm_gcon userdom_user_application_domain(gconfd_t, gconfd_exec_t) role gconfd_roles types gconfd_t; +type gnome_settings_t; +type gnome_settings_exec_t; +userdom_user_application_domain(gnome_settings_t, gnome_settings_exec_t) +role gnome_settings_roles types gnome_settings_t; + +type gnome_settings_daemon_t; +type gnome_settings_daemon_exec_t; +userdom_user_application_domain(gnome_settings_daemon_t, gnome_settings_daemon_exec_t) +role gnome_settings_daemon_roles types gnome_settings_daemon_t; + +type gnome_settings_schemas_t; +files_config_file(gnome_settings_schemas_t) + type gnome_home_t; typealias gnome_home_t alias { user_gnome_home_t staff_gnome_home_t sysadm_gnome_home_t }; typealias gnome_home_t alias { auditadm_gnome_home_t secadm_gnome_home_t }; @@ -43,9 +73,18 @@ application_executable_file(gkeyringd_ex type gnome_keyring_home_t; userdom_user_home_content(gnome_keyring_home_t) +type gnome_keyring_cache_home_t; +userdom_user_home_content(gnome_keyring_cache_home_t) + type gnome_keyring_tmp_t; userdom_user_tmp_file(gnome_keyring_tmp_t) +type mime_info_t; +files_config_file(mime_info_t) + +type gstreamer_orcexec_t; +application_executable_file(gstreamer_orcexec_t) + ############################## # # Common local Policy @@ -73,7 +112,62 @@ optional_policy(` ############################## # -# Conf daemon local Policy +# DConf daemon local policy (Gnome3) +# + +allow dconf_t self:process signal; + +allow dconf_t dconf_home_t:dir manage_dir_perms; +allow dconf_t dconf_home_t:file manage_file_perms; +allow dconf_t dconf_home_t:lnk_file manage_lnk_file_perms; + +userdom_search_user_home_content(dconf_t) + +fs_getattr_xattr_fs(dconf_t) + +kernel_read_system_state(dconf_t) + +selinux_getattr_fs(dconf_t) + +############################## +# +# At-spi local policy +# + +allow at_spi_t self:process signal; + +allow at_spi_t dconf_home_t:dir manage_dir_perms; +allow at_spi_t dconf_home_t:file manage_file_perms; +allow at_spi_t dconf_home_t:lnk_file manage_lnk_file_perms; + +allow at_spi_t gnome_settings_schemas_t:dir list_dir_perms; +allow at_spi_t gnome_settings_schemas_t:file read_file_perms; +allow at_spi_t gnome_settings_schemas_t:lnk_file read_lnk_file_perms; + +rw_fifo_files_pattern(at_spi_t, at_spi_t, at_spi_t) + +corecmd_search_bin(at_spi_t) + +files_read_usr_files(at_spi_t) + +fs_getattr_xattr_fs(at_spi_t) + +kernel_read_system_state(at_spi_t) + +selinux_getattr_fs(at_spi_t) + +# search in .cache +userdom_search_user_home_dirs(at_spi_t) +userdom_search_user_home_content(at_spi_t) + +optional_policy(` + xserver_read_user_xauth(at_spi_t) + xserver_stream_connect(at_spi_t) +') + +############################## +# +# GConf daemon local Policy (Gnome2) # allow gconfd_t gconf_etc_t:dir list_dir_perms; @@ -87,6 +181,12 @@ manage_dirs_pattern(gconfd_t, gconf_tmp_ manage_files_pattern(gconfd_t, gconf_tmp_t, gconf_tmp_t) userdom_user_tmp_filetrans(gconfd_t, gconf_tmp_t, { dir file }) +kernel_dontaudit_read_system_state(gconfd_t) + +files_search_tmp(gconfd_t) + +fs_getattr_xattr_fs(gconfd_t) + userdom_manage_user_tmp_dirs(gconfd_t) userdom_tmp_filetrans_user_tmp(gconfd_t, dir) userdom_user_runtime_filetrans_user_tmp(gconfd_t, dir) @@ -102,6 +202,171 @@ optional_policy(` ') ############################## +# +# Gnome-settings local policy +# + +allow gnome_settings_t self:dir list_dir_perms; +allow gnome_settings_t self:file rw_file_perms; +allow gnome_settings_t self:process { fork sigchld }; +allow gnome_settings_t self:unix_stream_socket create_stream_socket_perms; + +allow gnome_settings_t dconf_home_t:dir manage_dir_perms; +allow gnome_settings_t dconf_home_t:file manage_file_perms; +allow gnome_settings_t dconf_home_t:lnk_file manage_lnk_file_perms; + +allow gnome_settings_t gnome_settings_schemas_t:dir list_dir_perms; +allow gnome_settings_t gnome_settings_schemas_t:file read_file_perms; +allow gnome_settings_t gnome_settings_schemas_t:lnk_file read_lnk_file_perms; + +allow gnome_settings_t gnome_settings_exec_t:file entrypoint; + +rw_fifo_files_pattern(gnome_settings_t, gnome_settings_t, gnome_settings_t) + +corecmd_exec_bin(gnome_settings_t) +corecmd_search_bin(gnome_settings_t) + +dev_dontaudit_search_sysfs(gnome_settings_t) +dev_list_all_dev_nodes(gnome_settings_t) +dev_rw_null(gnome_settings_t) +dev_search_sysfs(gnome_settings_t) + +files_list_root(gnome_settings_t) +files_read_etc_files(gnome_settings_t) +files_read_usr_files(gnome_settings_t) +files_search_pids(gnome_settings_t) + +fs_getattr_xattr_fs(gnome_settings_t) + +init_sigchld(gnome_settings_t) + +kernel_read_system_state(gnome_settings_t) + +libs_use_ld_so(gnome_settings_t) +libs_use_shared_libs(gnome_settings_t) + +miscfiles_read_localization(gnome_settings_t) + +selinux_getattr_fs(gnome_settings_t) +selinux_dontaudit_search_fs(gnome_settings_t) + +### should create an xserver interface for writing .xsession-errors +userdom_dontaudit_write_user_home_content_files(gnome_settings_t) + +# search in .cache +userdom_search_user_home_dirs(gnome_settings_t) +userdom_search_user_home_content(gnome_settings_t) + +optional_policy(` + dbus_read_lib_files(gnome_settings_t) +') + +optional_policy(` + xserver_use_xdm_fds(gnome_settings_t) +') + +############################## +# +# Gnome-settings-daemon local policy +# + +allow gnome_settings_daemon_t self:dir list_dir_perms; +allow gnome_settings_daemon_t self:file rw_file_perms; +allow gnome_settings_daemon_t self:lnk_file read_lnk_file_perms; + +allow gnome_settings_daemon_t self:process { fork sigchld signal }; +allow gnome_settings_daemon_t self:unix_stream_socket create_stream_socket_perms; +allow gnome_settings_daemon_t self:netlink_kobject_uevent_socket create_socket_perms; + +allow gnome_settings_daemon_t dconf_home_t:dir manage_dir_perms; +allow gnome_settings_daemon_t dconf_home_t:file manage_file_perms; +allow gnome_settings_daemon_t dconf_home_t:lnk_file manage_lnk_file_perms; + +allow gnome_settings_daemon_t gnome_settings_schemas_t:dir list_dir_perms; +allow gnome_settings_daemon_t gnome_settings_schemas_t:file read_file_perms; +allow gnome_settings_daemon_t gnome_settings_schemas_t:lnk_file read_lnk_file_perms; + +allow gnome_settings_daemon_t gnome_settings_daemon_exec_t:file { entrypoint exec_file_perms }; + +rw_fifo_files_pattern(gnome_settings_daemon_t, gnome_settings_daemon_t, gnome_settings_daemon_t) + +read_files_pattern(gnome_settings_daemon_t, mime_info_t, mime_info_t) + +cups_read_config(gnome_settings_daemon_t) +cups_stream_connect(gnome_settings_daemon_t) + +dev_dontaudit_search_sysfs(gnome_settings_daemon_t) +dev_read_urand(gnome_settings_daemon_t) +dev_read_sysfs(gnome_settings_daemon_t) +dev_rw_null(gnome_settings_daemon_t) + +files_list_root(gnome_settings_daemon_t) +files_list_tmp(gnome_settings_daemon_t) +files_read_etc_files(gnome_settings_daemon_t) +files_read_usr_files(gnome_settings_daemon_t) +files_search_tmp(gnome_settings_daemon_t) + +fs_getattr_tmpfs(gnome_settings_daemon_t) +fs_getattr_xattr_fs(gnome_settings_daemon_t) +fs_list_tmpfs(gnome_settings_daemon_t) +fs_rw_tmpfs_files(gnome_settings_daemon_t) + +init_sigchld(gnome_settings_daemon_t) + +kernel_read_system_state(gnome_settings_daemon_t) + +libs_use_ld_so(gnome_settings_daemon_t) +libs_use_shared_libs(gnome_settings_daemon_t) + +logging_search_logs(gnome_settings_daemon_t) + +miscfiles_read_fonts(gnome_settings_daemon_t) +miscfiles_read_generic_certs(gnome_settings_daemon_t) +miscfiles_read_localization(gnome_settings_daemon_t) + +selinux_getattr_fs(gnome_settings_daemon_t) +selinux_dontaudit_search_fs(gnome_settings_daemon_t) + +### should create an xserver interface for writing .xsession-errors +userdom_dontaudit_write_user_home_content_files(gnome_settings_daemon_t) + +userdom_list_user_home_dirs(gnome_settings_daemon_t) +userdom_list_user_tmp(gnome_settings_daemon_t) +userdom_search_user_home_dirs(gnome_settings_daemon_t) +userdom_search_user_home_content(gnome_settings_daemon_t) + +optional_policy(` + colord_dbus_chat(gnome_settings_daemon_t) + colord_manage_home_files(gnome_settings_daemon_t) +') + +optional_policy(` + dbus_system_bus_client(gnome_settings_daemon_t) +') + +optional_policy(` + devicekit_dbus_chat_power(gnome_settings_daemon_t) +') + +optional_policy(` + policykit_dbus_chat(gnome_settings_daemon_t) + policykit_domtrans(gnome_settings_daemon_t) +') + +optional_policy(` + pulseaudio_read_home(gnome_settings_daemon_t) + pulseaudio_rw_tmpfs_files(gnome_settings_daemon_t) + pulseaudio_signull(gnome_settings_daemon_t) + pulseaudio_stream_connect(gnome_settings_daemon_t) + pulseaudio_use_fds(gnome_settings_daemon_t) +') + +optional_policy(` + xserver_read_user_xauth(gnome_settings_daemon_t) + xserver_stream_connect(gnome_settings_daemon_t) +') + +############################## # # Keyring-daemon local policy #--- refpolicy-git-06082016-orig/policy/modules/contrib/policykit.fc 2016-08-06 21:27:11.407094942 +0200 +++ refpolicy-git-06082016/policy/modules/contrib/policykit.fc 2016-08-20 01:03:29.139150710 +0200 @@ -1,3 +1,5 @@ +/usr/bin/pkexec -- gen_context(system_u:object_r:policykit_exec_t,s0) + /usr/lib/polkit-1/polkitd -- gen_context(system_u:object_r:policykit_exec_t,s0) /usr/lib/polkit-1/polkit-agent-helper-1 -- gen_context(system_u:object_r:policykit_auth_exec_t,s0) --- refpolicy-git-06082016-orig/policy/modules/contrib/policykit.if 2016-08-06 21:27:11.407094942 +0200 +++ refpolicy-git-06082016/policy/modules/contrib/policykit.if 2016-08-20 01:22:02.076149949 +0200 @@ -44,6 +44,26 @@ interface(`policykit_dbus_chat_auth',` ######################################## ## <summary> +## Execute a domain transition to +## run polkit. +## </summary> +## <param name="domain"> +## <summary> +## Domain allowed to transition. +## </summary> +## </param> +# +interface(`policykit_domtrans',` + gen_require(` + type policykit_t, policykit_exec_t; + ') + + corecmd_search_bin($1) + domtrans_pattern($1, policykit_exec_t, policykit_t) +') + +######################################## +## <summary> ## Execute a domain transition to run polkit_auth. ## </summary> ## <param name="domain"> --- refpolicy-git-06082016-orig/policy/modules/contrib/policykit.te 2016-08-06 21:27:11.408094953 +0200 +++ refpolicy-git-06082016/policy/modules/contrib/policykit.te 2016-08-19 22:14:15.581772016 +0200 @@ -117,6 +118,7 @@ optional_policy(` optional_policy(` gnome_read_generic_home_content(policykit_t) + gnome_read_settings_daemon_files(policykit_t) ') optional_policy(` --- refpolicy-git-06082016-orig/policy/modules/contrib/pulseaudio.if 2016-08-20 03:45:26.654959226 +0200 +++ refpolicy-git-06082016/policy/modules/contrib/pulseaudio.if 2016-08-20 00:25:39.112517500 +0200 @@ -347,3 +347,80 @@ interface(`pulseaudio_tmpfs_content',` typeattribute $1 pulseaudio_tmpfsfile; ') + +####################################### +## <summary> +## Read pulseaudio tmpfs files. +## </summary> +## <param name="domain"> +## <summary> +## Domain allowed access. +## </summary> +## </param> +# +interface(`pulseaudio_read_tmpfs_files',` + gen_require(` + type pulseaudio_tmpfs_t; + ') + + fs_search_tmpfs($1) + read_files_pattern($1, pulseaudio_tmpfs_t, pulseaudio_tmpfs_t) +') + +####################################### +## <summary> +## Read and write pulseaudio tmpfs +## files. +## </summary> +## <param name="domain"> +## <summary> +## Domain allowed access. +## </summary> +## </param> +# +interface(`pulseaudio_rw_tmpfs_files',` + gen_require(` + type pulseaudio_tmpfs_t; + ') + + fs_search_tmpfs($1) + rw_files_pattern($1, pulseaudio_tmpfs_t, pulseaudio_tmpfs_t) +') + +######################################## +## <summary> +## Use file descriptors for +## pulseaudio. +## </summary> +## <param name="domain"> +## <summary> +## Domain allowed access. +## </summary> +## </param> +# +interface(`pulseaudio_use_fds',` + gen_require(` + type pulseaudio_t; + ') + + allow $1 pulseaudio_t:fd use; +') + +######################################## +## <summary> +## Do not audit attempts to use the +## file descriptors for pulseaudio. +## </summary> +## <param name="domain"> +## <summary> +## Domain allowed access. +## </summary> +## </param> +# +interface(`pulseaudio_dontaudit_use_fds',` + gen_require(` + type pulseaudio_t; + ') + + dontaudit $1 pulseaudio_t:fd use; +') --- refpolicy-git-14082016/policy/modules/contrib/pulseaudio.te 2016-08-20 06:08:33.005716322 +0200 +++ refpolicy-git-06082016/policy/modules/contrib/pulseaudio.te 2016-08-18 18:23:19.470718028 +0200 @@ -193,6 +193,11 @@ optional_policy(` optional_policy(` gnome_stream_connect_gconf(pulseaudio_t) + + # OIL Runtime Compiler (ORC) optimized code execution + allow pulseaudio_t gstreamer_orcexec_t:file { manage_file_perms mmap_file_perms }; + gnome_user_runtime_filetrans_gstreamer_orcexec(pulseaudio_t, file) + gnome_user_home_dir_filetrans_gstreamer_orcexec(pulseaudio_t, file) ') optional_policy(`--- refpolicy-git-06082016-orig/policy/modules/system/userdomain.if 2016-08-20 04:02:51.687901531 +0200 +++ refpolicy-git-06082016/policy/modules/system/userdomain.if 2016-08-19 23:44:30.690540547 +0200 @@ -593,6 +593,10 @@ template(`userdom_common_user_template', ') optional_policy(` + colord_manage_home_files($1_t) + ') + + optional_policy(` dbus_system_bus_client($1_t) optional_policy(` ^ permalink raw reply [flat|nested] 73+ messages in thread
* [refpolicy] [PATCH v4] Update for the gnome policy and file contexts 2016-08-22 19:39 ` [refpolicy] [PATCH v4] " Guido Trentalancia @ 2016-08-23 1:15 ` Chris PeBenito 2016-08-23 12:44 ` Guido Trentalancia 2016-08-23 16:06 ` Guido Trentalancia 2016-09-01 4:20 ` Jason Zaman 1 sibling, 2 replies; 73+ messages in thread From: Chris PeBenito @ 2016-08-23 1:15 UTC (permalink / raw) To: refpolicy On 08/22/16 15:39, Guido Trentalancia wrote: > Update for the gnome module: > > - target the dconf daemon, the gsettings user application, the > gnome-settings-daemon and the at-spi daemon with all the > needed domain transitions; > - a new gstreamer_orcexec_t type and file context is introduced > to support the OIL Runtime Compiler (ORC) optimized code > execution (used for example by pulseaudio); > - add support for more permissions needed in gconfd_t and gnome > keyring domains; > - add support for chat over dbus in the gconfd domain and in the > new domains (dconf, gsettings, etc); > - add support for a few needed fs and kernel permissions. > - add support for reading the colord related files in the home > directories (such as the ICC EDID profiles): requires the > recent colord patch; > - add support for for reading the colord related files in the home > directories in the common user domain template; > - add support for a new mime_info_t type to be used in the home > directories; > - includes minor modifications to the consolekit, dbus and > policykit modules to support the new targeted gnome daemons > and applications; > - modifies the pulseaudio module to introduce new interfaces to > read and write pulseaudio tmpfs files and to use the pulseaudio > file descriptor; > - provides better module encapsulation (i.e. dbus module). > > The support for Gnome2/ORBit-2 (version 2) has been dropped. > > This patch depends on the recent colord patch. > > Recent changes to the pulseaudio module depends on this patch ! Unfortunately, as Dominick pointed out, you've gone to the other end of the patch organization spectrum and made too large of a patch. If you split it up into individual commits, git format-patch and git send-email will make it easy to send a series of patches in commit order. So all you have to do is create reasonably-sized and logically-organized commits. I did not review everything, but here are a few things I noticed: > +######################################## > +## <summary> > +## Make a domain transition from a > +## given source domain to another > +## specified target domain using > +## the DBUS executable file type. > +## </summary> > +## <param name="domain"> > +## <summary> > +## Source domain. > +## </summary> > +## </param> > +# > +interface(`dbus_domain_transition',` I'm not clear why this is necessary. > + gen_require(` > + type dbusd_exec_t; > + ') > + > + allow $1 dbusd_exec_t:file { entrypoint exec_file_perms }; Entrypoint should not be included here. > + domtrans_pattern($1, dbusd_exec_t, $2) > --- refpolicy-git-06082016-orig/policy/modules/contrib/gnome.if 2016-08-06 21:27:11.354094337 +0200 > +++ refpolicy-git-06082016/policy/modules/contrib/gnome.if 2016-08-22 21:24:49.634876147 +0200 > @@ -43,14 +43,39 @@ interface(`gnome_role',` > template(`gnome_role_template',` > gen_require(` > attribute gnomedomain, gkeyringd_domain; > + attribute_role dconf_roles; > + attribute_role at_spi_roles; > attribute_role gconfd_roles; > - type gkeyringd_exec_t, gnome_keyring_home_t, gnome_keyring_tmp_t; > + attribute_role gnome_settings_roles; > + attribute_role gnome_settings_daemon_roles; Are all of these role attributes really necessary? Typically these are only needed when there are long chains of transitions where the original domain doesn't have any relation to latter domains. For example: user_t -> domain1_t -> domain2_t In this case, there is no link in the sources between user_t and domain2_t, but domain2_t needs to be allowed user_r. Domain1_t's interfaces can collect up all the roles that run domain1 in a role attribute, and then use that attribute when running domain2. > + type dconf_t, dconf_exec_t, dconf_home_t; > + type at_spi_t, at_spi_exec_t; > type gconfd_t, gconfd_exec_t, gconf_tmp_t; > type gconf_home_t; > + type gnome_settings_t, gnome_settings_exec_t; > + type gnome_settings_daemon_t, gnome_settings_daemon_exec_t; > + type gnome_settings_schemas_t; > + type gkeyringd_exec_t, gnome_keyring_home_t, gnome_keyring_cache_home_t, gnome_keyring_tmp_t; > + type mime_info_t; > + type user_dbusd_t; This dbus type cannot be referenced directly in this module. > optional_policy(` > + dbus_connect_spec_session_bus(user, dconf_t) > + dbus_connect_spec_session_bus(user, at_spi_t) > + dbus_connect_spec_session_bus(user, gnome_settings_daemon_t) Prefixes can't be hardcoded like this. > + dbus_connect_system_bus(gnome_settings_daemon_t) > + dbus_domain_transition(at_spi_t, user_dbusd_t) > + dbus_domain_transition(gnome_settings_t, user_dbusd_t) > + dbus_send_spec_session_bus(user, dconf_t) > + dbus_send_spec_session_bus(user, at_spi_t) > + dbus_send_spec_session_bus(user, gnome_settings_daemon_t) > dbus_spec_session_domain($1, $1_gkeyringd_t, gkeyringd_exec_t) -- Chris PeBenito ^ permalink raw reply [flat|nested] 73+ messages in thread
* [refpolicy] [PATCH v4] Update for the gnome policy and file contexts 2016-08-23 1:15 ` Chris PeBenito @ 2016-08-23 12:44 ` Guido Trentalancia 2016-08-23 13:58 ` Guido Trentalancia 2016-08-23 23:02 ` Chris PeBenito 2016-08-23 16:06 ` Guido Trentalancia 1 sibling, 2 replies; 73+ messages in thread From: Guido Trentalancia @ 2016-08-23 12:44 UTC (permalink / raw) To: refpolicy Hello Christopher ! Thanks for providing your valuable feedback. On Mon, 22/08/2016 at 21.15 -0400, Chris PeBenito wrote: > On 08/22/16 15:39, Guido Trentalancia wrote: > > > > Update for the gnome module: > > > > - target the dconf daemon, the gsettings user application, the > > ? gnome-settings-daemon and the at-spi daemon with all the > > ? needed domain transitions; > > - a new gstreamer_orcexec_t type and file context is introduced > > ? to support the OIL Runtime Compiler (ORC) optimized code > > ? execution (used for example by pulseaudio); > > - add support for more permissions needed in gconfd_t and gnome > > ? keyring domains; > > - add support for chat over dbus in the gconfd domain and in the > > ? new domains (dconf, gsettings, etc); > > - add support for a few needed fs and kernel permissions. > > - add support for reading the colord related files in the home > > ? directories (such as the ICC EDID profiles): requires the > > ? recent colord patch; > > - add support for for reading the colord related files in the home > > ? directories in the common user domain template; > > - add support for a new mime_info_t type to be used in the home > > ? directories; > > - includes minor modifications to the consolekit, dbus and > > ? policykit modules to support the new targeted gnome daemons > > ? and applications; > > - modifies the pulseaudio module to introduce new interfaces to > > ? read and write pulseaudio tmpfs files and to use the pulseaudio > > ? file descriptor; > > - provides better module encapsulation (i.e. dbus module). > > > > The support for Gnome2/ORBit-2 (version 2) has been dropped. > > > > This patch depends on the recent colord patch. > > > > Recent changes to the pulseaudio module depends on this patch ! > > Unfortunately, as Dominick pointed out, you've gone to the other end > of? > the patch organization spectrum and made too large of a patch.??If > you? > split it up into individual commits, git format-patch and git send- > email? > will make it easy to send a series of patches in commit order.??So > all? > you have to do is create reasonably-sized and logically-organized > commits. > > > I did not review everything, but here are a few things I noticed: > > > > > +######################################## > > +## <summary> > > +## Make a domain transition from a > > +## given source domain to another > > +## specified target domain using > > +## the DBUS executable file type. > > +## </summary> > > +## <param name="domain"> > > +## <summary> > > +## Source domain. > > +## </summary> > > +## </param> > > +# > > +interface(`dbus_domain_transition',` > > I'm not clear why this is necessary. To encapsulate dbus related types in their own module (i.e. the dbus module). > > + gen_require(` > > + type dbusd_exec_t; > > + ') > > + > > + allow $1 dbusd_exec_t:file { entrypoint exec_file_perms }; > > Entrypoint should not be included here. I will check if this does not break the transition... > > + domtrans_pattern($1, dbusd_exec_t, $2) > > > > > --- refpolicy-git-06082016-orig/policy/modules/contrib/gnome.if > > 2016-08-06 21:27:11.354094337 +0200 > > +++ refpolicy-git-06082016/policy/modules/contrib/gnome.if 2 > > 016-08-22 21:24:49.634876147 +0200 > > @@ -43,14 +43,39 @@ interface(`gnome_role',` > > ?template(`gnome_role_template',` > > ? gen_require(` > > ? attribute gnomedomain, gkeyringd_domain; > > + attribute_role dconf_roles; > > + attribute_role at_spi_roles; > > ? attribute_role gconfd_roles; > > - type gkeyringd_exec_t, gnome_keyring_home_t, > > gnome_keyring_tmp_t; > > + attribute_role gnome_settings_roles; > > + attribute_role gnome_settings_daemon_roles; > > Are all of these role attributes really necessary???Typically these > are? > only needed when there are long chains of transitions where the > original? > domain doesn't have any relation to latter domains.??For example: > > user_t ->??domain1_t -> domain2_t > > In this case, there is no link in the sources between user_t and? > domain2_t, but domain2_t needs to be allowed user_r.??Domain1_t's? > interfaces can collect up all the roles that run domain1 in a role? > attribute, and then use that attribute when running domain2. I will remove the roles which are not needed. > > > > + type dconf_t, dconf_exec_t, dconf_home_t; > > + type at_spi_t, at_spi_exec_t; > > ? type gconfd_t, gconfd_exec_t, gconf_tmp_t; > > ? type gconf_home_t; > > + type gnome_settings_t, gnome_settings_exec_t; > > + type gnome_settings_daemon_t, > > gnome_settings_daemon_exec_t; > > + type gnome_settings_schemas_t; > > + type gkeyringd_exec_t, gnome_keyring_home_t, > > gnome_keyring_cache_home_t, gnome_keyring_tmp_t; > > + type mime_info_t; > > + type user_dbusd_t; > > This dbus type cannot be referenced directly in this module. If $1_dbusd_t is used to get the role/type prefix from the caller, then it doesn't compile for some reason which is not yet clear to me. Any idea ? > > > > ? optional_policy(` > > + dbus_connect_spec_session_bus(user, dconf_t) > > + dbus_connect_spec_session_bus(user, at_spi_t) > > + dbus_connect_spec_session_bus(user, > > gnome_settings_daemon_t) > > Prefixes can't be hardcoded like this. See above. > > > > + dbus_connect_system_bus(gnome_settings_daemon_t) > > + dbus_domain_transition(at_spi_t, user_dbusd_t) > > + dbus_domain_transition(gnome_settings_t, > > user_dbusd_t) > > + dbus_send_spec_session_bus(user, dconf_t) > > + dbus_send_spec_session_bus(user, at_spi_t) > > + dbus_send_spec_session_bus(user, > > gnome_settings_daemon_t) > > ? dbus_spec_session_domain($1, $1_gkeyringd_t, > > gkeyringd_exec_t) Best regards, Guido ^ permalink raw reply [flat|nested] 73+ messages in thread
* [refpolicy] [PATCH v4] Update for the gnome policy and file contexts 2016-08-23 12:44 ` Guido Trentalancia @ 2016-08-23 13:58 ` Guido Trentalancia 2016-08-23 23:02 ` Chris PeBenito 1 sibling, 0 replies; 73+ messages in thread From: Guido Trentalancia @ 2016-08-23 13:58 UTC (permalink / raw) To: refpolicy On Tue, 23/08/2016 at 14.44 +0200, Guido Trentalancia wrote: > Hello Christopher ! > > Thanks for providing your valuable feedback. > > On Mon, 22/08/2016 at 21.15 -0400, Chris PeBenito wrote: > > > > On 08/22/16 15:39, Guido Trentalancia wrote: > > > > > > > > > Update for the gnome module: > > > > > > - target the dconf daemon, the gsettings user application, the > > > ? gnome-settings-daemon and the at-spi daemon with all the > > > ? needed domain transitions; > > > - a new gstreamer_orcexec_t type and file context is introduced > > > ? to support the OIL Runtime Compiler (ORC) optimized code > > > ? execution (used for example by pulseaudio); > > > - add support for more permissions needed in gconfd_t and gnome > > > ? keyring domains; > > > - add support for chat over dbus in the gconfd domain and in the > > > ? new domains (dconf, gsettings, etc); > > > - add support for a few needed fs and kernel permissions. > > > - add support for reading the colord related files in the home > > > ? directories (such as the ICC EDID profiles): requires the > > > ? recent colord patch; > > > - add support for for reading the colord related files in the > > > home > > > ? directories in the common user domain template; > > > - add support for a new mime_info_t type to be used in the home > > > ? directories; > > > - includes minor modifications to the consolekit, dbus and > > > ? policykit modules to support the new targeted gnome daemons > > > ? and applications; > > > - modifies the pulseaudio module to introduce new interfaces to > > > ? read and write pulseaudio tmpfs files and to use the pulseaudio > > > ? file descriptor; > > > - provides better module encapsulation (i.e. dbus module). > > > > > > The support for Gnome2/ORBit-2 (version 2) has been dropped. > > > > > > This patch depends on the recent colord patch. > > > > > > Recent changes to the pulseaudio module depends on this patch ! [...] > > > --- refpolicy-git-06082016-orig/policy/modules/contrib/gnome.if > > > 2016-08-06 21:27:11.354094337 +0200 > > > +++ refpolicy-git-06082016/policy/modules/contrib/gnome.if > > > 2 > > > 016-08-22 21:24:49.634876147 +0200 > > > @@ -43,14 +43,39 @@ interface(`gnome_role',` > > > ?template(`gnome_role_template',` > > > ? gen_require(` > > > ? attribute gnomedomain, gkeyringd_domain; > > > + attribute_role dconf_roles; > > > + attribute_role at_spi_roles; > > > ? attribute_role gconfd_roles; > > > - type gkeyringd_exec_t, gnome_keyring_home_t, > > > gnome_keyring_tmp_t; > > > + attribute_role gnome_settings_roles; > > > + attribute_role gnome_settings_daemon_roles; > > > > Are all of these role attributes really necessary???Typically these > > are? > > only needed when there are long chains of transitions where the > > original? > > domain doesn't have any relation to latter domains.??For example: > > > > user_t ->??domain1_t -> domain2_t > > > > In this case, there is no link in the sources between user_t and? > > domain2_t, but domain2_t needs to be allowed user_r.??Domain1_t's? > > interfaces can collect up all the roles that run domain1 in a role? > > attribute, and then use that attribute when running domain2. > > I will remove the roles which are not needed. I have tested the above and the conclusion is that only the dconf attribute can be removed without breaking the functionality. Regards, Guido ^ permalink raw reply [flat|nested] 73+ messages in thread
* [refpolicy] [PATCH v4] Update for the gnome policy and file contexts 2016-08-23 12:44 ` Guido Trentalancia 2016-08-23 13:58 ` Guido Trentalancia @ 2016-08-23 23:02 ` Chris PeBenito 2016-08-23 23:31 ` Guido Trentalancia 2016-08-24 21:55 ` Guido Trentalancia 1 sibling, 2 replies; 73+ messages in thread From: Chris PeBenito @ 2016-08-23 23:02 UTC (permalink / raw) To: refpolicy On 08/23/16 08:44, Guido Trentalancia wrote: > Hello Christopher ! > > Thanks for providing your valuable feedback. > > On Mon, 22/08/2016 at 21.15 -0400, Chris PeBenito wrote: >> On 08/22/16 15:39, Guido Trentalancia wrote: >>> >>> + type dconf_t, dconf_exec_t, dconf_home_t; >>> + type at_spi_t, at_spi_exec_t; >>> type gconfd_t, gconfd_exec_t, gconf_tmp_t; >>> type gconf_home_t; >>> + type gnome_settings_t, gnome_settings_exec_t; >>> + type gnome_settings_daemon_t, >>> gnome_settings_daemon_exec_t; >>> + type gnome_settings_schemas_t; >>> + type gkeyringd_exec_t, gnome_keyring_home_t, >>> gnome_keyring_cache_home_t, gnome_keyring_tmp_t; >>> + type mime_info_t; >>> + type user_dbusd_t; >> >> This dbus type cannot be referenced directly in this module. > > If $1_dbusd_t is used to get the role/type prefix from the caller, then > it doesn't compile for some reason which is not yet clear to me. > > Any idea ? The $1_dbusd_t rules need to be contained in the dbus module, not the gnome module. Beyond that, it's tough to say what the problem is, without knowing the error messages. -- Chris PeBenito ^ permalink raw reply [flat|nested] 73+ messages in thread
* [refpolicy] [PATCH v4] Update for the gnome policy and file contexts 2016-08-23 23:02 ` Chris PeBenito @ 2016-08-23 23:31 ` Guido Trentalancia 2016-08-24 21:55 ` Guido Trentalancia 1 sibling, 0 replies; 73+ messages in thread From: Guido Trentalancia @ 2016-08-23 23:31 UTC (permalink / raw) To: refpolicy The error is: "Conflicting type rules". Unfortunately, the cil temporary file is destroyed before make gives the shell prompt back, so it is not possible to inspect the location of the problem. Guido On the 24th august 2016 01:02:29 CEST, Chris PeBenito <pebenito@ieee.org> wrote: >On 08/23/16 08:44, Guido Trentalancia wrote: >> Hello Christopher ! >> >> Thanks for providing your valuable feedback. >> >> On Mon, 22/08/2016 at 21.15 -0400, Chris PeBenito wrote: >>> On 08/22/16 15:39, Guido Trentalancia wrote: >>>> >>>> + type dconf_t, dconf_exec_t, dconf_home_t; >>>> + type at_spi_t, at_spi_exec_t; >>>> type gconfd_t, gconfd_exec_t, gconf_tmp_t; >>>> type gconf_home_t; >>>> + type gnome_settings_t, gnome_settings_exec_t; >>>> + type gnome_settings_daemon_t, >>>> gnome_settings_daemon_exec_t; >>>> + type gnome_settings_schemas_t; >>>> + type gkeyringd_exec_t, gnome_keyring_home_t, >>>> gnome_keyring_cache_home_t, gnome_keyring_tmp_t; >>>> + type mime_info_t; >>>> + type user_dbusd_t; >>> >>> This dbus type cannot be referenced directly in this module. >> >> If $1_dbusd_t is used to get the role/type prefix from the caller, >then >> it doesn't compile for some reason which is not yet clear to me. >> >> Any idea ? > >The $1_dbusd_t rules need to be contained in the dbus module, not the >gnome module. Beyond that, it's tough to say what the problem is, >without knowing the error messages. ^ permalink raw reply [flat|nested] 73+ messages in thread
* [refpolicy] [PATCH v4] Update for the gnome policy and file contexts 2016-08-23 23:02 ` Chris PeBenito 2016-08-23 23:31 ` Guido Trentalancia @ 2016-08-24 21:55 ` Guido Trentalancia 2016-08-24 22:10 ` Chris PeBenito 1 sibling, 1 reply; 73+ messages in thread From: Guido Trentalancia @ 2016-08-24 21:55 UTC (permalink / raw) To: refpolicy Hello Christopher. I have more detailed information about this problem... On Tue, 23/08/2016 at 19.02 -0400, Chris PeBenito wrote: > On 08/23/16 08:44, Guido Trentalancia wrote: > > > > Hello Christopher ! > > > > Thanks for providing your valuable feedback. > > > > On Mon, 22/08/2016 at 21.15 -0400, Chris PeBenito wrote: > > > > > > On 08/22/16 15:39, Guido Trentalancia wrote: > > > > > > > > > > > > + type dconf_t, dconf_exec_t, dconf_home_t; > > > > + type at_spi_t, at_spi_exec_t; > > > > ? type gconfd_t, gconfd_exec_t, gconf_tmp_t; > > > > ? type gconf_home_t; > > > > + type gnome_settings_t, gnome_settings_exec_t; > > > > + type gnome_settings_daemon_t, > > > > gnome_settings_daemon_exec_t; > > > > + type gnome_settings_schemas_t; > > > > + type gkeyringd_exec_t, gnome_keyring_home_t, > > > > gnome_keyring_cache_home_t, gnome_keyring_tmp_t; > > > > + type mime_info_t; > > > > + type user_dbusd_t; > > > > > > This dbus type cannot be referenced directly in this module. > > > > If $1_dbusd_t is used to get the role/type prefix from the caller, > > then > > it doesn't compile for some reason which is not yet clear to me. > > > > Any idea ? > > The $1_dbusd_t rules need to be contained in the dbus module, not > the? > gnome module.??Beyond that, it's tough to say what the problem is,? > without knowing the error messages. Suppose to have the following additional dbus interface: ####################################### ## <summary> ## Make a domain transition from a ## given source domain to the ## DBUS session bus domain using ## the DBUS executable file type. ## </summary> ## <param name="role_prefix"> ## <summary> ## The prefix of the user role (e.g., user ## is the prefix for user_r). ## </summary> ## </param> ## <param name="domain"> ## <summary> ## Domain allowed access. ## </summary> ## </param> # interface(`dbus_domain_transition_session_bus',` gen_require(` type dbusd_exec_t; type $1_dbusd_t; ') allow $2 dbusd_exec_t:file exec_file_perms; domtrans_pattern($2, dbusd_exec_t, $1_dbusd_t) ') and suppose that it is called by the following statement: dbus_domain_transition_session_bus($1, at_spi_t) where $1 = "user". During policy load, the following error is generated: Conflicting type rules Binary policy creation failed at line 29393 of /var/lib/selinux/refpolicy-06082016/tmp/modules/400/sysadm/cil Failed to generate binary /usr/sbin/semodule: Failed! make: *** [Rules.modular:58: load] Error 1 The temporary file is deleted automatically and cannot be inspected. I hope it is clear now... Do you have an idea ? It's the only thing missing before all the dbus rules are moved from the gnome to the dbus module and I can create a new version of this important patch. Regards, Guido ^ permalink raw reply [flat|nested] 73+ messages in thread
* [refpolicy] [PATCH v4] Update for the gnome policy and file contexts 2016-08-24 21:55 ` Guido Trentalancia @ 2016-08-24 22:10 ` Chris PeBenito 2016-08-24 22:42 ` Guido Trentalancia ` (2 more replies) 0 siblings, 3 replies; 73+ messages in thread From: Chris PeBenito @ 2016-08-24 22:10 UTC (permalink / raw) To: refpolicy On 08/24/16 17:55, Guido Trentalancia wrote: > Hello Christopher. > > I have more detailed information about this problem... > > On Tue, 23/08/2016 at 19.02 -0400, Chris PeBenito wrote: >> On 08/23/16 08:44, Guido Trentalancia wrote: >>> >>> Hello Christopher ! >>> >>> Thanks for providing your valuable feedback. >>> >>> On Mon, 22/08/2016 at 21.15 -0400, Chris PeBenito wrote: >>>> >>>> On 08/22/16 15:39, Guido Trentalancia wrote: >>>>> >>>>> >>>>> + type dconf_t, dconf_exec_t, dconf_home_t; >>>>> + type at_spi_t, at_spi_exec_t; >>>>> type gconfd_t, gconfd_exec_t, gconf_tmp_t; >>>>> type gconf_home_t; >>>>> + type gnome_settings_t, gnome_settings_exec_t; >>>>> + type gnome_settings_daemon_t, >>>>> gnome_settings_daemon_exec_t; >>>>> + type gnome_settings_schemas_t; >>>>> + type gkeyringd_exec_t, gnome_keyring_home_t, >>>>> gnome_keyring_cache_home_t, gnome_keyring_tmp_t; >>>>> + type mime_info_t; >>>>> + type user_dbusd_t; >>>> >>>> This dbus type cannot be referenced directly in this module. >>> >>> If $1_dbusd_t is used to get the role/type prefix from the caller, >>> then >>> it doesn't compile for some reason which is not yet clear to me. >>> >>> Any idea ? >> >> The $1_dbusd_t rules need to be contained in the dbus module, not >> the >> gnome module. Beyond that, it's tough to say what the problem is, >> without knowing the error messages. > > Suppose to have the following additional dbus interface: > > ####################################### > ## <summary> > ## Make a domain transition from a > ## given source domain to the > ## DBUS session bus domain using > ## the DBUS executable file type. > ## </summary> > ## <param name="role_prefix"> > ## <summary> > ## The prefix of the user role (e.g., user > ## is the prefix for user_r). > ## </summary> > ## </param> > ## <param name="domain"> > ## <summary> > ## Domain allowed access. > ## </summary> > ## </param> > # > interface(`dbus_domain_transition_session_bus',` > gen_require(` > type dbusd_exec_t; > type $1_dbusd_t; > ') > > allow $2 dbusd_exec_t:file exec_file_perms; > domtrans_pattern($2, dbusd_exec_t, $1_dbusd_t) > ') > > and suppose that it is called by the following statement: > > dbus_domain_transition_session_bus($1, at_spi_t) > > where $1 = "user". > > During policy load, the following error is generated: > > Conflicting type rules > Binary policy creation failed at line 29393 of /var/lib/selinux/refpolicy-06082016/tmp/modules/400/sysadm/cil > Failed to generate binary > /usr/sbin/semodule: Failed! > make: *** [Rules.modular:58: load] Error 1 > > The temporary file is deleted automatically and cannot be inspected. > > I hope it is clear now... > > Do you have an idea ? It's the only thing missing before all the dbus > rules are moved from the gnome to the dbus module and I can create a > new version of this important patch. It's not so helpful unfortunately. My guess is that it is a conflicting type_transition. Unfortunately the compiler error message isn't helpful. -- Chris PeBenito ^ permalink raw reply [flat|nested] 73+ messages in thread
* [refpolicy] [PATCH v4] Update for the gnome policy and file contexts 2016-08-24 22:10 ` Chris PeBenito @ 2016-08-24 22:42 ` Guido Trentalancia 2016-08-25 7:25 ` Dominick Grift 2016-08-25 9:47 ` Guido Trentalancia 2016-08-27 17:08 ` Guido Trentalancia 2 siblings, 1 reply; 73+ messages in thread From: Guido Trentalancia @ 2016-08-24 22:42 UTC (permalink / raw) To: refpolicy It works fine in the latest version of this patch (from within the gnome module)!! So, why does it stop working when I create a dbus interface and call it from the gnome module? I am stuck with this unfortunately... How about the other missing patch for the "module_load" permission in the kernel and files modules? Have you found an alternative name for that interface? The patch for the kernel is waiting to get committed, along with the testcase and a small Makefile patch for the testsuite. I have also posted here a patch for the Reference Policy Makefile so that it integrates better with the SELinux testsuite (which at the moment works out of the box only on Red Hat). Best regards, Guido On the 25th August 2016 00:10:22 CEST, Chris PeBenito <pebenito@ieee.org> wrote: >On 08/24/16 17:55, Guido Trentalancia wrote: >> Hello Christopher. >> >> I have more detailed information about this problem... >> >> On Tue, 23/08/2016 at 19.02 -0400, Chris PeBenito wrote: >>> On 08/23/16 08:44, Guido Trentalancia wrote: >>>> >>>> Hello Christopher ! >>>> >>>> Thanks for providing your valuable feedback. >>>> >>>> On Mon, 22/08/2016 at 21.15 -0400, Chris PeBenito wrote: >>>>> >>>>> On 08/22/16 15:39, Guido Trentalancia wrote: >>>>>> >>>>>> >>>>>> + type dconf_t, dconf_exec_t, dconf_home_t; >>>>>> + type at_spi_t, at_spi_exec_t; >>>>>> type gconfd_t, gconfd_exec_t, gconf_tmp_t; >>>>>> type gconf_home_t; >>>>>> + type gnome_settings_t, gnome_settings_exec_t; >>>>>> + type gnome_settings_daemon_t, >>>>>> gnome_settings_daemon_exec_t; >>>>>> + type gnome_settings_schemas_t; >>>>>> + type gkeyringd_exec_t, gnome_keyring_home_t, >>>>>> gnome_keyring_cache_home_t, gnome_keyring_tmp_t; >>>>>> + type mime_info_t; >>>>>> + type user_dbusd_t; >>>>> >>>>> This dbus type cannot be referenced directly in this module. >>>> >>>> If $1_dbusd_t is used to get the role/type prefix from the caller, >>>> then >>>> it doesn't compile for some reason which is not yet clear to me. >>>> >>>> Any idea ? >>> >>> The $1_dbusd_t rules need to be contained in the dbus module, not >>> the >>> gnome module. Beyond that, it's tough to say what the problem is, >>> without knowing the error messages. >> >> Suppose to have the following additional dbus interface: >> >> ####################################### >> ## <summary> >> ## Make a domain transition from a >> ## given source domain to the >> ## DBUS session bus domain using >> ## the DBUS executable file type. >> ## </summary> >> ## <param name="role_prefix"> >> ## <summary> >> ## The prefix of the user role (e.g., user >> ## is the prefix for user_r). >> ## </summary> >> ## </param> >> ## <param name="domain"> >> ## <summary> >> ## Domain allowed access. >> ## </summary> >> ## </param> >> # >> interface(`dbus_domain_transition_session_bus',` >> gen_require(` >> type dbusd_exec_t; >> type $1_dbusd_t; >> ') >> >> allow $2 dbusd_exec_t:file exec_file_perms; >> domtrans_pattern($2, dbusd_exec_t, $1_dbusd_t) >> ') >> >> and suppose that it is called by the following statement: >> >> dbus_domain_transition_session_bus($1, at_spi_t) >> >> where $1 = "user". >> >> During policy load, the following error is generated: >> >> Conflicting type rules >> Binary policy creation failed at line 29393 of >/var/lib/selinux/refpolicy-06082016/tmp/modules/400/sysadm/cil >> Failed to generate binary >> /usr/sbin/semodule: Failed! >> make: *** [Rules.modular:58: load] Error 1 >> >> The temporary file is deleted automatically and cannot be inspected. >> >> I hope it is clear now... >> >> Do you have an idea ? It's the only thing missing before all the dbus >> rules are moved from the gnome to the dbus module and I can create a >> new version of this important patch. > >It's not so helpful unfortunately. My guess is that it is a >conflicting >type_transition. Unfortunately the compiler error message isn't >helpful. ^ permalink raw reply [flat|nested] 73+ messages in thread
* [refpolicy] [PATCH v4] Update for the gnome policy and file contexts 2016-08-24 22:42 ` Guido Trentalancia @ 2016-08-25 7:25 ` Dominick Grift 0 siblings, 0 replies; 73+ messages in thread From: Dominick Grift @ 2016-08-25 7:25 UTC (permalink / raw) To: refpolicy On 08/25/2016 12:42 AM, Guido Trentalancia via refpolicy wrote: > It works fine in the latest version of this patch (from within the gnome module)!! > > So, why does it stop working when I create a dbus interface and call it from the gnome module? > > I am stuck with this unfortunately... > I have been there before. I have attempted to confined desktops for years. Facing all kinds of limitations of the reference policy. I am not saying that the issue you are facing is related to limitations to the refpolicy, because I do not know for sure. What I do feel i know is that confining complex desktops with reference policy is difficult if not impossible. The CIL policy was designed to deal with complex requirements. My DSSP policy demonstrates that with CIL , complex desktops can be confined. Besides the techinical issues there is also the issue of design with confining complex desktops. There are many patterns that become visible later in the process. Causing one to have to refactor the policy. I already see things in your patch where I personally would have done things differently taking into account the bigger picture. Basically a good approach would be to first confine the desktop fully. then look at that from a distance, and then write it again with in mind all the things you've learned. > How about the other missing patch for the "module_load" permission in the kernel and files modules? Have you found an alternative name for that interface? > > The patch for the kernel is waiting to get committed, along with the testcase and a small Makefile patch for the testsuite. > > I have also posted here a patch for the Reference Policy Makefile so that it integrates better with the SELinux testsuite (which at the moment works out of the box only on Red Hat). > > Best regards, > > Guido > > On the 25th August 2016 00:10:22 CEST, Chris PeBenito <pebenito@ieee.org> wrote: >> On 08/24/16 17:55, Guido Trentalancia wrote: >>> Hello Christopher. >>> >>> I have more detailed information about this problem... >>> >>> On Tue, 23/08/2016 at 19.02 -0400, Chris PeBenito wrote: >>>> On 08/23/16 08:44, Guido Trentalancia wrote: >>>>> >>>>> Hello Christopher ! >>>>> >>>>> Thanks for providing your valuable feedback. >>>>> >>>>> On Mon, 22/08/2016 at 21.15 -0400, Chris PeBenito wrote: >>>>>> >>>>>> On 08/22/16 15:39, Guido Trentalancia wrote: >>>>>>> >>>>>>> >>>>>>> + type dconf_t, dconf_exec_t, dconf_home_t; >>>>>>> + type at_spi_t, at_spi_exec_t; >>>>>>> type gconfd_t, gconfd_exec_t, gconf_tmp_t; >>>>>>> type gconf_home_t; >>>>>>> + type gnome_settings_t, gnome_settings_exec_t; >>>>>>> + type gnome_settings_daemon_t, >>>>>>> gnome_settings_daemon_exec_t; >>>>>>> + type gnome_settings_schemas_t; >>>>>>> + type gkeyringd_exec_t, gnome_keyring_home_t, >>>>>>> gnome_keyring_cache_home_t, gnome_keyring_tmp_t; >>>>>>> + type mime_info_t; >>>>>>> + type user_dbusd_t; >>>>>> >>>>>> This dbus type cannot be referenced directly in this module. >>>>> >>>>> If $1_dbusd_t is used to get the role/type prefix from the caller, >>>>> then >>>>> it doesn't compile for some reason which is not yet clear to me. >>>>> >>>>> Any idea ? >>>> >>>> The $1_dbusd_t rules need to be contained in the dbus module, not >>>> the >>>> gnome module. Beyond that, it's tough to say what the problem is, >>>> without knowing the error messages. >>> >>> Suppose to have the following additional dbus interface: >>> >>> ####################################### >>> ## <summary> >>> ## Make a domain transition from a >>> ## given source domain to the >>> ## DBUS session bus domain using >>> ## the DBUS executable file type. >>> ## </summary> >>> ## <param name="role_prefix"> >>> ## <summary> >>> ## The prefix of the user role (e.g., user >>> ## is the prefix for user_r). >>> ## </summary> >>> ## </param> >>> ## <param name="domain"> >>> ## <summary> >>> ## Domain allowed access. >>> ## </summary> >>> ## </param> >>> # >>> interface(`dbus_domain_transition_session_bus',` >>> gen_require(` >>> type dbusd_exec_t; >>> type $1_dbusd_t; >>> ') >>> >>> allow $2 dbusd_exec_t:file exec_file_perms; >>> domtrans_pattern($2, dbusd_exec_t, $1_dbusd_t) >>> ') >>> >>> and suppose that it is called by the following statement: >>> >>> dbus_domain_transition_session_bus($1, at_spi_t) >>> >>> where $1 = "user". >>> >>> During policy load, the following error is generated: >>> >>> Conflicting type rules >>> Binary policy creation failed at line 29393 of >> /var/lib/selinux/refpolicy-06082016/tmp/modules/400/sysadm/cil >>> Failed to generate binary >>> /usr/sbin/semodule: Failed! >>> make: *** [Rules.modular:58: load] Error 1 >>> >>> The temporary file is deleted automatically and cannot be inspected. >>> >>> I hope it is clear now... >>> >>> Do you have an idea ? It's the only thing missing before all the dbus >>> rules are moved from the gnome to the dbus module and I can create a >>> new version of this important patch. >> >> It's not so helpful unfortunately. My guess is that it is a >> conflicting >> type_transition. Unfortunately the compiler error message isn't >> helpful. > > _______________________________________________ > refpolicy mailing list > refpolicy at oss.tresys.com > http://oss.tresys.com/mailman/listinfo/refpolicy > -- Key fingerprint = 5F4D 3CDB D3F8 3652 FBD8 02D5 3B6C 5F1D 2C7B 6B02 https://sks-keyservers.net/pks/lookup?op=get&search=0x3B6C5F1D2C7B6B02 Dominick Grift -------------- next part -------------- A non-text attachment was scrubbed... Name: signature.asc Type: application/pgp-signature Size: 648 bytes Desc: OpenPGP digital signature Url : http://oss.tresys.com/pipermail/refpolicy/attachments/20160825/7c684dac/attachment.bin ^ permalink raw reply [flat|nested] 73+ messages in thread
* [refpolicy] [PATCH v4] Update for the gnome policy and file contexts 2016-08-24 22:10 ` Chris PeBenito 2016-08-24 22:42 ` Guido Trentalancia @ 2016-08-25 9:47 ` Guido Trentalancia 2016-08-25 22:49 ` Chris PeBenito 2016-08-27 17:08 ` Guido Trentalancia 2 siblings, 1 reply; 73+ messages in thread From: Guido Trentalancia @ 2016-08-25 9:47 UTC (permalink / raw) To: refpolicy Hello Christopher. I have more information on this problem. On Wed, 24/08/2016 at 18.10 -0400, Chris PeBenito wrote: > On 08/24/16 17:55, Guido Trentalancia wrote: > > > > Hello Christopher. > > > > I have more detailed information about this problem... > > > > On Tue, 23/08/2016 at 19.02 -0400, Chris PeBenito wrote: > > > > > > On 08/23/16 08:44, Guido Trentalancia wrote: > > > > > > > > > > > > Hello Christopher ! > > > > > > > > Thanks for providing your valuable feedback. > > > > > > > > On Mon, 22/08/2016 at 21.15 -0400, Chris PeBenito wrote: > > > > > > > > > > > > > > > On 08/22/16 15:39, Guido Trentalancia wrote: > > > > > > > > > > > > > > > > > > > > > > > > + type dconf_t, dconf_exec_t, dconf_home_t; > > > > > > + type at_spi_t, at_spi_exec_t; > > > > > > ? type gconfd_t, gconfd_exec_t, gconf_tmp_t; > > > > > > ? type gconf_home_t; > > > > > > + type gnome_settings_t, > > > > > > gnome_settings_exec_t; > > > > > > + type gnome_settings_daemon_t, > > > > > > gnome_settings_daemon_exec_t; > > > > > > + type gnome_settings_schemas_t; > > > > > > + type gkeyringd_exec_t, > > > > > > gnome_keyring_home_t, > > > > > > gnome_keyring_cache_home_t, gnome_keyring_tmp_t; > > > > > > + type mime_info_t; > > > > > > + type user_dbusd_t; > > > > > > > > > > This dbus type cannot be referenced directly in this module. > > > > > > > > If $1_dbusd_t is used to get the role/type prefix from the > > > > caller, > > > > then > > > > it doesn't compile for some reason which is not yet clear to > > > > me. > > > > > > > > Any idea ? > > > > > > The $1_dbusd_t rules need to be contained in the dbus module, not > > > the > > > gnome module.??Beyond that, it's tough to say what the problem > > > is, > > > without knowing the error messages. > > > > Suppose to have the following additional dbus interface: > > > > ####################################### > > ## <summary> > > ##??????Make a domain transition from a > > ##??????given source domain to the > > ##??????DBUS session bus domain using > > ##??????the DBUS executable file type. > > ## </summary> > > ## <param name="role_prefix"> > > ##??????<summary> > > ##??????The prefix of the user role (e.g., user > > ##??????is the prefix for user_r). > > ##??????</summary> > > ## </param> > > ## <param name="domain"> > > ##??????<summary> > > ##??????Domain allowed access. > > ##??????</summary> > > ## </param> > > # > > interface(`dbus_domain_transition_session_bus',` > > ????????gen_require(` > > ????????????????type dbusd_exec_t; > > ????????????????type $1_dbusd_t; > > ????????') > > > > ????????allow $2 dbusd_exec_t:file exec_file_perms; > > ????????domtrans_pattern($2, dbusd_exec_t, $1_dbusd_t) > > ') > > > > and suppose that it is called by the following statement: > > > > dbus_domain_transition_session_bus($1, at_spi_t) > > > > where $1 = "user". > > > > During policy load, the following error is generated: > > > > Conflicting type rules > > Binary policy creation failed at line 29393 of > > /var/lib/selinux/refpolicy-06082016/tmp/modules/400/sysadm/cil > > Failed to generate binary > > /usr/sbin/semodule:??Failed! > > make: *** [Rules.modular:58: load] Error 1 > > > > The temporary file is deleted automatically and cannot be > > inspected. > > > > I hope it is clear now... > > > > Do you have an idea ? It's the only thing missing before all the > > dbus > > rules are moved from the gnome to the dbus module and I can create > > a > > new version of this important patch. > > It's not so helpful unfortunately.??My guess is that it is a > conflicting? > type_transition.??Unfortunately the compiler error message isn't > helpful. I have tested and your guess is correct ! The above interface expands as follows: interface(`dbus_domain_transition_session_bus',` allow $1_dbusd_t dbusd_exec_t:file exec_file_perms; domain_transition_pattern($2,dbusd_exec_t,$1_dbusd_t) # type_transition $2 dbusd_exec_t:process $1_dbusd_t; allow $1_dbusd_t $2:fd use; allow $1_dbusd_t $2:fifo_file rw_fifo_file_perms; allow $1_dbusd_t $2:process sigchld; ') The line that has been commented out (type_transition) is the problematic rule which leads to the "conflicting type rules" error upon loading the policy. Such rule comes from the domain_auto_transition_pattern provided by support/misc_patterns.spt. However, if I hardcode "user" instead of "$1", the type_transition works fine. I suspect, it stops functioning when $1 is replaced by "sysadm" or "staff". If I do manually substitute the two and try to recompile, the following happens: $1=sysadm ==> staff.te doesn't compile (unknown type error) $1=staff ==> sysadm.te doesn't compile (unknown type error) In some way, it sounds like a bug or some sort of limitation of the actual policy... Can you shed some light ? Best regards, Guido ^ permalink raw reply [flat|nested] 73+ messages in thread
* [refpolicy] [PATCH v4] Update for the gnome policy and file contexts 2016-08-25 9:47 ` Guido Trentalancia @ 2016-08-25 22:49 ` Chris PeBenito 2016-08-26 22:21 ` Guido Trentalancia 0 siblings, 1 reply; 73+ messages in thread From: Chris PeBenito @ 2016-08-25 22:49 UTC (permalink / raw) To: refpolicy On 08/25/16 05:47, Guido Trentalancia wrote: > Hello Christopher. > > I have more information on this problem. > > On Wed, 24/08/2016 at 18.10 -0400, Chris PeBenito wrote: >> On 08/24/16 17:55, Guido Trentalancia wrote: >>> >>> Hello Christopher. >>> >>> I have more detailed information about this problem... >>> >>> On Tue, 23/08/2016 at 19.02 -0400, Chris PeBenito wrote: >>>> >>>> On 08/23/16 08:44, Guido Trentalancia wrote: >>>>> >>>>> >>>>> Hello Christopher ! >>>>> >>>>> Thanks for providing your valuable feedback. >>>>> >>>>> On Mon, 22/08/2016 at 21.15 -0400, Chris PeBenito wrote: >>>>>> >>>>>> >>>>>> On 08/22/16 15:39, Guido Trentalancia wrote: >>>>>>> >>>>>>> >>>>>>> >>>>>>> + type dconf_t, dconf_exec_t, dconf_home_t; >>>>>>> + type at_spi_t, at_spi_exec_t; >>>>>>> type gconfd_t, gconfd_exec_t, gconf_tmp_t; >>>>>>> type gconf_home_t; >>>>>>> + type gnome_settings_t, >>>>>>> gnome_settings_exec_t; >>>>>>> + type gnome_settings_daemon_t, >>>>>>> gnome_settings_daemon_exec_t; >>>>>>> + type gnome_settings_schemas_t; >>>>>>> + type gkeyringd_exec_t, >>>>>>> gnome_keyring_home_t, >>>>>>> gnome_keyring_cache_home_t, gnome_keyring_tmp_t; >>>>>>> + type mime_info_t; >>>>>>> + type user_dbusd_t; >>>>>> >>>>>> This dbus type cannot be referenced directly in this module. >>>>> >>>>> If $1_dbusd_t is used to get the role/type prefix from the >>>>> caller, >>>>> then >>>>> it doesn't compile for some reason which is not yet clear to >>>>> me. >>>>> >>>>> Any idea ? >>>> >>>> The $1_dbusd_t rules need to be contained in the dbus module, not >>>> the >>>> gnome module. Beyond that, it's tough to say what the problem >>>> is, >>>> without knowing the error messages. >>> >>> Suppose to have the following additional dbus interface: >>> >>> ####################################### >>> ## <summary> >>> ## Make a domain transition from a >>> ## given source domain to the >>> ## DBUS session bus domain using >>> ## the DBUS executable file type. >>> ## </summary> >>> ## <param name="role_prefix"> >>> ## <summary> >>> ## The prefix of the user role (e.g., user >>> ## is the prefix for user_r). >>> ## </summary> >>> ## </param> >>> ## <param name="domain"> >>> ## <summary> >>> ## Domain allowed access. >>> ## </summary> >>> ## </param> >>> # >>> interface(`dbus_domain_transition_session_bus',` >>> gen_require(` >>> type dbusd_exec_t; >>> type $1_dbusd_t; >>> ') >>> >>> allow $2 dbusd_exec_t:file exec_file_perms; >>> domtrans_pattern($2, dbusd_exec_t, $1_dbusd_t) >>> ') >>> >>> and suppose that it is called by the following statement: >>> >>> dbus_domain_transition_session_bus($1, at_spi_t) >>> >>> where $1 = "user". >>> >>> During policy load, the following error is generated: >>> >>> Conflicting type rules >>> Binary policy creation failed at line 29393 of >>> /var/lib/selinux/refpolicy-06082016/tmp/modules/400/sysadm/cil >>> Failed to generate binary >>> /usr/sbin/semodule: Failed! >>> make: *** [Rules.modular:58: load] Error 1 >>> >>> The temporary file is deleted automatically and cannot be >>> inspected. >>> >>> I hope it is clear now... >>> >>> Do you have an idea ? It's the only thing missing before all the >>> dbus >>> rules are moved from the gnome to the dbus module and I can create >>> a >>> new version of this important patch. >> >> It's not so helpful unfortunately. My guess is that it is a >> conflicting >> type_transition. Unfortunately the compiler error message isn't >> helpful. > > I have tested and your guess is correct ! > > The above interface expands as follows: > > interface(`dbus_domain_transition_session_bus',` > allow $1_dbusd_t dbusd_exec_t:file exec_file_perms; > > domain_transition_pattern($2,dbusd_exec_t,$1_dbusd_t) > # type_transition $2 dbusd_exec_t:process $1_dbusd_t; > > allow $1_dbusd_t $2:fd use; > allow $1_dbusd_t $2:fifo_file rw_fifo_file_perms; > allow $1_dbusd_t $2:process sigchld; > ') > > The line that has been commented out (type_transition) is the > problematic rule which leads to the "conflicting type rules" error upon > loading the policy. > > Such rule comes from the domain_auto_transition_pattern provided by > support/misc_patterns.spt. > > However, if I hardcode "user" instead of "$1", the type_transition > works fine. I suspect, it stops functioning when $1 is replaced by > "sysadm" or "staff". > > If I do manually substitute the two and try to recompile, the following > happens: > > $1=sysadm ==> staff.te doesn't compile (unknown type error) > > $1=staff ==> sysadm.te doesn't compile (unknown type error) > > In some way, it sounds like a bug or some sort of limitation of the > actual policy... Can you shed some light ? I'm not clear why you would see unknown types. You have to inspect the intermediate files. I believe if you add them to a .SECONDARY entry in the Makefile/Rules.*, it will not delete them when they're done. I'd be fine taking that patch too, so intermediate files are never deleted. -- Chris PeBenito ^ permalink raw reply [flat|nested] 73+ messages in thread
* [refpolicy] [PATCH v4] Update for the gnome policy and file contexts 2016-08-25 22:49 ` Chris PeBenito @ 2016-08-26 22:21 ` Guido Trentalancia 2016-08-28 18:29 ` Chris PeBenito 0 siblings, 1 reply; 73+ messages in thread From: Guido Trentalancia @ 2016-08-26 22:21 UTC (permalink / raw) To: refpolicy Hello Christopher. On Thu, 25/08/2016 at 18.49 -0400, Chris PeBenito wrote: [...] > > > > > > > On 08/22/16 15:39, Guido Trentalancia wrote: > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > + type dconf_t, dconf_exec_t, > > > > > > > > dconf_home_t; > > > > > > > > + type at_spi_t, at_spi_exec_t; > > > > > > > > ? type gconfd_t, gconfd_exec_t, > > > > > > > > gconf_tmp_t; > > > > > > > > ? type gconf_home_t; > > > > > > > > + type gnome_settings_t, > > > > > > > > gnome_settings_exec_t; > > > > > > > > + type gnome_settings_daemon_t, > > > > > > > > gnome_settings_daemon_exec_t; > > > > > > > > + type gnome_settings_schemas_t; > > > > > > > > + type gkeyringd_exec_t, > > > > > > > > gnome_keyring_home_t, > > > > > > > > gnome_keyring_cache_home_t, gnome_keyring_tmp_t; > > > > > > > > + type mime_info_t; > > > > > > > > + type user_dbusd_t; > > > > > > > > > > > > > > This dbus type cannot be referenced directly in this > > > > > > > module. > > > > > > > > > > > > If $1_dbusd_t is used to get the role/type prefix from the > > > > > > caller, > > > > > > then > > > > > > it doesn't compile for some reason which is not yet clear > > > > > > to > > > > > > me. > > > > > > > > > > > > Any idea ? > > > > > > > > > > The $1_dbusd_t rules need to be contained in the dbus module, > > > > > not > > > > > the > > > > > gnome module.??Beyond that, it's tough to say what the > > > > > problem > > > > > is, > > > > > without knowing the error messages. > > > > > > > > Suppose to have the following additional dbus interface: > > > > > > > > ####################################### > > > > ## <summary> > > > > ##??????Make a domain transition from a > > > > ##??????given source domain to the > > > > ##??????DBUS session bus domain using > > > > ##??????the DBUS executable file type. > > > > ## </summary> > > > > ## <param name="role_prefix"> > > > > ##??????<summary> > > > > ##??????The prefix of the user role (e.g., user > > > > ##??????is the prefix for user_r). > > > > ##??????</summary> > > > > ## </param> > > > > ## <param name="domain"> > > > > ##??????<summary> > > > > ##??????Domain allowed access. > > > > ##??????</summary> > > > > ## </param> > > > > # > > > > interface(`dbus_domain_transition_session_bus',` > > > > ????????gen_require(` > > > > ????????????????type dbusd_exec_t; > > > > ????????????????type $1_dbusd_t; > > > > ????????') > > > > > > > > ????????allow $2 dbusd_exec_t:file exec_file_perms; > > > > ????????domtrans_pattern($2, dbusd_exec_t, $1_dbusd_t) > > > > ') > > > > > > > > and suppose that it is called by the following statement: > > > > > > > > dbus_domain_transition_session_bus($1, at_spi_t) > > > > > > > > where $1 = "user". > > > > > > > > During policy load, the following error is generated: > > > > > > > > Conflicting type rules > > > > Binary policy creation failed at line 29393 of > > > > /var/lib/selinux/refpolicy-06082016/tmp/modules/400/sysadm/cil > > > > Failed to generate binary > > > > /usr/sbin/semodule:??Failed! > > > > make: *** [Rules.modular:58: load] Error 1 > > > > > > > > The temporary file is deleted automatically and cannot be > > > > inspected. > > > > > > > > I hope it is clear now... > > > > > > > > Do you have an idea ? It's the only thing missing before all > > > > the > > > > dbus > > > > rules are moved from the gnome to the dbus module and I can > > > > create > > > > a > > > > new version of this important patch. > > > > > > It's not so helpful unfortunately.??My guess is that it is a > > > conflicting > > > type_transition.??Unfortunately the compiler error message isn't > > > helpful. > > > > I have tested and your guess is correct ! > > > > The above interface expands as follows: > > > > interface(`dbus_domain_transition_session_bus',` > > ????????allow $1_dbusd_t dbusd_exec_t:file exec_file_perms; > > > > ????????domain_transition_pattern($2,dbusd_exec_t,$1_dbusd_t) > > #????????type_transition $2 dbusd_exec_t:process $1_dbusd_t; > > > > ????????allow $1_dbusd_t $2:fd use; > > ????????allow $1_dbusd_t $2:fifo_file rw_fifo_file_perms; > > ????????allow $1_dbusd_t $2:process sigchld; > > ') > > > > The line that has been commented out (type_transition) is the > > problematic rule which leads to the "conflicting type rules" error > > upon > > loading the policy. > > > > Such rule comes from the domain_auto_transition_pattern provided by > > support/misc_patterns.spt. > > > > However, if I hardcode "user" instead of "$1", the type_transition > > works fine. I suspect, it stops functioning when $1 is replaced by > > "sysadm" or "staff". > > > > If I do manually substitute the two and try to recompile, the > > following > > happens: > > > > $1=sysadm ==> staff.te doesn't compile (unknown type error) > > > > $1=staff ==> sysadm.te doesn't compile (unknown type error) > > > > In some way, it sounds like a bug or some sort of limitation of the > > actual policy... Can you shed some light ? > > I'm not clear why you would see unknown types.??You have to inspect > the? > intermediate files.??I believe if you add them to a .SECONDARY entry > in? > the Makefile/Rules.*, it will not delete them when they're done.??I'd > be? > fine taking that patch too, so intermediate files are never deleted. I think the files that you mention are stored in the "tmp" subdirectory of the policy source. I don't think there is a need to modify the Makefile or Rules.* files. The "Conflicting type rules" error comes from libsepol when one tries to load the policy using semodule (called by the policy Makefile). What semodule deleted (/var/lib/selinux/refpolicy- 06082016/tmp/modules/400/sysadm/cil) might be a binary file generated by libsepol. In any case, it has nothing to do with the policy Makefile. Unfortunately, I have checked the temporary files in the "tmp" subdirectory of the build tree, but the only difference between the working version and the non-working version is that the static hardcoded "user" string ("user_dbusd_t") in the type_transition rule is replaced by "staff", "sysadm" or "xguest" ("staff_dbusd_t" and so on). I noticed that the dbus_role_template is also using that variable type ($1_dbusd_t, where $1 is normally either "user", "staff", "sysadm" or "xguest"). The problem seems to be that the $1_dbusd_t type defined by the dbus_role_template conflicts with the type defined by the new interface that is required by gnome (it conflicts with the type_transition rule). I believe this is a bug or some sort of limitation of the existing policy... Do you know how to fix it ? Regards, Guido ^ permalink raw reply [flat|nested] 73+ messages in thread
* [refpolicy] [PATCH v4] Update for the gnome policy and file contexts 2016-08-26 22:21 ` Guido Trentalancia @ 2016-08-28 18:29 ` Chris PeBenito 0 siblings, 0 replies; 73+ messages in thread From: Chris PeBenito @ 2016-08-28 18:29 UTC (permalink / raw) To: refpolicy On 08/26/16 18:21, Guido Trentalancia wrote: > Hello Christopher. > > On Thu, 25/08/2016 at 18.49 -0400, Chris PeBenito wrote: > > [...] > >>>>>>>> On 08/22/16 15:39, Guido Trentalancia wrote: >>>>>>>>> >>>>>>>>> >>>>>>>>> >>>>>>>>> >>>>>>>>> + type dconf_t, dconf_exec_t, >>>>>>>>> dconf_home_t; >>>>>>>>> + type at_spi_t, at_spi_exec_t; >>>>>>>>> type gconfd_t, gconfd_exec_t, >>>>>>>>> gconf_tmp_t; >>>>>>>>> type gconf_home_t; >>>>>>>>> + type gnome_settings_t, >>>>>>>>> gnome_settings_exec_t; >>>>>>>>> + type gnome_settings_daemon_t, >>>>>>>>> gnome_settings_daemon_exec_t; >>>>>>>>> + type gnome_settings_schemas_t; >>>>>>>>> + type gkeyringd_exec_t, >>>>>>>>> gnome_keyring_home_t, >>>>>>>>> gnome_keyring_cache_home_t, gnome_keyring_tmp_t; >>>>>>>>> + type mime_info_t; >>>>>>>>> + type user_dbusd_t; >>>>>>>> >>>>>>>> This dbus type cannot be referenced directly in this >>>>>>>> module. >>>>>>> >>>>>>> If $1_dbusd_t is used to get the role/type prefix from the >>>>>>> caller, >>>>>>> then >>>>>>> it doesn't compile for some reason which is not yet clear >>>>>>> to >>>>>>> me. >>>>>>> >>>>>>> Any idea ? >>>>>> >>>>>> The $1_dbusd_t rules need to be contained in the dbus module, >>>>>> not >>>>>> the >>>>>> gnome module. Beyond that, it's tough to say what the >>>>>> problem >>>>>> is, >>>>>> without knowing the error messages. >>>>> >>>>> Suppose to have the following additional dbus interface: >>>>> >>>>> ####################################### >>>>> ## <summary> >>>>> ## Make a domain transition from a >>>>> ## given source domain to the >>>>> ## DBUS session bus domain using >>>>> ## the DBUS executable file type. >>>>> ## </summary> >>>>> ## <param name="role_prefix"> >>>>> ## <summary> >>>>> ## The prefix of the user role (e.g., user >>>>> ## is the prefix for user_r). >>>>> ## </summary> >>>>> ## </param> >>>>> ## <param name="domain"> >>>>> ## <summary> >>>>> ## Domain allowed access. >>>>> ## </summary> >>>>> ## </param> >>>>> # >>>>> interface(`dbus_domain_transition_session_bus',` >>>>> gen_require(` >>>>> type dbusd_exec_t; >>>>> type $1_dbusd_t; >>>>> ') >>>>> >>>>> allow $2 dbusd_exec_t:file exec_file_perms; >>>>> domtrans_pattern($2, dbusd_exec_t, $1_dbusd_t) >>>>> ') >>>>> >>>>> and suppose that it is called by the following statement: >>>>> >>>>> dbus_domain_transition_session_bus($1, at_spi_t) >>>>> >>>>> where $1 = "user". >>>>> >>>>> During policy load, the following error is generated: >>>>> >>>>> Conflicting type rules >>>>> Binary policy creation failed at line 29393 of >>>>> /var/lib/selinux/refpolicy-06082016/tmp/modules/400/sysadm/cil >>>>> Failed to generate binary >>>>> /usr/sbin/semodule: Failed! >>>>> make: *** [Rules.modular:58: load] Error 1 >>>>> >>>>> The temporary file is deleted automatically and cannot be >>>>> inspected. >>>>> >>>>> I hope it is clear now... >>>>> >>>>> Do you have an idea ? It's the only thing missing before all >>>>> the >>>>> dbus >>>>> rules are moved from the gnome to the dbus module and I can >>>>> create >>>>> a >>>>> new version of this important patch. >>>> >>>> It's not so helpful unfortunately. My guess is that it is a >>>> conflicting >>>> type_transition. Unfortunately the compiler error message isn't >>>> helpful. >>> >>> I have tested and your guess is correct ! >>> >>> The above interface expands as follows: >>> >>> interface(`dbus_domain_transition_session_bus',` >>> allow $1_dbusd_t dbusd_exec_t:file exec_file_perms; >>> >>> domain_transition_pattern($2,dbusd_exec_t,$1_dbusd_t) >>> # type_transition $2 dbusd_exec_t:process $1_dbusd_t; >>> >>> allow $1_dbusd_t $2:fd use; >>> allow $1_dbusd_t $2:fifo_file rw_fifo_file_perms; >>> allow $1_dbusd_t $2:process sigchld; >>> ') >>> >>> The line that has been commented out (type_transition) is the >>> problematic rule which leads to the "conflicting type rules" error >>> upon >>> loading the policy. >>> >>> Such rule comes from the domain_auto_transition_pattern provided by >>> support/misc_patterns.spt. >>> >>> However, if I hardcode "user" instead of "$1", the type_transition >>> works fine. I suspect, it stops functioning when $1 is replaced by >>> "sysadm" or "staff". >>> >>> If I do manually substitute the two and try to recompile, the >>> following >>> happens: >>> >>> $1=sysadm ==> staff.te doesn't compile (unknown type error) >>> >>> $1=staff ==> sysadm.te doesn't compile (unknown type error) >>> >>> In some way, it sounds like a bug or some sort of limitation of the >>> actual policy... Can you shed some light ? >> >> I'm not clear why you would see unknown types. You have to inspect >> the >> intermediate files. I believe if you add them to a .SECONDARY entry >> in >> the Makefile/Rules.*, it will not delete them when they're done. I'd >> be >> fine taking that patch too, so intermediate files are never deleted. > > I think the files that you mention are stored in the "tmp" subdirectory > of the policy source. > > I don't think there is a need to modify the Makefile or Rules.* files. > > The "Conflicting type rules" error comes from libsepol when one tries > to load the policy using semodule (called by the policy Makefile). > > What semodule deleted (/var/lib/selinux/refpolicy- > 06082016/tmp/modules/400/sysadm/cil) might be a binary file generated > by libsepol. In any case, it has nothing to do with the policy > Makefile. > > Unfortunately, I have checked the temporary files in the "tmp" > subdirectory of the build tree, but the only difference between the > working version and the non-working version is that the static > hardcoded "user" string ("user_dbusd_t") in the type_transition rule is > replaced by "staff", "sysadm" or "xguest" ("staff_dbusd_t" and so on). > > I noticed that the dbus_role_template is also using that variable type > ($1_dbusd_t, where $1 is normally either "user", "staff", "sysadm" or > "xguest"). > > The problem seems to be that the $1_dbusd_t type defined by the > dbus_role_template conflicts with the type defined by the new interface > that is required by gnome (it conflicts with the type_transition rule). > > I believe this is a bug or some sort of limitation of the existing > policy... Do you know how to fix it ? The dbus module is where *_dbusd_t should be declared, so *_dbusd_t declarations in a gnome module are incorrect. The only other issue that I can think of is in the past, if you required a type and then later declared it in the same file, that would hit a compiler limitation/bug that would (incorrectly) call it a duplicate type declaration. In terms of type_transition you'd have to inspect the intermediate file that is used to compile the binary to try to see where the conflict is. It may also be a conflict across multiple modules, which would make it more difficult to uncover. -- Chris PeBenito ^ permalink raw reply [flat|nested] 73+ messages in thread
* [refpolicy] [PATCH v4] Update for the gnome policy and file contexts 2016-08-24 22:10 ` Chris PeBenito 2016-08-24 22:42 ` Guido Trentalancia 2016-08-25 9:47 ` Guido Trentalancia @ 2016-08-27 17:08 ` Guido Trentalancia 2016-08-27 17:10 ` Dominick Grift 2 siblings, 1 reply; 73+ messages in thread From: Guido Trentalancia @ 2016-08-27 17:08 UTC (permalink / raw) To: refpolicy Hello Christopher. On Wed, 24/08/2016 at 18.10 -0400, Chris PeBenito wrote: > On 08/24/16 17:55, Guido Trentalancia wrote: > > > > Hello Christopher. > > > > I have more detailed information about this problem... > > > > On Tue, 23/08/2016 at 19.02 -0400, Chris PeBenito wrote: > > > > > > On 08/23/16 08:44, Guido Trentalancia wrote: > > > > > > > > > > > > Hello Christopher ! > > > > > > > > Thanks for providing your valuable feedback. > > > > > > > > On Mon, 22/08/2016 at 21.15 -0400, Chris PeBenito wrote: > > > > > > > > > > > > > > > On 08/22/16 15:39, Guido Trentalancia wrote: > > > > > > > > > > > > > > > > > > > > > > > > + type dconf_t, dconf_exec_t, dconf_home_t; > > > > > > + type at_spi_t, at_spi_exec_t; > > > > > > ? type gconfd_t, gconfd_exec_t, gconf_tmp_t; > > > > > > ? type gconf_home_t; > > > > > > + type gnome_settings_t, > > > > > > gnome_settings_exec_t; > > > > > > + type gnome_settings_daemon_t, > > > > > > gnome_settings_daemon_exec_t; > > > > > > + type gnome_settings_schemas_t; > > > > > > + type gkeyringd_exec_t, > > > > > > gnome_keyring_home_t, > > > > > > gnome_keyring_cache_home_t, gnome_keyring_tmp_t; > > > > > > + type mime_info_t; > > > > > > + type user_dbusd_t; > > > > > > > > > > This dbus type cannot be referenced directly in this module. > > > > > > > > If $1_dbusd_t is used to get the role/type prefix from the > > > > caller, > > > > then > > > > it doesn't compile for some reason which is not yet clear to > > > > me. > > > > > > > > Any idea ? > > > > > > The $1_dbusd_t rules need to be contained in the dbus module, not > > > the > > > gnome module.??Beyond that, it's tough to say what the problem > > > is, > > > without knowing the error messages. > > > > Suppose to have the following additional dbus interface: > > > > ####################################### > > ## <summary> > > ##??????Make a domain transition from a > > ##??????given source domain to the > > ##??????DBUS session bus domain using > > ##??????the DBUS executable file type. > > ## </summary> > > ## <param name="role_prefix"> > > ##??????<summary> > > ##??????The prefix of the user role (e.g., user > > ##??????is the prefix for user_r). > > ##??????</summary> > > ## </param> > > ## <param name="domain"> > > ##??????<summary> > > ##??????Domain allowed access. > > ##??????</summary> > > ## </param> > > # > > interface(`dbus_domain_transition_session_bus',` > > ????????gen_require(` > > ????????????????type dbusd_exec_t; > > ????????????????type $1_dbusd_t; > > ????????') > > > > ????????allow $2 dbusd_exec_t:file exec_file_perms; > > ????????domtrans_pattern($2, dbusd_exec_t, $1_dbusd_t) > > ') > > > > and suppose that it is called by the following statement: > > > > dbus_domain_transition_session_bus($1, at_spi_t) > > > > where $1 = "user". > > > > During policy load, the following error is generated: > > > > Conflicting type rules > > Binary policy creation failed at line 29393 of > > /var/lib/selinux/refpolicy-06082016/tmp/modules/400/sysadm/cil > > Failed to generate binary > > /usr/sbin/semodule:??Failed! > > make: *** [Rules.modular:58: load] Error 1 > > > > The temporary file is deleted automatically and cannot be > > inspected. > > > > I hope it is clear now... > > > > Do you have an idea ? It's the only thing missing before all the > > dbus > > rules are moved from the gnome to the dbus module and I can create > > a > > new version of this important patch. > > It's not so helpful unfortunately.??My guess is that it is a > conflicting? > type_transition.??Unfortunately the compiler error message isn't > helpful. I have just posted a patch on the SELinux mailing list to produce a more meaningful error message for conflicting type rules, see the following thread: [PATCH] libsepol: Produce more meaningful error messages for conflicting type rules In this case, the conflicting type rule is: scontext=at_spi_t tcontext=dbusd_exec_t tclass=process result=sysadm_dbusd_t which confirms the previous debugging results (it's the type_transition rule). Another one is similar, with scontext=gnome_settings_t. What I suspect is that when it compiles, it quadruplicates the type transition for each of user, staff, sysadm and xguest, thus leading to conflicting rules. Therefore, the solution might be to use a common static name for the domain (for example, "session_dbusd_t" instead of "$1_dbusd_t"). Regards, Guido ^ permalink raw reply [flat|nested] 73+ messages in thread
* [refpolicy] [PATCH v4] Update for the gnome policy and file contexts 2016-08-27 17:08 ` Guido Trentalancia @ 2016-08-27 17:10 ` Dominick Grift 2016-08-27 17:16 ` Guido Trentalancia 0 siblings, 1 reply; 73+ messages in thread From: Dominick Grift @ 2016-08-27 17:10 UTC (permalink / raw) To: refpolicy On 08/27/2016 07:08 PM, Guido Trentalancia via refpolicy wrote: > Hello Christopher. > > On Wed, 24/08/2016 at 18.10 -0400, Chris PeBenito wrote: >> On 08/24/16 17:55, Guido Trentalancia wrote: >>> >>> Hello Christopher. >>> >>> I have more detailed information about this problem... >>> >>> On Tue, 23/08/2016 at 19.02 -0400, Chris PeBenito wrote: >>>> >>>> On 08/23/16 08:44, Guido Trentalancia wrote: >>>>> >>>>> >>>>> Hello Christopher ! >>>>> >>>>> Thanks for providing your valuable feedback. >>>>> >>>>> On Mon, 22/08/2016 at 21.15 -0400, Chris PeBenito wrote: >>>>>> >>>>>> >>>>>> On 08/22/16 15:39, Guido Trentalancia wrote: >>>>>>> >>>>>>> >>>>>>> >>>>>>> + type dconf_t, dconf_exec_t, dconf_home_t; >>>>>>> + type at_spi_t, at_spi_exec_t; >>>>>>> type gconfd_t, gconfd_exec_t, gconf_tmp_t; >>>>>>> type gconf_home_t; >>>>>>> + type gnome_settings_t, >>>>>>> gnome_settings_exec_t; >>>>>>> + type gnome_settings_daemon_t, >>>>>>> gnome_settings_daemon_exec_t; >>>>>>> + type gnome_settings_schemas_t; >>>>>>> + type gkeyringd_exec_t, >>>>>>> gnome_keyring_home_t, >>>>>>> gnome_keyring_cache_home_t, gnome_keyring_tmp_t; >>>>>>> + type mime_info_t; >>>>>>> + type user_dbusd_t; >>>>>> >>>>>> This dbus type cannot be referenced directly in this module. >>>>> >>>>> If $1_dbusd_t is used to get the role/type prefix from the >>>>> caller, >>>>> then >>>>> it doesn't compile for some reason which is not yet clear to >>>>> me. >>>>> >>>>> Any idea ? >>>> >>>> The $1_dbusd_t rules need to be contained in the dbus module, not >>>> the >>>> gnome module. Beyond that, it's tough to say what the problem >>>> is, >>>> without knowing the error messages. >>> >>> Suppose to have the following additional dbus interface: >>> >>> ####################################### >>> ## <summary> >>> ## Make a domain transition from a >>> ## given source domain to the >>> ## DBUS session bus domain using >>> ## the DBUS executable file type. >>> ## </summary> >>> ## <param name="role_prefix"> >>> ## <summary> >>> ## The prefix of the user role (e.g., user >>> ## is the prefix for user_r). >>> ## </summary> >>> ## </param> >>> ## <param name="domain"> >>> ## <summary> >>> ## Domain allowed access. >>> ## </summary> >>> ## </param> >>> # >>> interface(`dbus_domain_transition_session_bus',` >>> gen_require(` >>> type dbusd_exec_t; >>> type $1_dbusd_t; >>> ') >>> >>> allow $2 dbusd_exec_t:file exec_file_perms; >>> domtrans_pattern($2, dbusd_exec_t, $1_dbusd_t) >>> ') >>> >>> and suppose that it is called by the following statement: >>> >>> dbus_domain_transition_session_bus($1, at_spi_t) >>> >>> where $1 = "user". >>> >>> During policy load, the following error is generated: >>> >>> Conflicting type rules >>> Binary policy creation failed at line 29393 of >>> /var/lib/selinux/refpolicy-06082016/tmp/modules/400/sysadm/cil >>> Failed to generate binary >>> /usr/sbin/semodule: Failed! >>> make: *** [Rules.modular:58: load] Error 1 >>> >>> The temporary file is deleted automatically and cannot be >>> inspected. >>> >>> I hope it is clear now... >>> >>> Do you have an idea ? It's the only thing missing before all the >>> dbus >>> rules are moved from the gnome to the dbus module and I can create >>> a >>> new version of this important patch. >> >> It's not so helpful unfortunately. My guess is that it is a >> conflicting >> type_transition. Unfortunately the compiler error message isn't >> helpful. > > I have just posted a patch on the SELinux mailing list to produce a > more meaningful error message for conflicting type rules, see the > following thread: > > [PATCH] libsepol: Produce more meaningful error messages for > conflicting type rules > > In this case, the conflicting type rule is: > > scontext=at_spi_t > tcontext=dbusd_exec_t > tclass=process > result=sysadm_dbusd_t > > which confirms the previous debugging results (it's the type_transition > rule). > > Another one is similar, with scontext=gnome_settings_t. > > What I suspect is that when it compiles, it quadruplicates the type > transition for each of user, staff, sysadm and xguest, thus leading to > conflicting rules. > > Therefore, the solution might be to use a common static name for the > domain (for example, "session_dbusd_t" instead of "$1_dbusd_t"). and that will introduce other issues. because the session bus must be able to run things on behalf of the caller > > Regards, > > Guido > > _______________________________________________ > refpolicy mailing list > refpolicy at oss.tresys.com > http://oss.tresys.com/mailman/listinfo/refpolicy > -- Key fingerprint = 5F4D 3CDB D3F8 3652 FBD8 02D5 3B6C 5F1D 2C7B 6B02 https://sks-keyservers.net/pks/lookup?op=get&search=0x3B6C5F1D2C7B6B02 Dominick Grift -------------- next part -------------- A non-text attachment was scrubbed... Name: signature.asc Type: application/pgp-signature Size: 648 bytes Desc: OpenPGP digital signature Url : http://oss.tresys.com/pipermail/refpolicy/attachments/20160827/ba98bb1b/attachment.bin ^ permalink raw reply [flat|nested] 73+ messages in thread
* [refpolicy] [PATCH v4] Update for the gnome policy and file contexts 2016-08-27 17:10 ` Dominick Grift @ 2016-08-27 17:16 ` Guido Trentalancia 2016-08-27 17:17 ` Dominick Grift 0 siblings, 1 reply; 73+ messages in thread From: Guido Trentalancia @ 2016-08-27 17:16 UTC (permalink / raw) To: refpolicy Hello Dominick. On Sat, 27/08/2016 at 19.10 +0200, Dominick Grift via refpolicy wrote: > On 08/27/2016 07:08 PM, Guido Trentalancia via refpolicy wrote: [...] > > > > > > > On 08/22/16 15:39, Guido Trentalancia wrote: > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > + type dconf_t, dconf_exec_t, > > > > > > > > dconf_home_t; > > > > > > > > + type at_spi_t, at_spi_exec_t; > > > > > > > > ? type gconfd_t, gconfd_exec_t, > > > > > > > > gconf_tmp_t; > > > > > > > > ? type gconf_home_t; > > > > > > > > + type gnome_settings_t, > > > > > > > > gnome_settings_exec_t; > > > > > > > > + type gnome_settings_daemon_t, > > > > > > > > gnome_settings_daemon_exec_t; > > > > > > > > + type gnome_settings_schemas_t; > > > > > > > > + type gkeyringd_exec_t, > > > > > > > > gnome_keyring_home_t, > > > > > > > > gnome_keyring_cache_home_t, gnome_keyring_tmp_t; > > > > > > > > + type mime_info_t; > > > > > > > > + type user_dbusd_t; > > > > > > > > > > > > > > This dbus type cannot be referenced directly in this > > > > > > > module. > > > > > > > > > > > > If $1_dbusd_t is used to get the role/type prefix from the > > > > > > caller, > > > > > > then > > > > > > it doesn't compile for some reason which is not yet clear > > > > > > to > > > > > > me. > > > > > > > > > > > > Any idea ? > > > > > > > > > > The $1_dbusd_t rules need to be contained in the dbus module, > > > > > not > > > > > the > > > > > gnome module.??Beyond that, it's tough to say what the > > > > > problem > > > > > is, > > > > > without knowing the error messages. > > > > > > > > Suppose to have the following additional dbus interface: > > > > > > > > ####################################### > > > > ## <summary> > > > > ##??????Make a domain transition from a > > > > ##??????given source domain to the > > > > ##??????DBUS session bus domain using > > > > ##??????the DBUS executable file type. > > > > ## </summary> > > > > ## <param name="role_prefix"> > > > > ##??????<summary> > > > > ##??????The prefix of the user role (e.g., user > > > > ##??????is the prefix for user_r). > > > > ##??????</summary> > > > > ## </param> > > > > ## <param name="domain"> > > > > ##??????<summary> > > > > ##??????Domain allowed access. > > > > ##??????</summary> > > > > ## </param> > > > > # > > > > interface(`dbus_domain_transition_session_bus',` > > > > ????????gen_require(` > > > > ????????????????type dbusd_exec_t; > > > > ????????????????type $1_dbusd_t; > > > > ????????') > > > > > > > > ????????allow $2 dbusd_exec_t:file exec_file_perms; > > > > ????????domtrans_pattern($2, dbusd_exec_t, $1_dbusd_t) > > > > ') > > > > > > > > and suppose that it is called by the following statement: > > > > > > > > dbus_domain_transition_session_bus($1, at_spi_t) > > > > > > > > where $1 = "user". > > > > > > > > During policy load, the following error is generated: > > > > > > > > Conflicting type rules > > > > Binary policy creation failed at line 29393 of > > > > /var/lib/selinux/refpolicy-06082016/tmp/modules/400/sysadm/cil > > > > Failed to generate binary > > > > /usr/sbin/semodule:??Failed! > > > > make: *** [Rules.modular:58: load] Error 1 > > > > > > > > The temporary file is deleted automatically and cannot be > > > > inspected. > > > > > > > > I hope it is clear now... > > > > > > > > Do you have an idea ? It's the only thing missing before all > > > > the > > > > dbus > > > > rules are moved from the gnome to the dbus module and I can > > > > create > > > > a > > > > new version of this important patch. > > > > > > It's not so helpful unfortunately.??My guess is that it is a > > > conflicting? > > > type_transition.??Unfortunately the compiler error message isn't > > > helpful. > > > > I have just posted a patch on the SELinux mailing list to produce a > > more meaningful error message for conflicting type rules, see the > > following thread: > > > > [PATCH] libsepol: Produce more meaningful error messages for > > conflicting type rules > > > > In this case, the conflicting type rule is: > > > > scontext=at_spi_t > > tcontext=dbusd_exec_t > > tclass=process > > result=sysadm_dbusd_t > > > > which confirms the previous debugging results (it's the > > type_transition > > rule). > > > > Another one is similar, with scontext=gnome_settings_t. > > > > What I suspect is that when it compiles, it quadruplicates the type > > transition for each of user, staff, sysadm and xguest, thus leading > > to > > conflicting rules. > > > > Therefore, the solution might be to use a common static name for > > the > > domain (for example, "session_dbusd_t" instead of "$1_dbusd_t"). > > and that will introduce other issues. because the session bus must be > able to run things on behalf of the caller Thanks for providing a forecast of other issues. So, what's the way out of this damn loop ? I am almost getting lost... Regards, Guido ^ permalink raw reply [flat|nested] 73+ messages in thread
* [refpolicy] [PATCH v4] Update for the gnome policy and file contexts 2016-08-27 17:16 ` Guido Trentalancia @ 2016-08-27 17:17 ` Dominick Grift 2016-08-27 20:41 ` Guido Trentalancia 0 siblings, 1 reply; 73+ messages in thread From: Dominick Grift @ 2016-08-27 17:17 UTC (permalink / raw) To: refpolicy On 08/27/2016 07:16 PM, Guido Trentalancia wrote: > Hello Dominick. > > On Sat, 27/08/2016 at 19.10 +0200, Dominick Grift via refpolicy wrote: >> On 08/27/2016 07:08 PM, Guido Trentalancia via refpolicy wrote: > > [...] > >>>>>>>> On 08/22/16 15:39, Guido Trentalancia wrote: >>>>>>>>> >>>>>>>>> >>>>>>>>> >>>>>>>>> >>>>>>>>> + type dconf_t, dconf_exec_t, >>>>>>>>> dconf_home_t; >>>>>>>>> + type at_spi_t, at_spi_exec_t; >>>>>>>>> type gconfd_t, gconfd_exec_t, >>>>>>>>> gconf_tmp_t; >>>>>>>>> type gconf_home_t; >>>>>>>>> + type gnome_settings_t, >>>>>>>>> gnome_settings_exec_t; >>>>>>>>> + type gnome_settings_daemon_t, >>>>>>>>> gnome_settings_daemon_exec_t; >>>>>>>>> + type gnome_settings_schemas_t; >>>>>>>>> + type gkeyringd_exec_t, >>>>>>>>> gnome_keyring_home_t, >>>>>>>>> gnome_keyring_cache_home_t, gnome_keyring_tmp_t; >>>>>>>>> + type mime_info_t; >>>>>>>>> + type user_dbusd_t; >>>>>>>> >>>>>>>> This dbus type cannot be referenced directly in this >>>>>>>> module. >>>>>>> >>>>>>> If $1_dbusd_t is used to get the role/type prefix from the >>>>>>> caller, >>>>>>> then >>>>>>> it doesn't compile for some reason which is not yet clear >>>>>>> to >>>>>>> me. >>>>>>> >>>>>>> Any idea ? >>>>>> >>>>>> The $1_dbusd_t rules need to be contained in the dbus module, >>>>>> not >>>>>> the >>>>>> gnome module. Beyond that, it's tough to say what the >>>>>> problem >>>>>> is, >>>>>> without knowing the error messages. >>>>> >>>>> Suppose to have the following additional dbus interface: >>>>> >>>>> ####################################### >>>>> ## <summary> >>>>> ## Make a domain transition from a >>>>> ## given source domain to the >>>>> ## DBUS session bus domain using >>>>> ## the DBUS executable file type. >>>>> ## </summary> >>>>> ## <param name="role_prefix"> >>>>> ## <summary> >>>>> ## The prefix of the user role (e.g., user >>>>> ## is the prefix for user_r). >>>>> ## </summary> >>>>> ## </param> >>>>> ## <param name="domain"> >>>>> ## <summary> >>>>> ## Domain allowed access. >>>>> ## </summary> >>>>> ## </param> >>>>> # >>>>> interface(`dbus_domain_transition_session_bus',` >>>>> gen_require(` >>>>> type dbusd_exec_t; >>>>> type $1_dbusd_t; >>>>> ') >>>>> >>>>> allow $2 dbusd_exec_t:file exec_file_perms; >>>>> domtrans_pattern($2, dbusd_exec_t, $1_dbusd_t) >>>>> ') >>>>> >>>>> and suppose that it is called by the following statement: >>>>> >>>>> dbus_domain_transition_session_bus($1, at_spi_t) >>>>> >>>>> where $1 = "user". >>>>> >>>>> During policy load, the following error is generated: >>>>> >>>>> Conflicting type rules >>>>> Binary policy creation failed at line 29393 of >>>>> /var/lib/selinux/refpolicy-06082016/tmp/modules/400/sysadm/cil >>>>> Failed to generate binary >>>>> /usr/sbin/semodule: Failed! >>>>> make: *** [Rules.modular:58: load] Error 1 >>>>> >>>>> The temporary file is deleted automatically and cannot be >>>>> inspected. >>>>> >>>>> I hope it is clear now... >>>>> >>>>> Do you have an idea ? It's the only thing missing before all >>>>> the >>>>> dbus >>>>> rules are moved from the gnome to the dbus module and I can >>>>> create >>>>> a >>>>> new version of this important patch. >>>> >>>> It's not so helpful unfortunately. My guess is that it is a >>>> conflicting >>>> type_transition. Unfortunately the compiler error message isn't >>>> helpful. >>> >>> I have just posted a patch on the SELinux mailing list to produce a >>> more meaningful error message for conflicting type rules, see the >>> following thread: >>> >>> [PATCH] libsepol: Produce more meaningful error messages for >>> conflicting type rules >>> >>> In this case, the conflicting type rule is: >>> >>> scontext=at_spi_t >>> tcontext=dbusd_exec_t >>> tclass=process >>> result=sysadm_dbusd_t >>> >>> which confirms the previous debugging results (it's the >>> type_transition >>> rule). >>> >>> Another one is similar, with scontext=gnome_settings_t. >>> >>> What I suspect is that when it compiles, it quadruplicates the type >>> transition for each of user, staff, sysadm and xguest, thus leading >>> to >>> conflicting rules. >>> >>> Therefore, the solution might be to use a common static name for >>> the >>> domain (for example, "session_dbusd_t" instead of "$1_dbusd_t"). >> >> and that will introduce other issues. because the session bus must be >> able to run things on behalf of the caller > > Thanks for providing a forecast of other issues. > > So, what's the way out of this damn loop ? > > I am almost getting lost... > I dont know. > Regards, > > Guido > -- Key fingerprint = 5F4D 3CDB D3F8 3652 FBD8 02D5 3B6C 5F1D 2C7B 6B02 https://sks-keyservers.net/pks/lookup?op=get&search=0x3B6C5F1D2C7B6B02 Dominick Grift -------------- next part -------------- A non-text attachment was scrubbed... Name: signature.asc Type: application/pgp-signature Size: 648 bytes Desc: OpenPGP digital signature Url : http://oss.tresys.com/pipermail/refpolicy/attachments/20160827/5446cd68/attachment-0001.bin ^ permalink raw reply [flat|nested] 73+ messages in thread
* [refpolicy] [PATCH v4] Update for the gnome policy and file contexts 2016-08-27 17:17 ` Dominick Grift @ 2016-08-27 20:41 ` Guido Trentalancia 2016-08-27 20:57 ` Dominick Grift 0 siblings, 1 reply; 73+ messages in thread From: Guido Trentalancia @ 2016-08-27 20:41 UTC (permalink / raw) To: refpolicy On Sat, 27/08/2016 at 19.17 +0200, Dominick Grift wrote: > On 08/27/2016 07:16 PM, Guido Trentalancia wrote: [...] > > > > > It's not so helpful unfortunately.??My guess is that it is a > > > > > conflicting? > > > > > type_transition.??Unfortunately the compiler error message > > > > > isn't > > > > > helpful. > > > > > > > > I have just posted a patch on the SELinux mailing list to > > > > produce a > > > > more meaningful error message for conflicting type rules, see > > > > the > > > > following thread: > > > > > > > > [PATCH] libsepol: Produce more meaningful error messages for > > > > conflicting type rules > > > > > > > > In this case, the conflicting type rule is: > > > > > > > > scontext=at_spi_t > > > > tcontext=dbusd_exec_t > > > > tclass=process > > > > result=sysadm_dbusd_t > > > > > > > > which confirms the previous debugging results (it's the > > > > type_transition > > > > rule). > > > > > > > > Another one is similar, with scontext=gnome_settings_t. > > > > > > > > What I suspect is that when it compiles, it quadruplicates the > > > > type > > > > transition for each of user, staff, sysadm and xguest, thus > > > > leading > > > > to > > > > conflicting rules. > > > > > > > > Therefore, the solution might be to use a common static name > > > > for > > > > the > > > > domain (for example, "session_dbusd_t" instead of > > > > "$1_dbusd_t"). > > > > > > and that will introduce other issues. because the session bus > > > must be > > > able to run things on behalf of the caller > > > > Thanks for providing a forecast of other issues. > > > > So, what's the way out of this damn loop ? > > > > I am almost getting lost... > > > > I dont know. We need to find a cure for this !! What prevents it from running things on behalf of the caller ? And what do you mean exactly for running things on behalf of the caller ? I have the following interface: allow $1 dbusd_exec_t:file exec_file_perms; domtrans_pattern($1, dbusd_exec_t, session_dbusd_t) which is called with $1=at_spi_t and $1=gnome_settings_t but goes completely ignored ! If I search for "execute" or "transition" permissions using sesearch, it doesn't find anything, so for some strange reason the interface goes completely ignored ! Is that what you meant earlier ? Why is it happening ?? Regards, Guido ^ permalink raw reply [flat|nested] 73+ messages in thread
* [refpolicy] [PATCH v4] Update for the gnome policy and file contexts 2016-08-27 20:41 ` Guido Trentalancia @ 2016-08-27 20:57 ` Dominick Grift 2016-08-27 21:48 ` Guido Trentalancia 2016-08-30 19:15 ` Guido Trentalancia 0 siblings, 2 replies; 73+ messages in thread From: Dominick Grift @ 2016-08-27 20:57 UTC (permalink / raw) To: refpolicy On 08/27/2016 10:41 PM, Guido Trentalancia wrote: > On Sat, 27/08/2016 at 19.17 +0200, Dominick Grift wrote: >> On 08/27/2016 07:16 PM, Guido Trentalancia wrote: > > [...] > >>>>>> It's not so helpful unfortunately. My guess is that it is a >>>>>> conflicting >>>>>> type_transition. Unfortunately the compiler error message >>>>>> isn't >>>>>> helpful. >>>>> >>>>> I have just posted a patch on the SELinux mailing list to >>>>> produce a >>>>> more meaningful error message for conflicting type rules, see >>>>> the >>>>> following thread: >>>>> >>>>> [PATCH] libsepol: Produce more meaningful error messages for >>>>> conflicting type rules >>>>> >>>>> In this case, the conflicting type rule is: >>>>> >>>>> scontext=at_spi_t >>>>> tcontext=dbusd_exec_t >>>>> tclass=process >>>>> result=sysadm_dbusd_t >>>>> >>>>> which confirms the previous debugging results (it's the >>>>> type_transition >>>>> rule). >>>>> >>>>> Another one is similar, with scontext=gnome_settings_t. >>>>> >>>>> What I suspect is that when it compiles, it quadruplicates the >>>>> type >>>>> transition for each of user, staff, sysadm and xguest, thus >>>>> leading >>>>> to >>>>> conflicting rules. >>>>> >>>>> Therefore, the solution might be to use a common static name >>>>> for >>>>> the >>>>> domain (for example, "session_dbusd_t" instead of >>>>> "$1_dbusd_t"). >>>> >>>> and that will introduce other issues. because the session bus >>>> must be >>>> able to run things on behalf of the caller >>> >>> Thanks for providing a forecast of other issues. >>> >>> So, what's the way out of this damn loop ? >>> >>> I am almost getting lost... >>> >> >> I dont know. > > We need to find a cure for this !! I have been pleading for this for years. In my case the solution to these problems is DSSP and CIL. I was never able to solve these issues with reference policy unfortunately. > > What prevents it from running things on behalf of the caller ? And what > do you mean exactly for running things on behalf of the caller ? It hard to explain. The best way to appreciate what I mean is to experience it yourself. It will become clear as you move towards a fully confined desktop. A lot of programs can be started by the session bus. Many of these programs started by the session bus on behalf of users run other programs and so forth and so forth. Some of these programs need to eventually be able run shell with a domain transition back to the login shell domain. staff_t -> staff_dbus_t -> staff_myapp_t -> staff_t To be able to do this we need to use derived types. You can't do it if theres a single session_dbus_t type. > > I have the following interface: > > allow $1 dbusd_exec_t:file exec_file_perms; > domtrans_pattern($1, dbusd_exec_t, session_dbusd_t) > > which is called with $1=at_spi_t and $1=gnome_settings_t but goes > completely ignored ! > > If I search for "execute" or "transition" permissions using sesearch, > it doesn't find anything, so for some strange reason the interface goes > completely ignored ! > > Is that what you meant earlier ? Why is it happening ?? > > Regards, > > Guido > Maybe others know a way out. I really don't. Sorry. -- Key fingerprint = 5F4D 3CDB D3F8 3652 FBD8 02D5 3B6C 5F1D 2C7B 6B02 https://sks-keyservers.net/pks/lookup?op=get&search=0x3B6C5F1D2C7B6B02 Dominick Grift -------------- next part -------------- A non-text attachment was scrubbed... Name: signature.asc Type: application/pgp-signature Size: 648 bytes Desc: OpenPGP digital signature Url : http://oss.tresys.com/pipermail/refpolicy/attachments/20160827/ce13f8cd/attachment.bin ^ permalink raw reply [flat|nested] 73+ messages in thread
* [refpolicy] [PATCH v4] Update for the gnome policy and file contexts 2016-08-27 20:57 ` Dominick Grift @ 2016-08-27 21:48 ` Guido Trentalancia 2016-08-28 7:24 ` Dominick Grift 2016-08-30 19:15 ` Guido Trentalancia 1 sibling, 1 reply; 73+ messages in thread From: Guido Trentalancia @ 2016-08-27 21:48 UTC (permalink / raw) To: refpolicy Hello Dominick. Thanks for providing more information. On Sat, 27/08/2016 at 22.57 +0200, Dominick Grift wrote: > On 08/27/2016 10:41 PM, Guido Trentalancia wrote: > > > > On Sat, 27/08/2016 at 19.17 +0200, Dominick Grift wrote: > > > > > > On 08/27/2016 07:16 PM, Guido Trentalancia wrote: > > > > [...] > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > It's not so helpful unfortunately.??My guess is that it > > > > > > > is a > > > > > > > conflicting? > > > > > > > type_transition.??Unfortunately the compiler error > > > > > > > message > > > > > > > isn't > > > > > > > helpful. > > > > > > > > > > > > I have just posted a patch on the SELinux mailing list to > > > > > > produce a > > > > > > more meaningful error message for conflicting type rules, > > > > > > see > > > > > > the > > > > > > following thread: > > > > > > > > > > > > [PATCH] libsepol: Produce more meaningful error messages > > > > > > for > > > > > > conflicting type rules > > > > > > > > > > > > In this case, the conflicting type rule is: > > > > > > > > > > > > scontext=at_spi_t > > > > > > tcontext=dbusd_exec_t > > > > > > tclass=process > > > > > > result=sysadm_dbusd_t > > > > > > > > > > > > which confirms the previous debugging results (it's the > > > > > > type_transition > > > > > > rule). > > > > > > > > > > > > Another one is similar, with scontext=gnome_settings_t. > > > > > > > > > > > > What I suspect is that when it compiles, it quadruplicates > > > > > > the > > > > > > type > > > > > > transition for each of user, staff, sysadm and xguest, thus > > > > > > leading > > > > > > to > > > > > > conflicting rules. > > > > > > > > > > > > Therefore, the solution might be to use a common static > > > > > > name > > > > > > for > > > > > > the > > > > > > domain (for example, "session_dbusd_t" instead of > > > > > > "$1_dbusd_t"). > > > > > > > > > > and that will introduce other issues. because the session bus > > > > > must be > > > > > able to run things on behalf of the caller > > > > > > > > Thanks for providing a forecast of other issues. > > > > > > > > So, what's the way out of this damn loop ? > > > > > > > > I am almost getting lost... > > > > > > > > > > I dont know. > > > > We need to find a cure for this !! > > I have been pleading for this for years. In my case the solution to > these problems is DSSP and CIL. I was never able to solve these > issues > with reference policy unfortunately. There must be a way of solving this problem. > > What prevents it from running things on behalf of the caller ? And > > what > > do you mean exactly for running things on behalf of the caller ? > > It hard to explain. The best way to appreciate what I mean is to > experience it yourself. It will become clear as you move towards a > fully > confined desktop. > > A lot of programs can be started by the session bus. Many of these > programs started by the session bus on behalf of users run other > programs and so forth and so forth. Some of these programs need to > eventually be able run shell with a domain transition back to the > login > shell domain. > > staff_t -> staff_dbus_t -> staff_myapp_t -> staff_t > > To be able to do this we need to use derived types. You can't do it > if > theres a single session_dbus_t type. In the case at hand, there isn't the need to get back to the initial domain. If I am not wrong, the whole transition is as follows: user_t (at_spi_exec_t)-> at_spi_t (dbusd_exec_t)-> session_dbusd_t (at_spi_exec_t)-> at_spi_t The last transition is not working for some reason (I have used the new dbus interface quoted below)... > > I have the following interface: > > > > allow $1 dbusd_exec_t:file exec_file_perms; > > domtrans_pattern($1, dbusd_exec_t, session_dbusd_t) > > > > which is called with $1=at_spi_t and $1=gnome_settings_t but goes > > completely ignored ! > > > > If I search for "execute" or "transition" permissions using > > sesearch, > > it doesn't find anything, so for some strange reason the interface > > goes > > ?completely ignored ! > > > > Is that what you meant earlier ? Why is it happening ?? [...] > Maybe others know a way out. I really don't. Sorry. Don't worry about that. But with the help of others, we need to find a cure for this ! Regards, Guido ^ permalink raw reply [flat|nested] 73+ messages in thread
* [refpolicy] [PATCH v4] Update for the gnome policy and file contexts 2016-08-27 21:48 ` Guido Trentalancia @ 2016-08-28 7:24 ` Dominick Grift 2016-08-28 8:03 ` Dominick Grift 0 siblings, 1 reply; 73+ messages in thread From: Dominick Grift @ 2016-08-28 7:24 UTC (permalink / raw) To: refpolicy On 08/27/2016 11:48 PM, Guido Trentalancia via refpolicy wrote: > Hello Dominick. > > Thanks for providing more information. > > On Sat, 27/08/2016 at 22.57 +0200, Dominick Grift wrote: >> On 08/27/2016 10:41 PM, Guido Trentalancia wrote: >>> >>> On Sat, 27/08/2016 at 19.17 +0200, Dominick Grift wrote: >>>> >>>> On 08/27/2016 07:16 PM, Guido Trentalancia wrote: >>> >>> [...] >>> >>>> >>>>> >>>>>> >>>>>>> >>>>>>>> >>>>>>>> It's not so helpful unfortunately. My guess is that it >>>>>>>> is a >>>>>>>> conflicting >>>>>>>> type_transition. Unfortunately the compiler error >>>>>>>> message >>>>>>>> isn't >>>>>>>> helpful. >>>>>>> >>>>>>> I have just posted a patch on the SELinux mailing list to >>>>>>> produce a >>>>>>> more meaningful error message for conflicting type rules, >>>>>>> see >>>>>>> the >>>>>>> following thread: >>>>>>> >>>>>>> [PATCH] libsepol: Produce more meaningful error messages >>>>>>> for >>>>>>> conflicting type rules >>>>>>> >>>>>>> In this case, the conflicting type rule is: >>>>>>> >>>>>>> scontext=at_spi_t >>>>>>> tcontext=dbusd_exec_t >>>>>>> tclass=process >>>>>>> result=sysadm_dbusd_t >>>>>>> >>>>>>> which confirms the previous debugging results (it's the >>>>>>> type_transition >>>>>>> rule). >>>>>>> >>>>>>> Another one is similar, with scontext=gnome_settings_t. >>>>>>> >>>>>>> What I suspect is that when it compiles, it quadruplicates >>>>>>> the >>>>>>> type >>>>>>> transition for each of user, staff, sysadm and xguest, thus >>>>>>> leading >>>>>>> to >>>>>>> conflicting rules. >>>>>>> >>>>>>> Therefore, the solution might be to use a common static >>>>>>> name >>>>>>> for >>>>>>> the >>>>>>> domain (for example, "session_dbusd_t" instead of >>>>>>> "$1_dbusd_t"). >>>>>> >>>>>> and that will introduce other issues. because the session bus >>>>>> must be >>>>>> able to run things on behalf of the caller >>>>> >>>>> Thanks for providing a forecast of other issues. >>>>> >>>>> So, what's the way out of this damn loop ? >>>>> >>>>> I am almost getting lost... >>>>> >>>> >>>> I dont know. >>> >>> We need to find a cure for this !! >> >> I have been pleading for this for years. In my case the solution to >> these problems is DSSP and CIL. I was never able to solve these >> issues >> with reference policy unfortunately. > > There must be a way of solving this problem. > >>> What prevents it from running things on behalf of the caller ? And >>> what >>> do you mean exactly for running things on behalf of the caller ? >> >> It hard to explain. The best way to appreciate what I mean is to >> experience it yourself. It will become clear as you move towards a >> fully >> confined desktop. >> >> A lot of programs can be started by the session bus. Many of these >> programs started by the session bus on behalf of users run other >> programs and so forth and so forth. Some of these programs need to >> eventually be able run shell with a domain transition back to the >> login >> shell domain. >> >> staff_t -> staff_dbus_t -> staff_myapp_t -> staff_t >> >> To be able to do this we need to use derived types. You can't do it >> if >> theres a single session_dbus_t type. > > In the case at hand, there isn't the need to get back to the initial > domain. > > If I am not wrong, the whole transition is as follows: > > user_t (at_spi_exec_t)-> at_spi_t (dbusd_exec_t)-> session_dbusd_t > (at_spi_exec_t)-> at_spi_t > To see what i am trying to say you have to experience it for yourself. Gnome is this single body made up of individual entities. Just because atspi "may" not need to be prefixed doesnt mean that the session bus doesnt need to be prefixed. atspi isnt the only app executed by the session bus. And let me just remind you. atspi needs to be able to run the session bus if it is not currently running. Do you see the chicken and egg problem? > The last transition is not working for some reason (I have used the new > dbus interface quoted below)... > >>> I have the following interface: >>> >>> allow $1 dbusd_exec_t:file exec_file_perms; >>> domtrans_pattern($1, dbusd_exec_t, session_dbusd_t) >>> >>> which is called with $1=at_spi_t and $1=gnome_settings_t but goes >>> completely ignored ! >>> >>> If I search for "execute" or "transition" permissions using >>> sesearch, >>> it doesn't find anything, so for some strange reason the interface >>> goes >>> completely ignored ! >>> >>> Is that what you meant earlier ? Why is it happening ?? > > [...] > >> Maybe others know a way out. I really don't. Sorry. > > Don't worry about that. But with the help of others, we need to find a > cure for this ! > > Regards, > > Guido > _______________________________________________ > refpolicy mailing list > refpolicy at oss.tresys.com > http://oss.tresys.com/mailman/listinfo/refpolicy > -- Key fingerprint = 5F4D 3CDB D3F8 3652 FBD8 02D5 3B6C 5F1D 2C7B 6B02 https://sks-keyservers.net/pks/lookup?op=get&search=0x3B6C5F1D2C7B6B02 Dominick Grift -------------- next part -------------- A non-text attachment was scrubbed... Name: signature.asc Type: application/pgp-signature Size: 648 bytes Desc: OpenPGP digital signature Url : http://oss.tresys.com/pipermail/refpolicy/attachments/20160828/fa8c81c7/attachment-0001.bin ^ permalink raw reply [flat|nested] 73+ messages in thread
* [refpolicy] [PATCH v4] Update for the gnome policy and file contexts 2016-08-28 7:24 ` Dominick Grift @ 2016-08-28 8:03 ` Dominick Grift 2016-08-28 15:37 ` Guido Trentalancia 0 siblings, 1 reply; 73+ messages in thread From: Dominick Grift @ 2016-08-28 8:03 UTC (permalink / raw) To: refpolicy On 08/28/2016 09:24 AM, Dominick Grift wrote: > On 08/27/2016 11:48 PM, Guido Trentalancia via refpolicy wrote: >> Hello Dominick. >> >> Thanks for providing more information. >> >> On Sat, 27/08/2016 at 22.57 +0200, Dominick Grift wrote: >>> On 08/27/2016 10:41 PM, Guido Trentalancia wrote: >>>> >>>> On Sat, 27/08/2016 at 19.17 +0200, Dominick Grift wrote: >>>>> >>>>> On 08/27/2016 07:16 PM, Guido Trentalancia wrote: >>>> >>>> [...] >>>> >>>>> >>>>>> >>>>>>> >>>>>>>> >>>>>>>>> >>>>>>>>> It's not so helpful unfortunately. My guess is that it >>>>>>>>> is a >>>>>>>>> conflicting >>>>>>>>> type_transition. Unfortunately the compiler error >>>>>>>>> message >>>>>>>>> isn't >>>>>>>>> helpful. >>>>>>>> >>>>>>>> I have just posted a patch on the SELinux mailing list to >>>>>>>> produce a >>>>>>>> more meaningful error message for conflicting type rules, >>>>>>>> see >>>>>>>> the >>>>>>>> following thread: >>>>>>>> >>>>>>>> [PATCH] libsepol: Produce more meaningful error messages >>>>>>>> for >>>>>>>> conflicting type rules >>>>>>>> >>>>>>>> In this case, the conflicting type rule is: >>>>>>>> >>>>>>>> scontext=at_spi_t >>>>>>>> tcontext=dbusd_exec_t >>>>>>>> tclass=process >>>>>>>> result=sysadm_dbusd_t >>>>>>>> >>>>>>>> which confirms the previous debugging results (it's the >>>>>>>> type_transition >>>>>>>> rule). >>>>>>>> >>>>>>>> Another one is similar, with scontext=gnome_settings_t. >>>>>>>> >>>>>>>> What I suspect is that when it compiles, it quadruplicates >>>>>>>> the >>>>>>>> type >>>>>>>> transition for each of user, staff, sysadm and xguest, thus >>>>>>>> leading >>>>>>>> to >>>>>>>> conflicting rules. >>>>>>>> >>>>>>>> Therefore, the solution might be to use a common static >>>>>>>> name >>>>>>>> for >>>>>>>> the >>>>>>>> domain (for example, "session_dbusd_t" instead of >>>>>>>> "$1_dbusd_t"). >>>>>>> >>>>>>> and that will introduce other issues. because the session bus >>>>>>> must be >>>>>>> able to run things on behalf of the caller >>>>>> >>>>>> Thanks for providing a forecast of other issues. >>>>>> >>>>>> So, what's the way out of this damn loop ? >>>>>> >>>>>> I am almost getting lost... >>>>>> >>>>> >>>>> I dont know. >>>> >>>> We need to find a cure for this !! >>> >>> I have been pleading for this for years. In my case the solution to >>> these problems is DSSP and CIL. I was never able to solve these >>> issues >>> with reference policy unfortunately. >> >> There must be a way of solving this problem. >> >>>> What prevents it from running things on behalf of the caller ? And >>>> what >>>> do you mean exactly for running things on behalf of the caller ? >>> >>> It hard to explain. The best way to appreciate what I mean is to >>> experience it yourself. It will become clear as you move towards a >>> fully >>> confined desktop. >>> >>> A lot of programs can be started by the session bus. Many of these >>> programs started by the session bus on behalf of users run other >>> programs and so forth and so forth. Some of these programs need to >>> eventually be able run shell with a domain transition back to the >>> login >>> shell domain. >>> >>> staff_t -> staff_dbus_t -> staff_myapp_t -> staff_t >>> >>> To be able to do this we need to use derived types. You can't do it >>> if >>> theres a single session_dbus_t type. >> >> In the case at hand, there isn't the need to get back to the initial >> domain. >> >> If I am not wrong, the whole transition is as follows: >> >> user_t (at_spi_exec_t)-> at_spi_t (dbusd_exec_t)-> session_dbusd_t >> (at_spi_exec_t)-> at_spi_t >> > > To see what i am trying to say you have to experience it for yourself. > Gnome is this single body made up of individual entities. Just because > atspi "may" not need to be prefixed doesnt mean that the session bus > doesnt need to be prefixed. atspi isnt the only app executed by the > session bus. > > And let me just remind you. atspi needs to be able to run the session > bus if it is not currently running. Do you see the chicken and egg problem? > > You have to see the bigger picture. That is why i suggested you confine a minimal desktop first before you start submitting patches. Because once you have a broad overview you will see important issues that need to be resolved. You aren't able to identify them if you do not look at this as a whole. Things should just naturally work. We can't have the house of cards collapse on the first anomaly that happens. >> The last transition is not working for some reason (I have used the new >> dbus interface quoted below)... >> >>>> I have the following interface: >>>> >>>> allow $1 dbusd_exec_t:file exec_file_perms; >>>> domtrans_pattern($1, dbusd_exec_t, session_dbusd_t) >>>> >>>> which is called with $1=at_spi_t and $1=gnome_settings_t but goes >>>> completely ignored ! >>>> >>>> If I search for "execute" or "transition" permissions using >>>> sesearch, >>>> it doesn't find anything, so for some strange reason the interface >>>> goes >>>> completely ignored ! >>>> >>>> Is that what you meant earlier ? Why is it happening ?? >> >> [...] >> >>> Maybe others know a way out. I really don't. Sorry. >> >> Don't worry about that. But with the help of others, we need to find a >> cure for this ! >> >> Regards, >> >> Guido >> _______________________________________________ >> refpolicy mailing list >> refpolicy at oss.tresys.com >> http://oss.tresys.com/mailman/listinfo/refpolicy >> > > -- Key fingerprint = 5F4D 3CDB D3F8 3652 FBD8 02D5 3B6C 5F1D 2C7B 6B02 https://sks-keyservers.net/pks/lookup?op=get&search=0x3B6C5F1D2C7B6B02 Dominick Grift -------------- next part -------------- A non-text attachment was scrubbed... Name: signature.asc Type: application/pgp-signature Size: 648 bytes Desc: OpenPGP digital signature Url : http://oss.tresys.com/pipermail/refpolicy/attachments/20160828/6374cf5a/attachment.bin ^ permalink raw reply [flat|nested] 73+ messages in thread
* [refpolicy] [PATCH v4] Update for the gnome policy and file contexts 2016-08-28 8:03 ` Dominick Grift @ 2016-08-28 15:37 ` Guido Trentalancia 2016-08-28 18:40 ` Chris PeBenito 0 siblings, 1 reply; 73+ messages in thread From: Guido Trentalancia @ 2016-08-28 15:37 UTC (permalink / raw) To: refpolicy Things are very far from working naturally as they are. On the other hand, the patches are surely far from being complete or stable yet, but at least every version allows to start the Gnome desktop. Now I met this major problem, it looks by all means a limitation of the existing framework, but I am sure that it will be sorted out... I am also waiting to hear from Christopher about this. Regards, Guido On the 28th of August 2016 10:03:17 CEST, Dominick Grift via refpolicy <refpolicy@oss.tresys.com> wrote: >On 08/28/2016 09:24 AM, Dominick Grift wrote: >> On 08/27/2016 11:48 PM, Guido Trentalancia via refpolicy wrote: >>> Hello Dominick. >>> >>> Thanks for providing more information. >>> >>> On Sat, 27/08/2016 at 22.57 +0200, Dominick Grift wrote: >>>> On 08/27/2016 10:41 PM, Guido Trentalancia wrote: >>>>> >>>>> On Sat, 27/08/2016 at 19.17 +0200, Dominick Grift wrote: >>>>>> >>>>>> On 08/27/2016 07:16 PM, Guido Trentalancia wrote: >>>>> >>>>> [...] >>>>> >>>>>> >>>>>>> >>>>>>>> >>>>>>>>> >>>>>>>>>> >>>>>>>>>> It's not so helpful unfortunately. My guess is that it >>>>>>>>>> is a >>>>>>>>>> conflicting >>>>>>>>>> type_transition. Unfortunately the compiler error >>>>>>>>>> message >>>>>>>>>> isn't >>>>>>>>>> helpful. >>>>>>>>> >>>>>>>>> I have just posted a patch on the SELinux mailing list to >>>>>>>>> produce a >>>>>>>>> more meaningful error message for conflicting type rules, >>>>>>>>> see >>>>>>>>> the >>>>>>>>> following thread: >>>>>>>>> >>>>>>>>> [PATCH] libsepol: Produce more meaningful error messages >>>>>>>>> for >>>>>>>>> conflicting type rules >>>>>>>>> >>>>>>>>> In this case, the conflicting type rule is: >>>>>>>>> >>>>>>>>> scontext=at_spi_t >>>>>>>>> tcontext=dbusd_exec_t >>>>>>>>> tclass=process >>>>>>>>> result=sysadm_dbusd_t >>>>>>>>> >>>>>>>>> which confirms the previous debugging results (it's the >>>>>>>>> type_transition >>>>>>>>> rule). >>>>>>>>> >>>>>>>>> Another one is similar, with scontext=gnome_settings_t. >>>>>>>>> >>>>>>>>> What I suspect is that when it compiles, it quadruplicates >>>>>>>>> the >>>>>>>>> type >>>>>>>>> transition for each of user, staff, sysadm and xguest, thus >>>>>>>>> leading >>>>>>>>> to >>>>>>>>> conflicting rules. >>>>>>>>> >>>>>>>>> Therefore, the solution might be to use a common static >>>>>>>>> name >>>>>>>>> for >>>>>>>>> the >>>>>>>>> domain (for example, "session_dbusd_t" instead of >>>>>>>>> "$1_dbusd_t"). >>>>>>>> >>>>>>>> and that will introduce other issues. because the session bus >>>>>>>> must be >>>>>>>> able to run things on behalf of the caller >>>>>>> >>>>>>> Thanks for providing a forecast of other issues. >>>>>>> >>>>>>> So, what's the way out of this damn loop ? >>>>>>> >>>>>>> I am almost getting lost... >>>>>>> >>>>>> >>>>>> I dont know. >>>>> >>>>> We need to find a cure for this !! >>>> >>>> I have been pleading for this for years. In my case the solution to >>>> these problems is DSSP and CIL. I was never able to solve these >>>> issues >>>> with reference policy unfortunately. >>> >>> There must be a way of solving this problem. >>> >>>>> What prevents it from running things on behalf of the caller ? And >>>>> what >>>>> do you mean exactly for running things on behalf of the caller ? >>>> >>>> It hard to explain. The best way to appreciate what I mean is to >>>> experience it yourself. It will become clear as you move towards a >>>> fully >>>> confined desktop. >>>> >>>> A lot of programs can be started by the session bus. Many of these >>>> programs started by the session bus on behalf of users run other >>>> programs and so forth and so forth. Some of these programs need to >>>> eventually be able run shell with a domain transition back to the >>>> login >>>> shell domain. >>>> >>>> staff_t -> staff_dbus_t -> staff_myapp_t -> staff_t >>>> >>>> To be able to do this we need to use derived types. You can't do it >>>> if >>>> theres a single session_dbus_t type. >>> >>> In the case at hand, there isn't the need to get back to the initial >>> domain. >>> >>> If I am not wrong, the whole transition is as follows: >>> >>> user_t (at_spi_exec_t)-> at_spi_t (dbusd_exec_t)-> session_dbusd_t >>> (at_spi_exec_t)-> at_spi_t >>> >> >> To see what i am trying to say you have to experience it for >yourself. >> Gnome is this single body made up of individual entities. Just >because >> atspi "may" not need to be prefixed doesnt mean that the session bus >> doesnt need to be prefixed. atspi isnt the only app executed by the >> session bus. >> >> And let me just remind you. atspi needs to be able to run the session >> bus if it is not currently running. Do you see the chicken and egg >problem? >> >> > >You have to see the bigger picture. That is why i suggested you confine >a minimal desktop first before you start submitting patches. Because >once you have a broad overview you will see important issues that need >to be resolved. You aren't able to identify them if you do not look at >this as a whole. > >Things should just naturally work. We can't have the house of cards >collapse on the first anomaly that happens. > >>> The last transition is not working for some reason (I have used the >new >>> dbus interface quoted below)... >>> >>>>> I have the following interface: >>>>> >>>>> allow $1 dbusd_exec_t:file exec_file_perms; >>>>> domtrans_pattern($1, dbusd_exec_t, session_dbusd_t) >>>>> >>>>> which is called with $1=at_spi_t and $1=gnome_settings_t but goes >>>>> completely ignored ! >>>>> >>>>> If I search for "execute" or "transition" permissions using >>>>> sesearch, >>>>> it doesn't find anything, so for some strange reason the interface >>>>> goes >>>>> completely ignored ! >>>>> >>>>> Is that what you meant earlier ? Why is it happening ?? >>> >>> [...] >>> >>>> Maybe others know a way out. I really don't. Sorry. >>> >>> Don't worry about that. But with the help of others, we need to find >a >>> cure for this ! >>> >>> Regards, >>> >>> Guido >>> _______________________________________________ >>> refpolicy mailing list >>> refpolicy at oss.tresys.com >>> http://oss.tresys.com/mailman/listinfo/refpolicy >>> >> >> ^ permalink raw reply [flat|nested] 73+ messages in thread
* [refpolicy] [PATCH v4] Update for the gnome policy and file contexts 2016-08-28 15:37 ` Guido Trentalancia @ 2016-08-28 18:40 ` Chris PeBenito 2016-08-28 19:11 ` Guido Trentalancia ` (2 more replies) 0 siblings, 3 replies; 73+ messages in thread From: Chris PeBenito @ 2016-08-28 18:40 UTC (permalink / raw) To: refpolicy On 08/28/16 11:37, Guido Trentalancia via refpolicy wrote: > Things are very far from working naturally as they are. > > On the other hand, the patches are surely far from being complete or stable yet, but at least every version allows to start the Gnome desktop. > > Now I met this major problem, it looks by all means a limitation of the existing framework, but I am sure that it will be sorted out... > > I am also waiting to hear from Christopher about this. The way I see it is that general purpose desktops are incredibly complicated and are not designed with security in mind. I wonder if the policy complexity needed to confine it all actually buys a proportional amount of security gains. I'm not saying it shouldn't be done, but I am skeptical that it is worth it. -- Chris PeBenito ^ permalink raw reply [flat|nested] 73+ messages in thread
* [refpolicy] [PATCH v4] Update for the gnome policy and file contexts 2016-08-28 18:40 ` Chris PeBenito @ 2016-08-28 19:11 ` Guido Trentalancia 2016-08-28 19:12 ` Dominick Grift 2016-08-30 19:23 ` Guido Trentalancia 2 siblings, 0 replies; 73+ messages in thread From: Guido Trentalancia @ 2016-08-28 19:11 UTC (permalink / raw) To: refpolicy Hello Christopher! I think it's definitely worth in terms of security confining the Gnome desktop (as well as the other applications) properly. The user domain is the most common vulnerable point, so it should have the most limited number of permissions possibile. By confining the desktop properly we get great security gains exactly in that direction. Any insight on the problem that I encountered? I couldn't get things working in the dbus module with the variable $1_dbusd_t type, so I am now moving to testing with a static type instead. Best regards, Guido On the 28th of August 2016 20:40:39 CEST, Chris PeBenito <pebenito@ieee.org> wrote: >On 08/28/16 11:37, Guido Trentalancia via refpolicy wrote: >> Things are very far from working naturally as they are. >> >> On the other hand, the patches are surely far from being complete or >stable yet, but at least every version allows to start the Gnome >desktop. >> >> Now I met this major problem, it looks by all means a limitation of >the existing framework, but I am sure that it will be sorted out... >> >> I am also waiting to hear from Christopher about this. > >The way I see it is that general purpose desktops are incredibly >complicated and are not designed with security in mind. I wonder if >the >policy complexity needed to confine it all actually buys a proportional > >amount of security gains. I'm not saying it shouldn't be done, but I >am >skeptical that it is worth it. ^ permalink raw reply [flat|nested] 73+ messages in thread
* [refpolicy] [PATCH v4] Update for the gnome policy and file contexts 2016-08-28 18:40 ` Chris PeBenito 2016-08-28 19:11 ` Guido Trentalancia @ 2016-08-28 19:12 ` Dominick Grift 2016-08-29 8:20 ` Dominick Grift 2016-08-30 19:23 ` Guido Trentalancia 2 siblings, 1 reply; 73+ messages in thread From: Dominick Grift @ 2016-08-28 19:12 UTC (permalink / raw) To: refpolicy On 08/28/2016 08:40 PM, Chris PeBenito wrote: > On 08/28/16 11:37, Guido Trentalancia via refpolicy wrote: >> Things are very far from working naturally as they are. >> >> On the other hand, the patches are surely far from being complete or >> stable yet, but at least every version allows to start the Gnome desktop. >> >> Now I met this major problem, it looks by all means a limitation of >> the existing framework, but I am sure that it will be sorted out... >> >> I am also waiting to hear from Christopher about this. > > The way I see it is that general purpose desktops are incredibly > complicated and are not designed with security in mind. I wonder if the > policy complexity needed to confine it all actually buys a proportional > amount of security gains. I'm not saying it shouldn't be done, but I am > skeptical that it is worth it. > It is expensive. I agree, but i would not go so far as to say that confining the desktop does not buy a proportional amount of security gains. It is telling though that you're not the only authority saying that using selinux to confine the desktop is not practical (Walsh shares your opinion). Anyhow DSSP fills a gap here. So if you value integrity on the desktop DSSP is be happy to take contributions :) -- Key fingerprint = 5F4D 3CDB D3F8 3652 FBD8 02D5 3B6C 5F1D 2C7B 6B02 https://sks-keyservers.net/pks/lookup?op=get&search=0x3B6C5F1D2C7B6B02 Dominick Grift -------------- next part -------------- A non-text attachment was scrubbed... Name: signature.asc Type: application/pgp-signature Size: 648 bytes Desc: OpenPGP digital signature Url : http://oss.tresys.com/pipermail/refpolicy/attachments/20160828/376db0aa/attachment.bin ^ permalink raw reply [flat|nested] 73+ messages in thread
* [refpolicy] [PATCH v4] Update for the gnome policy and file contexts 2016-08-28 19:12 ` Dominick Grift @ 2016-08-29 8:20 ` Dominick Grift 2016-08-29 17:45 ` Naftuli Tzvi Kay 0 siblings, 1 reply; 73+ messages in thread From: Dominick Grift @ 2016-08-29 8:20 UTC (permalink / raw) To: refpolicy On 08/28/2016 09:12 PM, Dominick Grift wrote: > On 08/28/2016 08:40 PM, Chris PeBenito wrote: >> On 08/28/16 11:37, Guido Trentalancia via refpolicy wrote: >>> Things are very far from working naturally as they are. >>> >>> On the other hand, the patches are surely far from being complete or >>> stable yet, but at least every version allows to start the Gnome desktop. >>> >>> Now I met this major problem, it looks by all means a limitation of >>> the existing framework, but I am sure that it will be sorted out... >>> >>> I am also waiting to hear from Christopher about this. >> >> The way I see it is that general purpose desktops are incredibly >> complicated and are not designed with security in mind. I wonder if the >> policy complexity needed to confine it all actually buys a proportional >> amount of security gains. I'm not saying it shouldn't be done, but I am >> skeptical that it is worth it. >> > > It is expensive. I agree, but i would not go so far as to say that > confining the desktop does not buy a proportional amount of security gains. > > It is telling though that you're not the only authority saying that > using selinux to confine the desktop is not practical (Walsh shares your > opinion). > > Anyhow DSSP fills a gap here. So if you value integrity on the desktop > DSSP is be happy to take contributions :) > SELinux is a flexible MAC, and it is designed to be a framework to address the widest range of access control challenges. It is THE tool for this job. Were talking Access Control, this is not just about containing flawed or malicious code. We use access control to govern who can do what as well. I will be the first to agree that desktops aren't designed with security in mind. That is one of the reasons we need to contain it. Some of the code in there looks downright disturbing. My shell is "fragile" I will be the first to admit. But at least I have an excuse (dropped out of kindergarten), plus i know its "fragile" and so i contain my own code. SELinux is not "practical" at all (until its is the only tool left capable enough to do the job). Desktop or not. Ask 10 random people, and I am willing to bet that at least 8 of them agree. Heck security is not practical! Our identities. passwords and other authentication credentials are pretty much all we have on this network called Internet. We should do all we can to protect it. On a desktop, the desktop is generally the most vulnerable. Yes we need to contain the system side as well, but A desktop generally has much less of that compared to a server. -- Key fingerprint = 5F4D 3CDB D3F8 3652 FBD8 02D5 3B6C 5F1D 2C7B 6B02 https://sks-keyservers.net/pks/lookup?op=get&search=0x3B6C5F1D2C7B6B02 Dominick Grift -------------- next part -------------- A non-text attachment was scrubbed... Name: signature.asc Type: application/pgp-signature Size: 648 bytes Desc: OpenPGP digital signature Url : http://oss.tresys.com/pipermail/refpolicy/attachments/20160829/a9e0bfcb/attachment.bin ^ permalink raw reply [flat|nested] 73+ messages in thread
* [refpolicy] [PATCH v4] Update for the gnome policy and file contexts 2016-08-29 8:20 ` Dominick Grift @ 2016-08-29 17:45 ` Naftuli Tzvi Kay 0 siblings, 0 replies; 73+ messages in thread From: Naftuli Tzvi Kay @ 2016-08-29 17:45 UTC (permalink / raw) To: refpolicy @Dominick, absolutely. I was really upset (to put it lightly) to find out that Fedora 24 doesn't confine Google Chrome any more, which is completely unacceptable. I might become a contributor to DSSP for this reason. Thanks, - Naftuli Tzvi On Mon, Aug 29, 2016 at 1:20 AM, Dominick Grift via refpolicy <refpolicy@oss.tresys.com> wrote: > On 08/28/2016 09:12 PM, Dominick Grift wrote: >> On 08/28/2016 08:40 PM, Chris PeBenito wrote: >>> On 08/28/16 11:37, Guido Trentalancia via refpolicy wrote: >>>> Things are very far from working naturally as they are. >>>> >>>> On the other hand, the patches are surely far from being complete or >>>> stable yet, but at least every version allows to start the Gnome desktop. >>>> >>>> Now I met this major problem, it looks by all means a limitation of >>>> the existing framework, but I am sure that it will be sorted out... >>>> >>>> I am also waiting to hear from Christopher about this. >>> >>> The way I see it is that general purpose desktops are incredibly >>> complicated and are not designed with security in mind. I wonder if the >>> policy complexity needed to confine it all actually buys a proportional >>> amount of security gains. I'm not saying it shouldn't be done, but I am >>> skeptical that it is worth it. >>> >> >> It is expensive. I agree, but i would not go so far as to say that >> confining the desktop does not buy a proportional amount of security gains. >> >> It is telling though that you're not the only authority saying that >> using selinux to confine the desktop is not practical (Walsh shares your >> opinion). >> >> Anyhow DSSP fills a gap here. So if you value integrity on the desktop >> DSSP is be happy to take contributions :) >> > > SELinux is a flexible MAC, and it is designed to be a framework to > address the widest range of access control challenges. It is THE tool > for this job. > > Were talking Access Control, this is not just about containing flawed or > malicious code. We use access control to govern who can do what as well. > > I will be the first to agree that desktops aren't designed with security > in mind. That is one of the reasons we need to contain it. Some of the > code in there looks downright disturbing. > > My shell is "fragile" I will be the first to admit. But at least I have > an excuse (dropped out of kindergarten), plus i know its "fragile" and > so i contain my own code. > > SELinux is not "practical" at all (until its is the only tool left > capable enough to do the job). Desktop or not. Ask 10 random people, and > I am willing to bet that at least 8 of them agree. Heck security is not > practical! > > Our identities. passwords and other authentication credentials are > pretty much all we have on this network called Internet. We should do > all we can to protect it. > > On a desktop, the desktop is generally the most vulnerable. > Yes we need to contain the system side as well, but A desktop generally > has much less of that compared to a server. > > > > > -- > Key fingerprint = 5F4D 3CDB D3F8 3652 FBD8 02D5 3B6C 5F1D 2C7B 6B02 > https://sks-keyservers.net/pks/lookup?op=get&search=0x3B6C5F1D2C7B6B02 > Dominick Grift > > > _______________________________________________ > refpolicy mailing list > refpolicy at oss.tresys.com > http://oss.tresys.com/mailman/listinfo/refpolicy > ^ permalink raw reply [flat|nested] 73+ messages in thread
* [refpolicy] [PATCH v4] Update for the gnome policy and file contexts 2016-08-28 18:40 ` Chris PeBenito 2016-08-28 19:11 ` Guido Trentalancia 2016-08-28 19:12 ` Dominick Grift @ 2016-08-30 19:23 ` Guido Trentalancia 2016-08-30 21:37 ` Chris PeBenito 2 siblings, 1 reply; 73+ messages in thread From: Guido Trentalancia @ 2016-08-30 19:23 UTC (permalink / raw) To: refpolicy Hello Christopher. On Sun, 28/08/2016 at 14.40 -0400, Chris PeBenito wrote: > On 08/28/16 11:37, Guido Trentalancia via refpolicy wrote: > > > > Things are very far from working naturally as they are. > > > > On the other hand, the patches are surely far from being complete > > or stable yet, but at least every version allows to start the Gnome > > desktop. > > > > Now I met this major problem, it looks by all means a limitation of > > the existing framework, but I am sure that it will be sorted out... > > > > I am also waiting to hear from Christopher about this. > > The way I see it is that general purpose desktops are incredibly? > complicated and are not designed with security in mind.??I wonder if > the? > policy complexity needed to confine it all actually buys a > proportional? > amount of security gains.??I'm not saying it shouldn't be done, but I > am? > skeptical that it is worth it. Apart from confining the whole desktop, what I recently proposed to Dominick for further evaluation is as follows: - we patch the libsepol code so that it creates all the conflicting type rules instead of aborting; - we also patch the policy enforcing code, so that when it needs to enforce one of such conflicting type rules, it first searches for duplicates and then it enforces the one that matches the calling context. Do you think the above is feasible (in particular, "matching the calling context") ? Best regards, Guido ^ permalink raw reply [flat|nested] 73+ messages in thread
* [refpolicy] [PATCH v4] Update for the gnome policy and file contexts 2016-08-30 19:23 ` Guido Trentalancia @ 2016-08-30 21:37 ` Chris PeBenito 2016-08-30 21:46 ` Guido Trentalancia 0 siblings, 1 reply; 73+ messages in thread From: Chris PeBenito @ 2016-08-30 21:37 UTC (permalink / raw) To: refpolicy On 08/30/16 15:23, Guido Trentalancia wrote: > Hello Christopher. > > On Sun, 28/08/2016 at 14.40 -0400, Chris PeBenito wrote: >> On 08/28/16 11:37, Guido Trentalancia via refpolicy wrote: >>> >>> Things are very far from working naturally as they are. >>> >>> On the other hand, the patches are surely far from being complete >>> or stable yet, but at least every version allows to start the Gnome >>> desktop. >>> >>> Now I met this major problem, it looks by all means a limitation of >>> the existing framework, but I am sure that it will be sorted out... >>> >>> I am also waiting to hear from Christopher about this. >> >> The way I see it is that general purpose desktops are incredibly >> complicated and are not designed with security in mind. I wonder if >> the >> policy complexity needed to confine it all actually buys a >> proportional >> amount of security gains. I'm not saying it shouldn't be done, but I >> am >> skeptical that it is worth it. > > Apart from confining the whole desktop, what I recently proposed to > Dominick for further evaluation is as follows: > > - we patch the libsepol code so that it creates all the conflicting > type rules instead of aborting; > - we also patch the policy enforcing code, so that when it needs to > enforce one of such conflicting type rules, it first searches for > duplicates and then it enforces the one that matches the calling > context. > > Do you think the above is feasible (in particular, "matching the > calling context") ? I don't know what you mean by "matching the calling context." A conflicting type transition looks like this: type_transition source_type exec_type:process new_domain; type_transition source_type exec_type:process other_new_domain; I don't see how you can decide between the two if they both exist in the policy (unless they are in opposite if/else blocks, which is valid). -- Chris PeBenito ^ permalink raw reply [flat|nested] 73+ messages in thread
* [refpolicy] [PATCH v4] Update for the gnome policy and file contexts 2016-08-30 21:37 ` Chris PeBenito @ 2016-08-30 21:46 ` Guido Trentalancia 0 siblings, 0 replies; 73+ messages in thread From: Guido Trentalancia @ 2016-08-30 21:46 UTC (permalink / raw) To: refpolicy On Tue, 30/08/2016 at 17.37 -0400, Chris PeBenito wrote: > On 08/30/16 15:23, Guido Trentalancia wrote: > > > > Hello Christopher. > > > > On Sun, 28/08/2016 at 14.40 -0400, Chris PeBenito wrote: > > > > > > On 08/28/16 11:37, Guido Trentalancia via refpolicy wrote: > > > > > > > > > > > > Things are very far from working naturally as they are. > > > > > > > > On the other hand, the patches are surely far from being > > > > complete > > > > or stable yet, but at least every version allows to start the > > > > Gnome > > > > desktop. > > > > > > > > Now I met this major problem, it looks by all means a > > > > limitation of > > > > the existing framework, but I am sure that it will be sorted > > > > out... > > > > > > > > I am also waiting to hear from Christopher about this. > > > > > > The way I see it is that general purpose desktops are incredibly > > > complicated and are not designed with security in mind.??I wonder > > > if > > > the > > > policy complexity needed to confine it all actually buys a > > > proportional > > > amount of security gains.??I'm not saying it shouldn't be done, > > > but I > > > am > > > skeptical that it is worth it. > > > > Apart from confining the whole desktop, what I recently proposed to > > Dominick for further evaluation is as follows: > > > > - we patch the libsepol code so that it creates all the conflicting > > type rules instead of aborting; > > - we also patch the policy enforcing code, so that when it needs to > > enforce one of such conflicting type rules, it first searches for > > duplicates and then it enforces the one that matches the calling > > context. > > > > Do you think the above is feasible (in particular, "matching the > > calling context") ? > > I don't know what you mean by "matching the calling context."??A? > conflicting type transition looks like this: > > type_transition source_type exec_type:process new_domain; > type_transition source_type exec_type:process other_new_domain; > > I don't see how you can decide between the two if they both exist in > the? > policy (unless they are in opposite if/else blocks, which is valid). type_transition session_dbusd_t bin_t:process user_t; type_transition session_dbusd_t bin_t:process staff_t; type_transition session_dbusd_t bin_t:process sysadm_t; type_transition session_dbusd_t bin_t:process xguest_t; At the moment, they cannot coexist (conflicting type rules). Imagine that we insert all of them into the policy. The process that is running as session_dbusd_t (the source) is actually classified as user_u:user_r:session_dbusd_t (or equivalently for the other three possible cases). So, for the case at hand, we know that the first rule should be considered for such process: we enforce: type_transition session_dbusd_t bin_t:process user_t; Theoretically, we can select the correct rule for each calling process by looking at the full context of such process. Am I missing something ? Regards, Guido ^ permalink raw reply [flat|nested] 73+ messages in thread
* [refpolicy] [PATCH v4] Update for the gnome policy and file contexts 2016-08-27 20:57 ` Dominick Grift 2016-08-27 21:48 ` Guido Trentalancia @ 2016-08-30 19:15 ` Guido Trentalancia 2016-08-30 19:21 ` Dominick Grift 1 sibling, 1 reply; 73+ messages in thread From: Guido Trentalancia @ 2016-08-30 19:15 UTC (permalink / raw) To: refpolicy Hello Dominick. On Sat, 27/08/2016 at 22.57 +0200, Dominick Grift wrote: > On 08/27/2016 10:41 PM, Guido Trentalancia wrote: > > > > On Sat, 27/08/2016 at 19.17 +0200, Dominick Grift wrote: > > > > > > On 08/27/2016 07:16 PM, Guido Trentalancia wrote: > > > > [...] > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > It's not so helpful unfortunately.??My guess is that it > > > > > > > is a > > > > > > > conflicting? > > > > > > > type_transition.??Unfortunately the compiler error > > > > > > > message > > > > > > > isn't > > > > > > > helpful. > > > > > > > > > > > > I have just posted a patch on the SELinux mailing list to > > > > > > produce a > > > > > > more meaningful error message for conflicting type rules, > > > > > > see > > > > > > the > > > > > > following thread: > > > > > > > > > > > > [PATCH] libsepol: Produce more meaningful error messages > > > > > > for > > > > > > conflicting type rules > > > > > > > > > > > > In this case, the conflicting type rule is: > > > > > > > > > > > > scontext=at_spi_t > > > > > > tcontext=dbusd_exec_t > > > > > > tclass=process > > > > > > result=sysadm_dbusd_t > > > > > > > > > > > > which confirms the previous debugging results (it's the > > > > > > type_transition > > > > > > rule). > > > > > > > > > > > > Another one is similar, with scontext=gnome_settings_t. > > > > > > > > > > > > What I suspect is that when it compiles, it quadruplicates > > > > > > the > > > > > > type > > > > > > transition for each of user, staff, sysadm and xguest, thus > > > > > > leading > > > > > > to > > > > > > conflicting rules. > > > > > > > > > > > > Therefore, the solution might be to use a common static > > > > > > name > > > > > > for > > > > > > the > > > > > > domain (for example, "session_dbusd_t" instead of > > > > > > "$1_dbusd_t"). > > > > > > > > > > and that will introduce other issues. because the session bus > > > > > must be > > > > > able to run things on behalf of the caller > > > > > > > > Thanks for providing a forecast of other issues. > > > > > > > > So, what's the way out of this damn loop ? > > > > > > > > I am almost getting lost... > > > > > > > > > > I dont know. > > > > We need to find a cure for this !! > > I have been pleading for this for years. In my case the solution to > these problems is DSSP and CIL. I was never able to solve these > issues > with reference policy unfortunately. > > > > > > > What prevents it from running things on behalf of the caller ? And > > what > > do you mean exactly for running things on behalf of the caller ? > > It hard to explain. The best way to appreciate what I mean is to > experience it yourself. It will become clear as you move towards a > fully > confined desktop. > > A lot of programs can be started by the session bus. Many of these > programs started by the session bus on behalf of users run other > programs and so forth and so forth. Some of these programs need to > eventually be able run shell with a domain transition back to the > login > shell domain. > > staff_t -> staff_dbus_t -> staff_myapp_t -> staff_t > > To be able to do this we need to use derived types. You can't do it > if > theres a single session_dbus_t type. I am hitting a similar situation at the moment with the modified gnome and dbus modules... user_t -> session_dbusd_t -> cannot execute bin_t or shell in the user_t domain Perhaps, it is possible to change the existing code so that it adds the conflicting type rules, but then when it actually needs to apply them, it looks up for duplicates and it only applies the one which matches the calling context. It should be feasible... What do you say ? We need to find a way out of this ! Best regards, Guido ^ permalink raw reply [flat|nested] 73+ messages in thread
* [refpolicy] [PATCH v4] Update for the gnome policy and file contexts 2016-08-30 19:15 ` Guido Trentalancia @ 2016-08-30 19:21 ` Dominick Grift 2016-08-30 21:39 ` Chris PeBenito 0 siblings, 1 reply; 73+ messages in thread From: Dominick Grift @ 2016-08-30 19:21 UTC (permalink / raw) To: refpolicy On 08/30/2016 09:15 PM, Guido Trentalancia wrote: > Hello Dominick. > > On Sat, 27/08/2016 at 22.57 +0200, Dominick Grift wrote: >> On 08/27/2016 10:41 PM, Guido Trentalancia wrote: >>> >>> On Sat, 27/08/2016 at 19.17 +0200, Dominick Grift wrote: >>>> >>>> On 08/27/2016 07:16 PM, Guido Trentalancia wrote: >>> >>> [...] >>> >>>> >>>>> >>>>>> >>>>>>> >>>>>>>> >>>>>>>> It's not so helpful unfortunately. My guess is that it >>>>>>>> is a >>>>>>>> conflicting >>>>>>>> type_transition. Unfortunately the compiler error >>>>>>>> message >>>>>>>> isn't >>>>>>>> helpful. >>>>>>> >>>>>>> I have just posted a patch on the SELinux mailing list to >>>>>>> produce a >>>>>>> more meaningful error message for conflicting type rules, >>>>>>> see >>>>>>> the >>>>>>> following thread: >>>>>>> >>>>>>> [PATCH] libsepol: Produce more meaningful error messages >>>>>>> for >>>>>>> conflicting type rules >>>>>>> >>>>>>> In this case, the conflicting type rule is: >>>>>>> >>>>>>> scontext=at_spi_t >>>>>>> tcontext=dbusd_exec_t >>>>>>> tclass=process >>>>>>> result=sysadm_dbusd_t >>>>>>> >>>>>>> which confirms the previous debugging results (it's the >>>>>>> type_transition >>>>>>> rule). >>>>>>> >>>>>>> Another one is similar, with scontext=gnome_settings_t. >>>>>>> >>>>>>> What I suspect is that when it compiles, it quadruplicates >>>>>>> the >>>>>>> type >>>>>>> transition for each of user, staff, sysadm and xguest, thus >>>>>>> leading >>>>>>> to >>>>>>> conflicting rules. >>>>>>> >>>>>>> Therefore, the solution might be to use a common static >>>>>>> name >>>>>>> for >>>>>>> the >>>>>>> domain (for example, "session_dbusd_t" instead of >>>>>>> "$1_dbusd_t"). >>>>>> >>>>>> and that will introduce other issues. because the session bus >>>>>> must be >>>>>> able to run things on behalf of the caller >>>>> >>>>> Thanks for providing a forecast of other issues. >>>>> >>>>> So, what's the way out of this damn loop ? >>>>> >>>>> I am almost getting lost... >>>>> >>>> >>>> I dont know. >>> >>> We need to find a cure for this !! >> >> I have been pleading for this for years. In my case the solution to >> these problems is DSSP and CIL. I was never able to solve these >> issues >> with reference policy unfortunately. >> >>> >>> >>> What prevents it from running things on behalf of the caller ? And >>> what >>> do you mean exactly for running things on behalf of the caller ? >> >> It hard to explain. The best way to appreciate what I mean is to >> experience it yourself. It will become clear as you move towards a >> fully >> confined desktop. >> >> A lot of programs can be started by the session bus. Many of these >> programs started by the session bus on behalf of users run other >> programs and so forth and so forth. Some of these programs need to >> eventually be able run shell with a domain transition back to the >> login >> shell domain. >> >> staff_t -> staff_dbus_t -> staff_myapp_t -> staff_t >> >> To be able to do this we need to use derived types. You can't do it >> if >> theres a single session_dbus_t type. > > I am hitting a similar situation at the moment with the modified gnome > and dbus modules... > > user_t -> session_dbusd_t -> cannot execute bin_t or shell in the > user_t domain > > Perhaps, it is possible to change the existing code so that it adds the > conflicting type rules, but then when it actually needs to apply them, > it looks up for duplicates and it only applies the one which matches > the calling context. > > It should be feasible... > > What do you say ? > I am saying what I said. This issue is very old and no one ever bothered to fix it. It is not going to happen. Module policy is legacy. A new superior language that does not have these issues is available. > We need to find a way out of this ! There is a way out but its not module policy > > Best regards, > > Guido > -- Key fingerprint = 5F4D 3CDB D3F8 3652 FBD8 02D5 3B6C 5F1D 2C7B 6B02 https://sks-keyservers.net/pks/lookup?op=get&search=0x3B6C5F1D2C7B6B02 Dominick Grift -------------- next part -------------- A non-text attachment was scrubbed... Name: signature.asc Type: application/pgp-signature Size: 648 bytes Desc: OpenPGP digital signature Url : http://oss.tresys.com/pipermail/refpolicy/attachments/20160830/c9528686/attachment-0001.bin ^ permalink raw reply [flat|nested] 73+ messages in thread
* [refpolicy] [PATCH v4] Update for the gnome policy and file contexts 2016-08-30 19:21 ` Dominick Grift @ 2016-08-30 21:39 ` Chris PeBenito 2016-08-31 6:55 ` Dominick Grift 0 siblings, 1 reply; 73+ messages in thread From: Chris PeBenito @ 2016-08-30 21:39 UTC (permalink / raw) To: refpolicy On 08/30/16 15:21, Dominick Grift via refpolicy wrote: > On 08/30/2016 09:15 PM, Guido Trentalancia wrote: >> Hello Dominick. >> >> On Sat, 27/08/2016 at 22.57 +0200, Dominick Grift wrote: >>> On 08/27/2016 10:41 PM, Guido Trentalancia wrote: >>>> >>>> On Sat, 27/08/2016 at 19.17 +0200, Dominick Grift wrote: >>>>> >>>>> On 08/27/2016 07:16 PM, Guido Trentalancia wrote: >>>> >>>> [...] >>>> >>>>> >>>>>> >>>>>>> >>>>>>>> >>>>>>>>> >>>>>>>>> It's not so helpful unfortunately. My guess is that it >>>>>>>>> is a >>>>>>>>> conflicting >>>>>>>>> type_transition. Unfortunately the compiler error >>>>>>>>> message >>>>>>>>> isn't >>>>>>>>> helpful. >>>>>>>> >>>>>>>> I have just posted a patch on the SELinux mailing list to >>>>>>>> produce a >>>>>>>> more meaningful error message for conflicting type rules, >>>>>>>> see >>>>>>>> the >>>>>>>> following thread: >>>>>>>> >>>>>>>> [PATCH] libsepol: Produce more meaningful error messages >>>>>>>> for >>>>>>>> conflicting type rules >>>>>>>> >>>>>>>> In this case, the conflicting type rule is: >>>>>>>> >>>>>>>> scontext=at_spi_t >>>>>>>> tcontext=dbusd_exec_t >>>>>>>> tclass=process >>>>>>>> result=sysadm_dbusd_t >>>>>>>> >>>>>>>> which confirms the previous debugging results (it's the >>>>>>>> type_transition >>>>>>>> rule). >>>>>>>> >>>>>>>> Another one is similar, with scontext=gnome_settings_t. >>>>>>>> >>>>>>>> What I suspect is that when it compiles, it quadruplicates >>>>>>>> the >>>>>>>> type >>>>>>>> transition for each of user, staff, sysadm and xguest, thus >>>>>>>> leading >>>>>>>> to >>>>>>>> conflicting rules. >>>>>>>> >>>>>>>> Therefore, the solution might be to use a common static >>>>>>>> name >>>>>>>> for >>>>>>>> the >>>>>>>> domain (for example, "session_dbusd_t" instead of >>>>>>>> "$1_dbusd_t"). >>>>>>> >>>>>>> and that will introduce other issues. because the session bus >>>>>>> must be >>>>>>> able to run things on behalf of the caller >>>>>> >>>>>> Thanks for providing a forecast of other issues. >>>>>> >>>>>> So, what's the way out of this damn loop ? >>>>>> >>>>>> I am almost getting lost... >>>>>> >>>>> >>>>> I dont know. >>>> >>>> We need to find a cure for this !! >>> >>> I have been pleading for this for years. In my case the solution to >>> these problems is DSSP and CIL. I was never able to solve these >>> issues >>> with reference policy unfortunately. >>> >>>> >>>> >>>> What prevents it from running things on behalf of the caller ? And >>>> what >>>> do you mean exactly for running things on behalf of the caller ? >>> >>> It hard to explain. The best way to appreciate what I mean is to >>> experience it yourself. It will become clear as you move towards a >>> fully >>> confined desktop. >>> >>> A lot of programs can be started by the session bus. Many of these >>> programs started by the session bus on behalf of users run other >>> programs and so forth and so forth. Some of these programs need to >>> eventually be able run shell with a domain transition back to the >>> login >>> shell domain. >>> >>> staff_t -> staff_dbus_t -> staff_myapp_t -> staff_t >>> >>> To be able to do this we need to use derived types. You can't do it >>> if >>> theres a single session_dbus_t type. >> >> I am hitting a similar situation at the moment with the modified gnome >> and dbus modules... >> >> user_t -> session_dbusd_t -> cannot execute bin_t or shell in the >> user_t domain >> >> Perhaps, it is possible to change the existing code so that it adds the >> conflicting type rules, but then when it actually needs to apply them, >> it looks up for duplicates and it only applies the one which matches >> the calling context. >> >> It should be feasible... >> >> What do you say ? >> > > I am saying what I said. This issue is very old and no one ever bothered > to fix it. It is not going to happen. > > Module policy is legacy. A new superior language that does not have > these issues is available. > >> We need to find a way out of this ! > > There is a way out but its not module policy Perhaps you can structure the policy better, but a conflicting type transition is an error even if is written in CIL. -- Chris PeBenito ^ permalink raw reply [flat|nested] 73+ messages in thread
* [refpolicy] [PATCH v4] Update for the gnome policy and file contexts 2016-08-30 21:39 ` Chris PeBenito @ 2016-08-31 6:55 ` Dominick Grift 2016-08-31 7:31 ` Dominick Grift 0 siblings, 1 reply; 73+ messages in thread From: Dominick Grift @ 2016-08-31 6:55 UTC (permalink / raw) To: refpolicy On 08/30/2016 11:39 PM, Chris PeBenito wrote: > On 08/30/16 15:21, Dominick Grift via refpolicy wrote: >> On 08/30/2016 09:15 PM, Guido Trentalancia wrote: >>> Hello Dominick. >>> >>> On Sat, 27/08/2016 at 22.57 +0200, Dominick Grift wrote: >>>> On 08/27/2016 10:41 PM, Guido Trentalancia wrote: >>>>> >>>>> On Sat, 27/08/2016 at 19.17 +0200, Dominick Grift wrote: >>>>>> >>>>>> On 08/27/2016 07:16 PM, Guido Trentalancia wrote: >>>>> >>>>> [...] >>>>> >>>>>> >>>>>>> >>>>>>>> >>>>>>>>> >>>>>>>>>> >>>>>>>>>> It's not so helpful unfortunately. My guess is that it >>>>>>>>>> is a >>>>>>>>>> conflicting >>>>>>>>>> type_transition. Unfortunately the compiler error >>>>>>>>>> message >>>>>>>>>> isn't >>>>>>>>>> helpful. >>>>>>>>> >>>>>>>>> I have just posted a patch on the SELinux mailing list to >>>>>>>>> produce a >>>>>>>>> more meaningful error message for conflicting type rules, >>>>>>>>> see >>>>>>>>> the >>>>>>>>> following thread: >>>>>>>>> >>>>>>>>> [PATCH] libsepol: Produce more meaningful error messages >>>>>>>>> for >>>>>>>>> conflicting type rules >>>>>>>>> >>>>>>>>> In this case, the conflicting type rule is: >>>>>>>>> >>>>>>>>> scontext=at_spi_t >>>>>>>>> tcontext=dbusd_exec_t >>>>>>>>> tclass=process >>>>>>>>> result=sysadm_dbusd_t >>>>>>>>> >>>>>>>>> which confirms the previous debugging results (it's the >>>>>>>>> type_transition >>>>>>>>> rule). >>>>>>>>> >>>>>>>>> Another one is similar, with scontext=gnome_settings_t. >>>>>>>>> >>>>>>>>> What I suspect is that when it compiles, it quadruplicates >>>>>>>>> the >>>>>>>>> type >>>>>>>>> transition for each of user, staff, sysadm and xguest, thus >>>>>>>>> leading >>>>>>>>> to >>>>>>>>> conflicting rules. >>>>>>>>> >>>>>>>>> Therefore, the solution might be to use a common static >>>>>>>>> name >>>>>>>>> for >>>>>>>>> the >>>>>>>>> domain (for example, "session_dbusd_t" instead of >>>>>>>>> "$1_dbusd_t"). >>>>>>>> >>>>>>>> and that will introduce other issues. because the session bus >>>>>>>> must be >>>>>>>> able to run things on behalf of the caller >>>>>>> >>>>>>> Thanks for providing a forecast of other issues. >>>>>>> >>>>>>> So, what's the way out of this damn loop ? >>>>>>> >>>>>>> I am almost getting lost... >>>>>>> >>>>>> >>>>>> I dont know. >>>>> >>>>> We need to find a cure for this !! >>>> >>>> I have been pleading for this for years. In my case the solution to >>>> these problems is DSSP and CIL. I was never able to solve these >>>> issues >>>> with reference policy unfortunately. >>>> >>>>> >>>>> >>>>> What prevents it from running things on behalf of the caller ? And >>>>> what >>>>> do you mean exactly for running things on behalf of the caller ? >>>> >>>> It hard to explain. The best way to appreciate what I mean is to >>>> experience it yourself. It will become clear as you move towards a >>>> fully >>>> confined desktop. >>>> >>>> A lot of programs can be started by the session bus. Many of these >>>> programs started by the session bus on behalf of users run other >>>> programs and so forth and so forth. Some of these programs need to >>>> eventually be able run shell with a domain transition back to the >>>> login >>>> shell domain. >>>> >>>> staff_t -> staff_dbus_t -> staff_myapp_t -> staff_t >>>> >>>> To be able to do this we need to use derived types. You can't do it >>>> if >>>> theres a single session_dbus_t type. >>> >>> I am hitting a similar situation at the moment with the modified gnome >>> and dbus modules... >>> >>> user_t -> session_dbusd_t -> cannot execute bin_t or shell in the >>> user_t domain >>> >>> Perhaps, it is possible to change the existing code so that it adds the >>> conflicting type rules, but then when it actually needs to apply them, >>> it looks up for duplicates and it only applies the one which matches >>> the calling context. >>> >>> It should be feasible... >>> >>> What do you say ? >>> >> >> I am saying what I said. This issue is very old and no one ever bothered >> to fix it. It is not going to happen. >> >> Module policy is legacy. A new superior language that does not have >> these issues is available. >> >>> We need to find a way out of this ! >> >> There is a way out but its not module policy > > Perhaps you can structure the policy better, but a conflicting type > transition is an error even if is written in CIL. > > Sure. That is true. Maybe the ability to structure your policy better makes a big difference, aside from having the luxury of more meaningful compiler errors and warnings. -- Key fingerprint = 5F4D 3CDB D3F8 3652 FBD8 02D5 3B6C 5F1D 2C7B 6B02 https://sks-keyservers.net/pks/lookup?op=get&search=0x3B6C5F1D2C7B6B02 Dominick Grift -------------- next part -------------- A non-text attachment was scrubbed... Name: signature.asc Type: application/pgp-signature Size: 648 bytes Desc: OpenPGP digital signature Url : http://oss.tresys.com/pipermail/refpolicy/attachments/20160831/f4aabd70/attachment-0001.bin ^ permalink raw reply [flat|nested] 73+ messages in thread
* [refpolicy] [PATCH v4] Update for the gnome policy and file contexts 2016-08-31 6:55 ` Dominick Grift @ 2016-08-31 7:31 ` Dominick Grift 0 siblings, 0 replies; 73+ messages in thread From: Dominick Grift @ 2016-08-31 7:31 UTC (permalink / raw) To: refpolicy On 08/31/2016 08:55 AM, Dominick Grift wrote: > On 08/30/2016 11:39 PM, Chris PeBenito wrote: >> On 08/30/16 15:21, Dominick Grift via refpolicy wrote: >>> On 08/30/2016 09:15 PM, Guido Trentalancia wrote: >>>> Hello Dominick. >>>> >>>> On Sat, 27/08/2016 at 22.57 +0200, Dominick Grift wrote: >>>>> On 08/27/2016 10:41 PM, Guido Trentalancia wrote: >>>>>> >>>>>> On Sat, 27/08/2016 at 19.17 +0200, Dominick Grift wrote: >>>>>>> >>>>>>> On 08/27/2016 07:16 PM, Guido Trentalancia wrote: >>>>>> >>>>>> [...] >>>>>> >>>>>>> >>>>>>>> >>>>>>>>> >>>>>>>>>> >>>>>>>>>>> >>>>>>>>>>> It's not so helpful unfortunately. My guess is that it >>>>>>>>>>> is a >>>>>>>>>>> conflicting >>>>>>>>>>> type_transition. Unfortunately the compiler error >>>>>>>>>>> message >>>>>>>>>>> isn't >>>>>>>>>>> helpful. >>>>>>>>>> >>>>>>>>>> I have just posted a patch on the SELinux mailing list to >>>>>>>>>> produce a >>>>>>>>>> more meaningful error message for conflicting type rules, >>>>>>>>>> see >>>>>>>>>> the >>>>>>>>>> following thread: >>>>>>>>>> >>>>>>>>>> [PATCH] libsepol: Produce more meaningful error messages >>>>>>>>>> for >>>>>>>>>> conflicting type rules >>>>>>>>>> >>>>>>>>>> In this case, the conflicting type rule is: >>>>>>>>>> >>>>>>>>>> scontext=at_spi_t >>>>>>>>>> tcontext=dbusd_exec_t >>>>>>>>>> tclass=process >>>>>>>>>> result=sysadm_dbusd_t >>>>>>>>>> >>>>>>>>>> which confirms the previous debugging results (it's the >>>>>>>>>> type_transition >>>>>>>>>> rule). >>>>>>>>>> >>>>>>>>>> Another one is similar, with scontext=gnome_settings_t. >>>>>>>>>> >>>>>>>>>> What I suspect is that when it compiles, it quadruplicates >>>>>>>>>> the >>>>>>>>>> type >>>>>>>>>> transition for each of user, staff, sysadm and xguest, thus >>>>>>>>>> leading >>>>>>>>>> to >>>>>>>>>> conflicting rules. >>>>>>>>>> >>>>>>>>>> Therefore, the solution might be to use a common static >>>>>>>>>> name >>>>>>>>>> for >>>>>>>>>> the >>>>>>>>>> domain (for example, "session_dbusd_t" instead of >>>>>>>>>> "$1_dbusd_t"). >>>>>>>>> >>>>>>>>> and that will introduce other issues. because the session bus >>>>>>>>> must be >>>>>>>>> able to run things on behalf of the caller >>>>>>>> >>>>>>>> Thanks for providing a forecast of other issues. >>>>>>>> >>>>>>>> So, what's the way out of this damn loop ? >>>>>>>> >>>>>>>> I am almost getting lost... >>>>>>>> >>>>>>> >>>>>>> I dont know. >>>>>> >>>>>> We need to find a cure for this !! >>>>> >>>>> I have been pleading for this for years. In my case the solution to >>>>> these problems is DSSP and CIL. I was never able to solve these >>>>> issues >>>>> with reference policy unfortunately. >>>>> >>>>>> >>>>>> >>>>>> What prevents it from running things on behalf of the caller ? And >>>>>> what >>>>>> do you mean exactly for running things on behalf of the caller ? >>>>> >>>>> It hard to explain. The best way to appreciate what I mean is to >>>>> experience it yourself. It will become clear as you move towards a >>>>> fully >>>>> confined desktop. >>>>> >>>>> A lot of programs can be started by the session bus. Many of these >>>>> programs started by the session bus on behalf of users run other >>>>> programs and so forth and so forth. Some of these programs need to >>>>> eventually be able run shell with a domain transition back to the >>>>> login >>>>> shell domain. >>>>> >>>>> staff_t -> staff_dbus_t -> staff_myapp_t -> staff_t >>>>> >>>>> To be able to do this we need to use derived types. You can't do it >>>>> if >>>>> theres a single session_dbus_t type. >>>> >>>> I am hitting a similar situation at the moment with the modified gnome >>>> and dbus modules... >>>> >>>> user_t -> session_dbusd_t -> cannot execute bin_t or shell in the >>>> user_t domain >>>> >>>> Perhaps, it is possible to change the existing code so that it adds the >>>> conflicting type rules, but then when it actually needs to apply them, >>>> it looks up for duplicates and it only applies the one which matches >>>> the calling context. >>>> >>>> It should be feasible... >>>> >>>> What do you say ? >>>> >>> >>> I am saying what I said. This issue is very old and no one ever bothered >>> to fix it. It is not going to happen. >>> >>> Module policy is legacy. A new superior language that does not have >>> these issues is available. >>> >>>> We need to find a way out of this ! >>> >>> There is a way out but its not module policy >> >> Perhaps you can structure the policy better, but a conflicting type >> transition is an error even if is written in CIL. >> >> > > Sure. That is true. Maybe the ability to structure your policy better > makes a big difference, aside from having the luxury of more meaningful > compiler errors and warnings. > Not suggesting secilc is perfect. It is not. SECILC should identify and warn about any blockabstracts it finds in optional policy. Currently it allows them without any notification that it is not allowed and/or that it causes inconsistent behavior. This is bound to cause confusion. Even though these are documented "rules". The compiler should still catch it and prevent it from happening. -- Key fingerprint = 5F4D 3CDB D3F8 3652 FBD8 02D5 3B6C 5F1D 2C7B 6B02 https://sks-keyservers.net/pks/lookup?op=get&search=0x3B6C5F1D2C7B6B02 Dominick Grift -------------- next part -------------- A non-text attachment was scrubbed... Name: signature.asc Type: application/pgp-signature Size: 648 bytes Desc: OpenPGP digital signature Url : http://oss.tresys.com/pipermail/refpolicy/attachments/20160831/b130d02a/attachment.bin ^ permalink raw reply [flat|nested] 73+ messages in thread
* [refpolicy] [PATCH v4] Update for the gnome policy and file contexts 2016-08-23 1:15 ` Chris PeBenito 2016-08-23 12:44 ` Guido Trentalancia @ 2016-08-23 16:06 ` Guido Trentalancia 1 sibling, 0 replies; 73+ messages in thread From: Guido Trentalancia @ 2016-08-23 16:06 UTC (permalink / raw) To: refpolicy On Mon, 22/08/2016 at 21.15 -0400, Chris PeBenito wrote: > On 08/22/16 15:39, Guido Trentalancia wrote: > > > > Update for the gnome module: > > > > - target the dconf daemon, the gsettings user application, the > > ? gnome-settings-daemon and the at-spi daemon with all the > > ? needed domain transitions; > > - a new gstreamer_orcexec_t type and file context is introduced > > ? to support the OIL Runtime Compiler (ORC) optimized code > > ? execution (used for example by pulseaudio); > > - add support for more permissions needed in gconfd_t and gnome > > ? keyring domains; > > - add support for chat over dbus in the gconfd domain and in the > > ? new domains (dconf, gsettings, etc); > > - add support for a few needed fs and kernel permissions. > > - add support for reading the colord related files in the home > > ? directories (such as the ICC EDID profiles): requires the > > ? recent colord patch; > > - add support for for reading the colord related files in the home > > ? directories in the common user domain template; > > - add support for a new mime_info_t type to be used in the home > > ? directories; > > - includes minor modifications to the consolekit, dbus and > > ? policykit modules to support the new targeted gnome daemons > > ? and applications; > > - modifies the pulseaudio module to introduce new interfaces to > > ? read and write pulseaudio tmpfs files and to use the pulseaudio > > ? file descriptor; > > - provides better module encapsulation (i.e. dbus module). > > > > The support for Gnome2/ORBit-2 (version 2) has been dropped. > > > > This patch depends on the recent colord patch. > > > > Recent changes to the pulseaudio module depends on this patch ! [...] > > > > + type dconf_t, dconf_exec_t, dconf_home_t; > > + type at_spi_t, at_spi_exec_t; > > ? type gconfd_t, gconfd_exec_t, gconf_tmp_t; > > ? type gconf_home_t; > > + type gnome_settings_t, gnome_settings_exec_t; > > + type gnome_settings_daemon_t, > > gnome_settings_daemon_exec_t; > > + type gnome_settings_schemas_t; > > + type gkeyringd_exec_t, gnome_keyring_home_t, > > gnome_keyring_cache_home_t, gnome_keyring_tmp_t; > > + type mime_info_t; > > + type user_dbusd_t; > > This dbus type cannot be referenced directly in this module. It's not a dbus type, although it might resemble that from its naming... It's just a convenience private type used to create a domain for running non-system dbus sessions. > > > > ? optional_policy(` > > + dbus_connect_spec_session_bus(user, dconf_t) > > + dbus_connect_spec_session_bus(user, at_spi_t) > > + dbus_connect_spec_session_bus(user, > > gnome_settings_daemon_t) > > Prefixes can't be hardcoded like this. It's related to the above private type. It is used somewhat similarly to a variable in a program. It's not related to "user" as in the arguments "(user, user_r, user_t)". As already explained, it would fail to compile with a "conflicting type rule" error if I use the $1 argument. > > > > + dbus_connect_system_bus(gnome_settings_daemon_t) > > + dbus_domain_transition(at_spi_t, user_dbusd_t) > > + dbus_domain_transition(gnome_settings_t, > > user_dbusd_t) > > + dbus_send_spec_session_bus(user, dconf_t) > > + dbus_send_spec_session_bus(user, at_spi_t) > > + dbus_send_spec_session_bus(user, > > gnome_settings_daemon_t) > > ? dbus_spec_session_domain($1, $1_gkeyringd_t, > > gkeyringd_exec_t) Regards, Guido ^ permalink raw reply [flat|nested] 73+ messages in thread
* [refpolicy] [PATCH v4] Update for the gnome policy and file contexts 2016-08-22 19:39 ` [refpolicy] [PATCH v4] " Guido Trentalancia 2016-08-23 1:15 ` Chris PeBenito @ 2016-09-01 4:20 ` Jason Zaman 2016-09-01 9:33 ` Guido Trentalancia 1 sibling, 1 reply; 73+ messages in thread From: Jason Zaman @ 2016-09-01 4:20 UTC (permalink / raw) To: refpolicy On Mon, Aug 22, 2016 at 09:39:58PM +0200, Guido Trentalancia wrote: > Update for the gnome module: > > - target the dconf daemon, the gsettings user application, the > gnome-settings-daemon and the at-spi daemon with all the > needed domain transitions; > - a new gstreamer_orcexec_t type and file context is introduced > to support the OIL Runtime Compiler (ORC) optimized code > execution (used for example by pulseaudio); > - add support for more permissions needed in gconfd_t and gnome > keyring domains; > - add support for chat over dbus in the gconfd domain and in the > new domains (dconf, gsettings, etc); > - add support for a few needed fs and kernel permissions. > - add support for reading the colord related files in the home > directories (such as the ICC EDID profiles): requires the > recent colord patch; > - add support for for reading the colord related files in the home > directories in the common user domain template; > - add support for a new mime_info_t type to be used in the home > directories; > - includes minor modifications to the consolekit, dbus and > policykit modules to support the new targeted gnome daemons > and applications; > - modifies the pulseaudio module to introduce new interfaces to > read and write pulseaudio tmpfs files and to use the pulseaudio > file descriptor; > - provides better module encapsulation (i.e. dbus module). > > The support for Gnome2/ORBit-2 (version 2) has been dropped. > > This patch depends on the recent colord patch. > > Recent changes to the pulseaudio module depends on this patch ! Hey, I've been fairly busy lately so didnt closely follow this thread and its too long now for me to understand what exactly the problems are. If I followed correctly, it seems like the biggest problem currently is transitioning to/from dbus? can you show the "ps auxfZ | grep dbus" lines? How exactly are you running into problems? Can you post a very minimal command that triggers the problems? Is there some hello world I can put in /usr/share/dbus-1/services and a command to trigger the issue? A lot of these other problems in this patch seem to be issues with dbus so lets fix that first then the other ones will be easier. -- Jason ^ permalink raw reply [flat|nested] 73+ messages in thread
* [refpolicy] [PATCH v4] Update for the gnome policy and file contexts 2016-09-01 4:20 ` Jason Zaman @ 2016-09-01 9:33 ` Guido Trentalancia 2016-09-01 11:53 ` Jason Zaman 0 siblings, 1 reply; 73+ messages in thread From: Guido Trentalancia @ 2016-09-01 9:33 UTC (permalink / raw) To: refpolicy Hello Jason. On Thu, 01/09/2016 at 12.20 +0800, Jason Zaman wrote: > On Mon, Aug 22, 2016 at 09:39:58PM +0200, Guido Trentalancia wrote: > > > > Update for the gnome module: [...] > Hey, > > I've been fairly busy lately so didnt closely follow this thread and > its > too long now for me to understand what exactly the problems are. I'll point you to a few right messages to read in this thread to understand the problem clearly... Please read the following messages in order: http://oss.tresys.com/pipermail/refpolicy/2016-August/008360.html?(non- quoted message text only) http://oss.tresys.com/pipermail/refpolicy/2016-August/008369.html?(non- quoted message text only) What Dominick added here is partly true, although at the I have had some success with re-writing the policy for the whole desktop (or most of it): http://oss.tresys.com/pipermail/refpolicy/2016-August/008370.html http://oss.tresys.com/pipermail/refpolicy/2016-August/008374.html http://oss.tresys.com/pipermail/refpolicy/2016-August/008382.html http://oss.tresys.com/pipermail/refpolicy/2016-August/008385.html http://oss.tresys.com/pipermail/refpolicy/2016-August/008384.html The following messages are about a possible way to solve the problem without changing the actual policy (which can be tricky): http://oss.tresys.com/pipermail/refpolicy/2016-August/008397.html http://oss.tresys.com/pipermail/refpolicy/2016-August/008398.html http://oss.tresys.com/pipermail/refpolicy/2016-August/008400.html So, you have an excellent excerpt now... > If I followed correctly, it seems like the biggest problem currently > is > transitioning to/from dbus? can you show the "ps auxfZ | grep dbus" > lines? The problem is transitioning from a user domain (user, staff, sysadm or xguest) to other domains such as dbus (or gkeyring) and then back to the initial user domain. At the moment the policy uses variable types built using the user argument ($1) passed to the gnome/dbus role() interface. Such approach has big limitations and the current framework is poorly designed with respect to the ability to perform the above mentioned transition. > How exactly are you running into problems? Can you post a very > minimal > command that triggers the problems? Is there some hello world I can > put > in /usr/share/dbus-1/services and a command to trigger the issue? It's more complex than just starting a command. There are problems in the underlying framework when the modified policy is loaded (conflicting type rules, i.e. conflicting type transitions). One way to solve the problem is by changing the policy. I have had some success so far, however it's tricky, expensive and it's not the optimal solution. A possible optimal solution is proposed in the last two or three messages that I posted (see the last two or three messages quoted above). > A lot of these other problems in this patch seem to be issues with > dbus > so lets fix that first then the other ones will be easier. If you want to help implementing a patch, we need to identify the code where such policy is actually enforced, so that there we can track the calling user domain to choose the right type transition. Regards, Guido ^ permalink raw reply [flat|nested] 73+ messages in thread
* [refpolicy] [PATCH v4] Update for the gnome policy and file contexts 2016-09-01 9:33 ` Guido Trentalancia @ 2016-09-01 11:53 ` Jason Zaman 2016-09-01 12:28 ` Guido Trentalancia 0 siblings, 1 reply; 73+ messages in thread From: Jason Zaman @ 2016-09-01 11:53 UTC (permalink / raw) To: refpolicy On Thu, Sep 01, 2016 at 11:33:00AM +0200, Guido Trentalancia wrote: > Hello Jason. > > On Thu, 01/09/2016 at 12.20 +0800, Jason Zaman wrote: > > On Mon, Aug 22, 2016 at 09:39:58PM +0200, Guido Trentalancia wrote: > > > > > > Update for the gnome module: > > [...] > > > Hey, > > > > I've been fairly busy lately so didnt closely follow this thread and > > its > > too long now for me to understand what exactly the problems are. > > I'll point you to a few right messages to read in this thread to > understand the problem clearly... > > Please read the following messages in order: > > http://oss.tresys.com/pipermail/refpolicy/2016-August/008360.html?(non- > quoted message text only) > > http://oss.tresys.com/pipermail/refpolicy/2016-August/008369.html?(non- > quoted message text only) > > What Dominick added here is partly true, although at the I have had > some success with re-writing the policy for the whole desktop (or most > of it): > > http://oss.tresys.com/pipermail/refpolicy/2016-August/008370.html > > http://oss.tresys.com/pipermail/refpolicy/2016-August/008374.html > > http://oss.tresys.com/pipermail/refpolicy/2016-August/008382.html > > http://oss.tresys.com/pipermail/refpolicy/2016-August/008385.html > > http://oss.tresys.com/pipermail/refpolicy/2016-August/008384.html > > The following messages are about a possible way to solve the problem > without changing the actual policy (which can be tricky): > > http://oss.tresys.com/pipermail/refpolicy/2016-August/008397.html > > http://oss.tresys.com/pipermail/refpolicy/2016-August/008398.html > > http://oss.tresys.com/pipermail/refpolicy/2016-August/008400.html > > So, you have an excellent excerpt now... This helped a lot but I am still unclear what the original problem is. > > If I followed correctly, it seems like the biggest problem currently > > is > > transitioning to/from dbus? can you show the "ps auxfZ | grep dbus" > > lines? > > The problem is transitioning from a user domain (user, staff, sysadm or > xguest) to other domains such as dbus (or gkeyring) and then back to > the initial user domain. > > At the moment the policy uses variable types built using the user > argument ($1) passed to the gnome/dbus role() interface. > > Such approach has big limitations and the current framework is poorly > designed with respect to the ability to perform the above mentioned > transition. As you realized, this kind if thing is not allowed: type_transition session_dbusd_t bin_t:process user_t; type_transition session_dbusd_t bin_t:process staff_t; type_transition session_dbusd_t bin_t:process sysadm_t; type_transition session_dbusd_t bin_t:process xguest_t; There are typically two ways to fix it, the easiest is prefixed types so that the transitions become: type_transition user_dbusd_t bin_t:process user_t; type_transition staff_dbusd_t bin_t:process staff_t; dbus is currently setup like this along with most other kinds of programs that need their own domain but then need to transition back to the user's shell (eg staff_sudo_t, and a few login type things are what first come to mind). The other way is to have the program be selinux aware. Ie link with libselinux and query the policy for what should be used. For example, when running a user's cronjob, cron will look in /etc/selinux/mcs/contexts/default_contexts for the line and query all the role/type combos until it finds one that is allowed by the policy for that user. For these kinds of things the program basically does setexeccon() before the exec to manually set it so do not require the type_transition rules at all. DBus is also SELinux aware and it looks like logic for something like this might already exist. On my system I have: /etc/selinux/mcs/contexts/dbus_contexts but it's empty so not sure what should be in it. There are many ways to fix a problem like this depending on a lot of things. > > > How exactly are you running into problems? Can you post a very > > minimal > > command that triggers the problems? Is there some hello world I can > > put > > in /usr/share/dbus-1/services and a command to trigger the issue? > > It's more complex than just starting a command. There are problems in > the underlying framework when the modified policy is loaded > (conflicting type rules, i.e. conflicting type transitions). > > One way to solve the problem is by changing the policy. I have had some > success so far, however it's tricky, expensive and it's not the optimal > solution. > > A possible optimal solution is proposed in the last two or three > messages that I posted (see the last two or three messages quoted > above). I still do not understand exactly what problem you are trying to solve tho. What is running and what is it trying to do? Can you show some error messages? Are these lines the ones that are giving issues? Why do you need the lines at all? dbus_domain_transition(at_spi_t, user_dbusd_t) dbus_domain_transition(gnome_settings_t, user_dbusd_t) Wouldnt they just need dbus send_msg? Why does it need to exec the dbus daemon? It should already be running, they dont need to start it or anything. Can you show some error messages? > > A lot of these other problems in this patch seem to be issues with > > dbus > > so lets fix that first then the other ones will be easier. > > If you want to help implementing a patch, we need to identify the code > where such policy is actually enforced, so that there we can track the > calling user domain to choose the right type transition. We need to take a step back, there are too many issues mixed together with this patch. fixing the policy to allow conflicting types sounds like the wrong solution to whatever the problem is. -- Jason > Regards, > > Guido ^ permalink raw reply [flat|nested] 73+ messages in thread
* [refpolicy] [PATCH v4] Update for the gnome policy and file contexts 2016-09-01 11:53 ` Jason Zaman @ 2016-09-01 12:28 ` Guido Trentalancia 2016-09-01 14:06 ` Jason Zaman 0 siblings, 1 reply; 73+ messages in thread From: Guido Trentalancia @ 2016-09-01 12:28 UTC (permalink / raw) To: refpolicy Hello Jason, thanks for getting back on this. On Thu, 01/09/2016 at 19.53 +0800, Jason Zaman wrote: > On Thu, Sep 01, 2016 at 11:33:00AM +0200, Guido Trentalancia wrote: [...] > > The following messages are about a possible way to solve the > > problem > > without changing the actual policy (which can be tricky): > > > > http://oss.tresys.com/pipermail/refpolicy/2016-August/008397.html > > > > http://oss.tresys.com/pipermail/refpolicy/2016-August/008398.html > > > > http://oss.tresys.com/pipermail/refpolicy/2016-August/008400.html > > > > So, you have an excellent excerpt now... > > This helped a lot but I am still unclear what the original problem > is. The original problem is that the patch that I posted to update the gnome policy and the gnome file contexts leads to the conflicting type rules issues. It's a limitation of the current situation. What the patch does (its description) has been posted here: http://oss.tresys.com/pipermail/refpolicy/2016-August/008324.html Try by yourself, by applying such patch, then modifying as indicated by Christopher (moving dbus related statements from the gnome role template to the dbus module) and finally using the prefixed types (at the moment it uses user_dbusd_t, which won't work for all users). It shouldn't take very long to apply the patch and modify it... At least you can touch the problem with your own hands. > > > If I followed correctly, it seems like the biggest problem > > > currently > > > is > > > transitioning to/from dbus? can you show the "ps auxfZ | grep > > > dbus" > > > lines? > > > > The problem is transitioning from a user domain (user, staff, > > sysadm or > > xguest) to other domains such as dbus (or gkeyring) and then back > > to > > the initial user domain. > > > > At the moment the policy uses variable types built using the user > > argument ($1) passed to the gnome/dbus role() interface. > > > > Such approach has big limitations and the current framework is > > poorly > > designed with respect to the ability to perform the above mentioned > > transition. > > As you realized, this kind if thing is not allowed: > ????type_transition session_dbusd_t bin_t:process user_t; > ????type_transition session_dbusd_t bin_t:process staff_t; > ????type_transition session_dbusd_t bin_t:process sysadm_t; > ????type_transition session_dbusd_t bin_t:process xguest_t; > > There are typically two ways to fix it, the easiest is prefixed types > so > that the transitions become: > ????type_transition user_dbusd_t bin_t:process user_t; > ????type_transition staff_dbusd_t bin_t:process staff_t; That is what doesn't work: the prefixed types. They lead to conflicting type rules. > dbus is currently setup like this along with most other kinds of > programs that need their own domain but then need to transition back > to > the user's shell (eg staff_sudo_t, and a few login type things are > what > first come to mind). > > The other way is to have the program be selinux aware. Ie link with > libselinux and query the policy for what should be used. > For example, when running a user's cronjob, cron will look in > /etc/selinux/mcs/contexts/default_contexts for the line and query all > the role/type combos until it finds one that is allowed by the policy > for that user. For these kinds of things the program basically does > setexeccon() before the exec to manually set it so do not require the > type_transition rules at all. I don't think this is the right approach for the problem at hand. > DBus is also SELinux aware and it looks like logic for something like > this might already exist. On my system I have: > /etc/selinux/mcs/contexts/dbus_contexts but it's empty so not sure > what > should be in it.? It's probably reserved for dbus file contexts. > There are many ways to fix a problem like this depending on a lot of > things. > > > > > > > > > > > How exactly are you running into problems? Can you post a very > > > minimal > > > command that triggers the problems? Is there some hello world I > > > can > > > put > > > in /usr/share/dbus-1/services and a command to trigger the issue? > > > > It's more complex than just starting a command. There are problems > > in > > the underlying framework when the modified policy is loaded > > (conflicting type rules, i.e. conflicting type transitions). > > > > One way to solve the problem is by changing the policy. I have had > > some > > success so far, however it's tricky, expensive and it's not the > > optimal > > solution. > > > > A possible optimal solution is proposed in the last two or three > > messages that I posted (see the last two or three messages quoted > > above). > > I still do not understand exactly what problem you are trying to > solve > tho. What is running and what is it trying to do? Can you show some > error messages? > > Are these lines the ones that are giving issues? Why do you need the > lines at all? > dbus_domain_transition(at_spi_t, user_dbusd_t) > dbus_domain_transition(gnome_settings_t, user_dbusd_t) At the moment the gnome desktop is not confined. It runs in the user domain. One of the things that the patch does is to start confining the gnome desktop. If you start doing so, you'll end up with needing transitions that apparently cannot be supported by the current framework. If you want to reproduce the problem, you need to start confining the gnome desktop: dconf, at-spi, gsettings, gnome-settings-daemon and so on. A way to start doing so is to try the patch (v4) that I posted and modify it as indicated by Christopher in the review. > Wouldnt they just need dbus send_msg? Why does it need to exec the > dbus > daemon? It should already be running, they dont need to start it or > anything. Can you show some error messages? The system dbus daemon is running, not the session one. > > > A lot of these other problems in this patch seem to be issues > > > with > > > dbus > > > so lets fix that first then the other ones will be easier. All I can say, is that the prefixed types don't work when you start confining the gnome desktop. Try by yourself, it takes 5 minutes to apply the patch and modify it to use the prefixed types instead of "user_dbusd_t". > > If you want to help implementing a patch, we need to identify the > > code > > where such policy is actually enforced, so that there we can track > > the > > calling user domain to choose the right type transition. > > We need to take a step back, there are too many issues mixed together > with this patch. fixing the policy to allow conflicting types sounds > like the wrong solution to whatever the problem is. At the moment, I still believe that is the optimal solution: allowing conflicts in the policy and resolving them at runtime by exploiting the knowledge of the user and role parts of the context. Regards, Guido ^ permalink raw reply [flat|nested] 73+ messages in thread
* [refpolicy] [PATCH v4] Update for the gnome policy and file contexts 2016-09-01 12:28 ` Guido Trentalancia @ 2016-09-01 14:06 ` Jason Zaman 2016-09-01 14:40 ` Guido Trentalancia 0 siblings, 1 reply; 73+ messages in thread From: Jason Zaman @ 2016-09-01 14:06 UTC (permalink / raw) To: refpolicy On Thu, Sep 01, 2016 at 02:28:50PM +0200, Guido Trentalancia wrote: > Hello Jason, > > thanks for getting back on this. > > On Thu, 01/09/2016 at 19.53 +0800, Jason Zaman wrote: > > On Thu, Sep 01, 2016 at 11:33:00AM +0200, Guido Trentalancia wrote: > > [...] > > > > The following messages are about a possible way to solve the > > > problem > > > without changing the actual policy (which can be tricky): > > > > > > http://oss.tresys.com/pipermail/refpolicy/2016-August/008397.html > > > > > > http://oss.tresys.com/pipermail/refpolicy/2016-August/008398.html > > > > > > http://oss.tresys.com/pipermail/refpolicy/2016-August/008400.html > > > > > > So, you have an excellent excerpt now... > > > > This helped a lot but I am still unclear what the original problem > > is. > > The original problem is that the patch that I posted to update the > gnome policy and the gnome file contexts leads to the conflicting type > rules issues. > > It's a limitation of the current situation. > > What the patch does (its description) has been posted here: > > http://oss.tresys.com/pipermail/refpolicy/2016-August/008324.html > > Try by yourself, by applying such patch, then modifying as indicated by > Christopher (moving dbus related statements from the gnome role > template to the dbus module) and finally using the prefixed types (at > the moment it uses user_dbusd_t, which won't work for all users). > > It shouldn't take very long to apply the patch and modify it... At > least you can touch the problem with your own hands. > > > > > If I followed correctly, it seems like the biggest problem > > > > currently > > > > is > > > > transitioning to/from dbus? can you show the "ps auxfZ | grep > > > > dbus" > > > > lines? > > > > > > The problem is transitioning from a user domain (user, staff, > > > sysadm or > > > xguest) to other domains such as dbus (or gkeyring) and then back > > > to > > > the initial user domain. > > > > > > At the moment the policy uses variable types built using the user > > > argument ($1) passed to the gnome/dbus role() interface. > > > > > > Such approach has big limitations and the current framework is > > > poorly > > > designed with respect to the ability to perform the above mentioned > > > transition. > > > > As you realized, this kind if thing is not allowed: > > ????type_transition session_dbusd_t bin_t:process user_t; > > ????type_transition session_dbusd_t bin_t:process staff_t; > > ????type_transition session_dbusd_t bin_t:process sysadm_t; > > ????type_transition session_dbusd_t bin_t:process xguest_t; > > > > There are typically two ways to fix it, the easiest is prefixed types > > so > > that the transitions become: > > ????type_transition user_dbusd_t bin_t:process user_t; > > ????type_transition staff_dbusd_t bin_t:process staff_t; > > That is what doesn't work: the prefixed types. They lead to conflicting > type rules. > > > dbus is currently setup like this along with most other kinds of > > programs that need their own domain but then need to transition back > > to > > the user's shell (eg staff_sudo_t, and a few login type things are > > what > > first come to mind). > > > > The other way is to have the program be selinux aware. Ie link with > > libselinux and query the policy for what should be used. > > For example, when running a user's cronjob, cron will look in > > /etc/selinux/mcs/contexts/default_contexts for the line and query all > > the role/type combos until it finds one that is allowed by the policy > > for that user. For these kinds of things the program basically does > > setexeccon() before the exec to manually set it so do not require the > > type_transition rules at all. > > I don't think this is the right approach for the problem at hand. > > > DBus is also SELinux aware and it looks like logic for something like > > this might already exist. On my system I have: > > /etc/selinux/mcs/contexts/dbus_contexts but it's empty so not sure > > what > > should be in it.? > > It's probably reserved for dbus file contexts. > > > There are many ways to fix a problem like this depending on a lot of > > things. > > > > > > > > > > > > > > > > How exactly are you running into problems? Can you post a very > > > > minimal > > > > command that triggers the problems? Is there some hello world I > > > > can > > > > put > > > > in /usr/share/dbus-1/services and a command to trigger the issue? > > > > > > It's more complex than just starting a command. There are problems > > > in > > > the underlying framework when the modified policy is loaded > > > (conflicting type rules, i.e. conflicting type transitions). > > > > > > One way to solve the problem is by changing the policy. I have had > > > some > > > success so far, however it's tricky, expensive and it's not the > > > optimal > > > solution. > > > > > > A possible optimal solution is proposed in the last two or three > > > messages that I posted (see the last two or three messages quoted > > > above). > > > > I still do not understand exactly what problem you are trying to > > solve > > tho. What is running and what is it trying to do? Can you show some > > error messages? > > > > Are these lines the ones that are giving issues? Why do you need the > > lines at all? > > dbus_domain_transition(at_spi_t, user_dbusd_t) > > dbus_domain_transition(gnome_settings_t, user_dbusd_t) > > At the moment the gnome desktop is not confined. It runs in the user > domain. > > One of the things that the patch does is to start confining the gnome > desktop. > > If you start doing so, you'll end up with needing transitions that > apparently cannot be supported by the current framework. > > If you want to reproduce the problem, you need to start confining the > gnome desktop: dconf, at-spi, gsettings, gnome-settings-daemon and so > on. A way to start doing so is to try the patch (v4) that I posted and > modify it as indicated by Christopher in the review. > > > Wouldnt they just need dbus send_msg? Why does it need to exec the > > dbus > > daemon? It should already be running, they dont need to start it or > > anything. Can you show some error messages? > > The system dbus daemon is running, not the session one. The session dbus is supposed to be started when you login first thing. at-spi shouldnt be trying to start it. > > > > A lot of these other problems in this patch seem to be issues > > > > with > > > > dbus > > > > so lets fix that first then the other ones will be easier. > > All I can say, is that the prefixed types don't work when you start > confining the gnome desktop. You still haven't explained exactly what is trying to run what? What are the starting domains? what is the program? what is it trying to run? what are the domains (before and after the patch) of the things it tries to run? What are the error messages? > Try by yourself, it takes 5 minutes to apply the patch and modify it to > use the prefixed types instead of "user_dbusd_t". Yeah, I know the rules dont work, I can see that without even building. My question is why do you need the rules? You keep saying you need these rules but what *exactly* do they fix? Once we know that we can suggest other solutions. Using user_dbusd_t is useless. your patch would fix it for user_t, but staff_t and any others would be still broken. > > > If you want to help implementing a patch, we need to identify the > > > code > > > where such policy is actually enforced, so that there we can track > > > the > > > calling user domain to choose the right type transition. > > > > We need to take a step back, there are too many issues mixed together > > with this patch. fixing the policy to allow conflicting types sounds > > like the wrong solution to whatever the problem is. > > At the moment, I still believe that is the optimal solution: allowing > conflicts in the policy and resolving them at runtime by exploiting the > knowledge of the user and role parts of the context. > > Regards, > > Guido ^ permalink raw reply [flat|nested] 73+ messages in thread
* [refpolicy] [PATCH v4] Update for the gnome policy and file contexts 2016-09-01 14:06 ` Jason Zaman @ 2016-09-01 14:40 ` Guido Trentalancia 2016-09-01 15:21 ` Jason Zaman 0 siblings, 1 reply; 73+ messages in thread From: Guido Trentalancia @ 2016-09-01 14:40 UTC (permalink / raw) To: refpolicy On Thu, 01/09/2016 at 22.06 +0800, Jason Zaman wrote: > On Thu, Sep 01, 2016 at 02:28:50PM +0200, Guido Trentalancia wrote: [...] > > At the moment the gnome desktop is not confined. It runs in the > > user > > domain. > > > > One of the things that the patch does is to start confining the > > gnome > > desktop. > > > > If you start doing so, you'll end up with needing transitions that > > apparently cannot be supported by the current framework. > > > > If you want to reproduce the problem, you need to start confining > > the > > gnome desktop: dconf, at-spi, gsettings, gnome-settings-daemon and > > so > > on. A way to start doing so is to try the patch (v4) that I posted > > and > > modify it as indicated by Christopher in the review. > > > > > > > > Wouldnt they just need dbus send_msg? Why does it need to exec > > > the > > > dbus > > > daemon? It should already be running, they dont need to start it > > > or > > > anything. Can you show some error messages? > > > > The system dbus daemon is running, not the session one. > > The session dbus is supposed to be started when you login first > thing. Yes, exactly. > at-spi shouldnt be trying to start it. Who said that ? At-spi starts with Gnome from the xdg autostart directory by default. > > > > > A lot of these other problems in this patch seem to be issues > > > > > with > > > > > dbus > > > > > so lets fix that first then the other ones will be easier. > > > > All I can say, is that the prefixed types don't work when you start > > confining the gnome desktop. > > You still haven't explained exactly what is trying to run what? What > are > the starting domains? what is the program? what is it trying to run? > what are the domains (before and after the patch) of the things it > tries > to run? What are the error messages? > > > > > Try by yourself, it takes 5 minutes to apply the patch and modify > > it to > > use the prefixed types instead of "user_dbusd_t". > > Yeah, I know the rules dont work, I can see that without even > building. > My question is why do you need the rules? You keep saying you need > these > rules but what *exactly* do they fix? Once we know that we can > suggest > other solutions. The new rules solve some problems in the current policy that don't let Gnome to start and also they confine other pieces of Gnome that are not currently confined (dconf, at-spi, gsd and so on). Other things that are tackled by the patch are listed at the top of it (description of the patch). It is several things all together. > Using user_dbusd_t is useless. your patch would fix it for user_t, > but > staff_t and any others would be still broken. Yes, I know. It was so because the prefixed types don't work properly. I think we are starting to loop around the same arguments... > > > > If you want to help implementing a patch, we need to identify > > > > the > > > > code > > > > where such policy is actually enforced, so that there we can > > > > track > > > > the > > > > calling user domain to choose the right type transition. > > > > > > We need to take a step back, there are too many issues mixed > > > together > > > with this patch. fixing the policy to allow conflicting types > > > sounds > > > like the wrong solution to whatever the problem is. > > > > At the moment, I still believe that is the optimal solution: > > allowing > > conflicts in the policy and resolving them at runtime by exploiting > > the > > knowledge of the user and role parts of the context. The above is what is needed to achieve an optimal solution to the problem that I encountered while developing this gnome patch. Guido ^ permalink raw reply [flat|nested] 73+ messages in thread
* [refpolicy] [PATCH v4] Update for the gnome policy and file contexts 2016-09-01 14:40 ` Guido Trentalancia @ 2016-09-01 15:21 ` Jason Zaman 2016-09-01 16:18 ` Guido Trentalancia ` (2 more replies) 0 siblings, 3 replies; 73+ messages in thread From: Jason Zaman @ 2016-09-01 15:21 UTC (permalink / raw) To: refpolicy On Thu, Sep 01, 2016 at 04:40:39PM +0200, Guido Trentalancia via refpolicy wrote: > On Thu, 01/09/2016 at 22.06 +0800, Jason Zaman wrote: > > On Thu, Sep 01, 2016 at 02:28:50PM +0200, Guido Trentalancia wrote: > Who said that ? At-spi starts with Gnome from the xdg autostart > directory by default. What happens if you start dbus-daemon --session from xdg autostart too? > > > > > If you want to help implementing a patch, we need to identify > > > > > the > > > > > code > > > > > where such policy is actually enforced, so that there we can > > > > > track > > > > > the > > > > > calling user domain to choose the right type transition. > > > > > > > > We need to take a step back, there are too many issues mixed > > > > together > > > > with this patch. fixing the policy to allow conflicting types > > > > sounds > > > > like the wrong solution to whatever the problem is. > > > > > > At the moment, I still believe that is the optimal solution: > > > allowing > > > conflicts in the policy and resolving them at runtime by exploiting > > > the > > > knowledge of the user and role parts of the context. > > The above is what is needed to achieve an optimal solution to the > problem that I encountered while developing this gnome patch. Again ... *what problem*? show me the error messages you get without this patch applied. You keep saying that what you have done is optimal to solve the problem but you have not explained what the problem is. Do you need atspi to be able to exec dbus-daemon? What happens if you start dbus-daemon before atspi? Why cant you just prefix the atspi domains too? type_transition staff_atspi_t dbusd_exec_t:process staff_dbusd_t; type_transition user_atspi_t dbusd_exec_t:process user_dbusd_t; -- Jason ^ permalink raw reply [flat|nested] 73+ messages in thread
* [refpolicy] [PATCH v4] Update for the gnome policy and file contexts 2016-09-01 15:21 ` Jason Zaman @ 2016-09-01 16:18 ` Guido Trentalancia 2016-09-01 19:30 ` Guido Trentalancia 2016-09-03 13:34 ` Guido Trentalancia 2 siblings, 0 replies; 73+ messages in thread From: Guido Trentalancia @ 2016-09-01 16:18 UTC (permalink / raw) To: refpolicy On Thu, 01/09/2016 at 23.21 +0800, Jason Zaman wrote: > On Thu, Sep 01, 2016 at 04:40:39PM +0200, Guido Trentalancia via > refpolicy wrote: > > > > On Thu, 01/09/2016 at 22.06 +0800, Jason Zaman wrote: > > > > > > On Thu, Sep 01, 2016 at 02:28:50PM +0200, Guido Trentalancia > > > wrote: > > Who said that ? At-spi starts with Gnome from the xdg autostart > > directory by default. > > What happens if you start dbus-daemon --session from xdg autostart > too? The DBUS session daemon is not designed to be started from xdg autostart. There must be multiple instances of it. > > > > > > If you want to help implementing a patch, we need to > > > > > > identify > > > > > > the > > > > > > code > > > > > > where such policy is actually enforced, so that there we > > > > > > can > > > > > > track > > > > > > the > > > > > > calling user domain to choose the right type transition. > > > > > > > > > > We need to take a step back, there are too many issues mixed > > > > > together > > > > > with this patch. fixing the policy to allow conflicting types > > > > > sounds > > > > > like the wrong solution to whatever the problem is. > > > > > > > > At the moment, I still believe that is the optimal solution: > > > > allowing > > > > conflicts in the policy and resolving them at runtime by > > > > exploiting > > > > the > > > > knowledge of the user and role parts of the context. > > > > The above is what is needed to achieve an optimal solution to the > > problem that I encountered while developing this gnome patch. > > Again ... *what problem*? show me the error messages you get without > this patch applied. You keep saying that what you have done is As already explained, without the patch applied, Gnome doesn't start, pulseaudio doesn't work fine, there are permissions granted that are not strictly needed and however it is not confined properly (there are Gnome processes running in the user domain, which instead should run in their own domain). > optimal > to solve the problem but you have not explained what the problem is. I have no other ways of explaining it. The others have understood the problem, perhaps you can read their replies to get more insight... > Do you need atspi to be able to exec dbus-daemon? What happens if you > start dbus-daemon before atspi? > > Why cant you just prefix the atspi domains too? > type_transition staff_atspi_t dbusd_exec_t:process staff_dbusd_t; > type_transition user_atspi_t dbusd_exec_t:process user_dbusd_t; > > -- Jason Guido ^ permalink raw reply [flat|nested] 73+ messages in thread
* [refpolicy] [PATCH v4] Update for the gnome policy and file contexts 2016-09-01 15:21 ` Jason Zaman 2016-09-01 16:18 ` Guido Trentalancia @ 2016-09-01 19:30 ` Guido Trentalancia 2016-09-02 1:12 ` Jason Zaman 2016-09-03 13:34 ` Guido Trentalancia 2 siblings, 1 reply; 73+ messages in thread From: Guido Trentalancia @ 2016-09-01 19:30 UTC (permalink / raw) To: refpolicy Hello Jason, I'll try another time to answer your question... On Thu, 01/09/2016 at 23.21 +0800, Jason Zaman wrote: > On Thu, Sep 01, 2016 at 04:40:39PM +0200, Guido Trentalancia via > refpolicy wrote: > > > > On Thu, 01/09/2016 at 22.06 +0800, Jason Zaman wrote: > > > > > > On Thu, Sep 01, 2016 at 02:28:50PM +0200, Guido Trentalancia > > > wrote: > > Who said that ? At-spi starts with Gnome from the xdg autostart > > directory by default. > > What happens if you start dbus-daemon --session from xdg autostart > too? > > > > > > > > > > > > > > > > > > > > > > > > > > > If you want to help implementing a patch, we need to > > > > > > identify > > > > > > the > > > > > > code > > > > > > where such policy is actually enforced, so that there we > > > > > > can > > > > > > track > > > > > > the > > > > > > calling user domain to choose the right type transition. > > > > > > > > > > We need to take a step back, there are too many issues mixed > > > > > together > > > > > with this patch. fixing the policy to allow conflicting types > > > > > sounds > > > > > like the wrong solution to whatever the problem is. > > > > > > > > At the moment, I still believe that is the optimal solution: > > > > allowing > > > > conflicts in the policy and resolving them at runtime by > > > > exploiting > > > > the > > > > knowledge of the user and role parts of the context. > > > > The above is what is needed to achieve an optimal solution to the > > problem that I encountered while developing this gnome patch. > > Again ... *what problem*? show me the error messages you get without > this patch applied. You keep saying that what you have done is > optimal > to solve the problem but you have not explained what the problem is. The main problem that the patch was trying to sort out is to allow Gnome to run with the Reference Policy and to confine it better (for a full description, please refer to the latest version of the patch). In this case, there isn't just one specific error message. There is a series of permissions denied in the log files and the desktop won't start (as in not passing the xdm login screen, for example) or it won't function properly. While developing the above mentioned patch, I came across a problem with the policy: conflicting type rules. The specific error message in this case is "Conflicting type rules" when loading the policy (it compiles fine). You can reproduce it by applying the patch and then changing the "user_dbusd_t" type that I have used initially to the prefixed type "$1_dbusd_t". To solve the latter problem, I believe that the optimal solution is not to change the policy further, but to: - change the existing source code so that it adds the conflicting type rules without generating an error; - resolve the conflict at runtime by exploiting the knowledge of the user and role parts of the context. I was asking other people what they think of such proposed solution and, provided that it sounds feasible to them, if they have specific ideas on its implementation. I hope it does make sense now... > Do you need atspi to be able to exec dbus-daemon? What happens if you > start dbus-daemon before atspi? > Why cant you just prefix the atspi domains too? I don't know if prefixing the other domains works. However, if you post a revised patch, I can test it and let you know. At the moment, I have removed the prefixed types and I am working with static types prefixed by the keyword "session". It works, but it surely isn't what I would call optimal. > type_transition staff_atspi_t dbusd_exec_t:process staff_dbusd_t; > type_transition user_atspi_t dbusd_exec_t:process user_dbusd_t; Regards, Guido ^ permalink raw reply [flat|nested] 73+ messages in thread
* [refpolicy] [PATCH v4] Update for the gnome policy and file contexts 2016-09-01 19:30 ` Guido Trentalancia @ 2016-09-02 1:12 ` Jason Zaman 0 siblings, 0 replies; 73+ messages in thread From: Jason Zaman @ 2016-09-02 1:12 UTC (permalink / raw) To: refpolicy On Thu, Sep 01, 2016 at 09:30:25PM +0200, Guido Trentalancia via refpolicy wrote: > > Why cant you just prefix the atspi domains too? > > I don't know if prefixing the other domains works. > However, if you post a revised patch, I can test it and let you know. > At the moment, I have removed the prefixed types and I am working with > static types prefixed by the keyword "session". It works, but it > surely isn't what I would call optimal. I'm pretty sure removing prefixes is the opposite direction from where you need to be going. Xfce uses at-spi-bus-launcher so I can confine that and gconfd first so we can get things working in general. If those work then the rest of the parts of gnome would follow the same pattern. -- Jason > > type_transition staff_atspi_t dbusd_exec_t:process staff_dbusd_t; > > type_transition user_atspi_t dbusd_exec_t:process user_dbusd_t; > > Regards, > > Guido > > _______________________________________________ > refpolicy mailing list > refpolicy at oss.tresys.com > http://oss.tresys.com/mailman/listinfo/refpolicy ^ permalink raw reply [flat|nested] 73+ messages in thread
* [refpolicy] [PATCH v4] Update for the gnome policy and file contexts 2016-09-01 15:21 ` Jason Zaman 2016-09-01 16:18 ` Guido Trentalancia 2016-09-01 19:30 ` Guido Trentalancia @ 2016-09-03 13:34 ` Guido Trentalancia 2016-09-06 9:18 ` Jason Zaman 2 siblings, 1 reply; 73+ messages in thread From: Guido Trentalancia @ 2016-09-03 13:34 UTC (permalink / raw) To: refpolicy Hello Jason. I have an update about the advice that you kindly provided... On Thu, 01/09/2016 at 23.21 +0800, Jason Zaman wrote: > On Thu, Sep 01, 2016 at 04:40:39PM +0200, Guido Trentalancia via > refpolicy wrote: > > > > On Thu, 01/09/2016 at 22.06 +0800, Jason Zaman wrote: > > > > > > On Thu, Sep 01, 2016 at 02:28:50PM +0200, Guido Trentalancia > > > wrote: > > Who said that ? At-spi starts with Gnome from the xdg autostart > > directory by default. > > What happens if you start dbus-daemon --session from xdg autostart > too? > > > > > > > > > > > > > > > > > > > > > > > > > > > If you want to help implementing a patch, we need to > > > > > > identify > > > > > > the > > > > > > code > > > > > > where such policy is actually enforced, so that there we > > > > > > can > > > > > > track > > > > > > the > > > > > > calling user domain to choose the right type transition. > > > > > > > > > > We need to take a step back, there are too many issues mixed > > > > > together > > > > > with this patch. fixing the policy to allow conflicting types > > > > > sounds > > > > > like the wrong solution to whatever the problem is. > > > > > > > > At the moment, I still believe that is the optimal solution: > > > > allowing > > > > conflicts in the policy and resolving them at runtime by > > > > exploiting > > > > the > > > > knowledge of the user and role parts of the context. > > > > The above is what is needed to achieve an optimal solution to the > > problem that I encountered while developing this gnome patch. > > Again ... *what problem*? show me the error messages you get without > this patch applied. You keep saying that what you have done is > optimal > to solve the problem but you have not explained what the problem is. > > Do you need atspi to be able to exec dbus-daemon? What happens if you > start dbus-daemon before atspi? > > Why cant you just prefix the atspi domains too? > type_transition staff_atspi_t dbusd_exec_t:process staff_dbusd_t; > type_transition user_atspi_t dbusd_exec_t:process user_dbusd_t; The latter (prefixing the other domains, such as at_spi, that at some point need to transition back to the user domain) solved the problem that I was experiencing ! Brilliant idea... Thanks very much for your advice !! Unfortunately, I don't know if I can really update this patch for the mailing list and resubmit it, because there are very strict requirements on its length. It's a shame, but I cannot split it in several parts because this patch is made of highly interdependent bits... Best regards, Guido ^ permalink raw reply [flat|nested] 73+ messages in thread
* [refpolicy] [PATCH v4] Update for the gnome policy and file contexts 2016-09-03 13:34 ` Guido Trentalancia @ 2016-09-06 9:18 ` Jason Zaman 2016-09-06 12:26 ` Guido Trentalancia 0 siblings, 1 reply; 73+ messages in thread From: Jason Zaman @ 2016-09-06 9:18 UTC (permalink / raw) To: refpolicy > On Thu, 01/09/2016 at 23.21 +0800, Jason Zaman wrote: > > Why cant you just prefix the atspi domains too? > > type_transition staff_atspi_t dbusd_exec_t:process staff_dbusd_t; > > type_transition user_atspi_t dbusd_exec_t:process user_dbusd_t; > > The latter (prefixing the other domains, such as at_spi, that at some > point need to transition back to the user domain) solved the problem > that I was experiencing ! > > Brilliant idea... Thanks very much for your advice !! > > Unfortunately, I don't know if I can really update this patch for the > mailing list and resubmit it, because there are very strict > requirements on its length. > > It's a shame, but I cannot split it in several parts because this patch > is made of highly interdependent bits... Great that it works! Can you rebase the patch on master then send me the file directly (not to the list since it's big). Then I can take a look and comment. If this works well for dbus session programs we probably want to make a few templates to handle the common stuff first. Then we can do the specific patches separately for atspi and the other programs afterwards. It's a big change but I'm sure we can figure out a good way to organise it. I use xfce so will check if there are more things that use dbus so we can make the templates good for everything at the same time. -- Jason -------------- next part -------------- An HTML attachment was scrubbed... URL: http://oss.tresys.com/pipermail/refpolicy/attachments/20160906/6f094538/attachment.html ^ permalink raw reply [flat|nested] 73+ messages in thread
* [refpolicy] [PATCH v4] Update for the gnome policy and file contexts 2016-09-06 9:18 ` Jason Zaman @ 2016-09-06 12:26 ` Guido Trentalancia 0 siblings, 0 replies; 73+ messages in thread From: Guido Trentalancia @ 2016-09-06 12:26 UTC (permalink / raw) To: refpolicy Hello Jason. On Tue, 06/09/2016 at 17.18 +0800, Jason Zaman wrote: > > On Thu, 01/09/2016 at 23.21 +0800, Jason Zaman wrote: > > > Why cant you just prefix the atspi domains too? > > > type_transition staff_atspi_t dbusd_exec_t:process staff_dbusd_t; > > > type_transition user_atspi_t dbusd_exec_t:process user_dbusd_t; > > > > The latter (prefixing the other domains, such as at_spi, that at > some > > point need to transition back to the user domain) solved the > problem > > that I was experiencing ! > > > > Brilliant idea... Thanks very much for your advice !! > > > > Unfortunately, I don't know if I can really update this patch for > the > > mailing list and resubmit it, because there are very strict > > requirements on its length. > > > > It's a shame, but I cannot split it in several parts because this > patch > > is made of highly interdependent bits... > Great that it works! Yes, thanks very much to your advice ! > Can you rebase the patch on master then send me the file directly > (not to the list since it's big). Then I can take a look and comment. I am still completing it. There are still bits that are getting changed and improved every now and then while it gets tested better. > If this works well for dbus session programs we probably want to make > a few templates to handle the common stuff first. Then we can do the > specific patches separately for atspi and the other programs > afterwards. It's a big change but I'm sure we can figure out a good > way to organise it. I really hope it will get committed. > I use xfce so will check if there are more things that use dbus so we > can make the templates good for everything at the same time. There is only one strange thing happening: when I start gnome-terminal from the gnome-shell menu (it executes /usr/bin/gnome-terminal, which then executes /usr/libexec/gnome-terminal-server), it runs in the $1_dbusd_t domain. Other applications when are started from the gnome-shell menu do not end up running in the $1_dbusd_t domain but in the user domain, as desirable. It am not sure why the above is happening. I can get it to transition from $1_dbusd_t to $1_t, which sorts things out, but it would be better if it was running in gnome_terminal_t and gnome_terminal_server_t respectively. Best regards, Guido ^ permalink raw reply [flat|nested] 73+ messages in thread
end of thread, other threads:[~2016-09-06 12:26 UTC | newest] Thread overview: 73+ messages (download: mbox.gz / follow: Atom feed) -- links below jump to the message on this page -- 2016-08-13 14:45 [refpolicy] [PATCH] Update for the gnome policy and file contexts Guido Trentalancia 2016-08-13 14:51 ` Dominick Grift 2016-08-13 20:09 ` Guido Trentalancia 2016-08-13 20:20 ` Dominick Grift 2016-08-14 17:35 ` Guido Trentalancia 2016-08-14 17:45 ` Dominick Grift 2016-08-14 21:14 ` Guido Trentalancia 2016-08-14 21:19 ` Dominick Grift 2016-08-14 21:33 ` Guido Trentalancia 2016-08-14 21:35 ` Dominick Grift 2016-08-14 22:13 ` Guido Trentalancia 2016-08-15 6:00 ` Dominick Grift 2016-08-15 8:29 ` Dominick Grift 2016-08-16 19:26 ` Guido Trentalancia 2016-08-16 19:30 ` Dominick Grift 2016-08-15 21:33 ` [refpolicy] [PATCH v2] " Guido Trentalancia 2016-08-15 20:08 ` Chris PeBenito 2016-08-20 14:52 ` [refpolicy] [PATCH v3] " Guido Trentalancia 2016-08-21 18:49 ` Dominick Grift 2016-08-21 19:02 ` Guido Trentalancia 2016-08-21 19:05 ` Dominick Grift 2016-08-21 19:44 ` Guido Trentalancia 2016-08-22 19:39 ` [refpolicy] [PATCH v4] " Guido Trentalancia 2016-08-23 1:15 ` Chris PeBenito 2016-08-23 12:44 ` Guido Trentalancia 2016-08-23 13:58 ` Guido Trentalancia 2016-08-23 23:02 ` Chris PeBenito 2016-08-23 23:31 ` Guido Trentalancia 2016-08-24 21:55 ` Guido Trentalancia 2016-08-24 22:10 ` Chris PeBenito 2016-08-24 22:42 ` Guido Trentalancia 2016-08-25 7:25 ` Dominick Grift 2016-08-25 9:47 ` Guido Trentalancia 2016-08-25 22:49 ` Chris PeBenito 2016-08-26 22:21 ` Guido Trentalancia 2016-08-28 18:29 ` Chris PeBenito 2016-08-27 17:08 ` Guido Trentalancia 2016-08-27 17:10 ` Dominick Grift 2016-08-27 17:16 ` Guido Trentalancia 2016-08-27 17:17 ` Dominick Grift 2016-08-27 20:41 ` Guido Trentalancia 2016-08-27 20:57 ` Dominick Grift 2016-08-27 21:48 ` Guido Trentalancia 2016-08-28 7:24 ` Dominick Grift 2016-08-28 8:03 ` Dominick Grift 2016-08-28 15:37 ` Guido Trentalancia 2016-08-28 18:40 ` Chris PeBenito 2016-08-28 19:11 ` Guido Trentalancia 2016-08-28 19:12 ` Dominick Grift 2016-08-29 8:20 ` Dominick Grift 2016-08-29 17:45 ` Naftuli Tzvi Kay 2016-08-30 19:23 ` Guido Trentalancia 2016-08-30 21:37 ` Chris PeBenito 2016-08-30 21:46 ` Guido Trentalancia 2016-08-30 19:15 ` Guido Trentalancia 2016-08-30 19:21 ` Dominick Grift 2016-08-30 21:39 ` Chris PeBenito 2016-08-31 6:55 ` Dominick Grift 2016-08-31 7:31 ` Dominick Grift 2016-08-23 16:06 ` Guido Trentalancia 2016-09-01 4:20 ` Jason Zaman 2016-09-01 9:33 ` Guido Trentalancia 2016-09-01 11:53 ` Jason Zaman 2016-09-01 12:28 ` Guido Trentalancia 2016-09-01 14:06 ` Jason Zaman 2016-09-01 14:40 ` Guido Trentalancia 2016-09-01 15:21 ` Jason Zaman 2016-09-01 16:18 ` Guido Trentalancia 2016-09-01 19:30 ` Guido Trentalancia 2016-09-02 1:12 ` Jason Zaman 2016-09-03 13:34 ` Guido Trentalancia 2016-09-06 9:18 ` Jason Zaman 2016-09-06 12:26 ` Guido Trentalancia
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.