From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-17.3 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_CR_TRAILER,INCLUDES_PATCH,MAILING_LIST_MULTI,NICE_REPLY_A, SPF_HELO_NONE,SPF_PASS,USER_AGENT_SANE_1 autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id BC56CC5519F for ; Sun, 22 Nov 2020 19:04:47 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 6DEE22076B for ; Sun, 22 Nov 2020 19:04:47 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (1024-bit key) header.d=ieee.org header.i=@ieee.org header.b="L6qvlQec" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728123AbgKVTEr (ORCPT ); Sun, 22 Nov 2020 14:04:47 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:36734 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727795AbgKVTEq (ORCPT ); Sun, 22 Nov 2020 14:04:46 -0500 Received: from mail-qt1-x843.google.com (mail-qt1-x843.google.com [IPv6:2607:f8b0:4864:20::843]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 6E91EC0613CF for ; Sun, 22 Nov 2020 11:04:46 -0800 (PST) Received: by mail-qt1-x843.google.com with SMTP id f15so7959364qto.13 for ; Sun, 22 Nov 2020 11:04:46 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ieee.org; s=google; h=subject:to:cc:references:from:message-id:date:user-agent :mime-version:in-reply-to:content-language:content-transfer-encoding; bh=+sKrqvai/EFjdts7FVMZ2aRARtrkLR8rQct1r7kzUa4=; b=L6qvlQecYGjCa7ZFqxHN02TfA4yirEmOfgVEJVWqsLlUxmE4poaXQzhNN0ZAbG0nXw oyj9AbOkBD7fBFLo+fprjEnkdJizaoHO+XkjZPtLN7+Nu19UweYArvtYfWYsywAATSgX QcXXLf5T/t8VXkpy9+rUusCtkMinV2ieYcgE4= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:to:cc:references:from:message-id:date :user-agent:mime-version:in-reply-to:content-language :content-transfer-encoding; bh=+sKrqvai/EFjdts7FVMZ2aRARtrkLR8rQct1r7kzUa4=; b=Mn2/mDih5sjDs4/XRFcz1gUlFEh/PZaAvp0B9r30cXrc69yEa3nljrzZvO9mfcpsLC Iqimrqtb/K3WZWcTEw6XC5SlCJVyHO2nWWZE/Vzuubb5onTY7WUI0pQCnBB5ti2pY6m9 1g8yFhJVKH8rnJMVoh0f5mtwGjeMa7RXxa/70T0Bi5awJDGf5qy4bJ3QtSMJs1zsXiu0 Oznc/jYVNIiAIwk7RfBrkXBDb9fBXGzxBBsf4pVyulGghNmhJ5FduufTKGTzhhHyiqwa s5owN3M1jRptSsZmEDR+ORy9rbANmAK/5H4i7lG/1X2frpPCh4NAtte4z1m/RVR54d/y BtHw== X-Gm-Message-State: AOAM531qUesaTTgGia0Q1srJK60/vySpKCZbDpM4Gtsb5nbNrWQfSjjc PdLZJBmq1dhilKhcutS/DH7S6IiUT/3JUg== X-Google-Smtp-Source: ABdhPJzPyv/uxaaT3XOnFjvjQYvGpLkaY9n5P7cabjn1zpjPAEuX8Plmba108bvw0MUgxBAQ3cXgvw== X-Received: by 2002:ac8:a01:: with SMTP id b1mr4542551qti.217.1606071885523; Sun, 22 Nov 2020 11:04:45 -0800 (PST) Received: from fedora.pebenito.net (pool-96-234-173-17.bltmmd.fios.verizon.net. [96.234.173.17]) by smtp.gmail.com with ESMTPSA id x21sm7107707qkx.31.2020.11.22.11.04.44 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Sun, 22 Nov 2020 11:04:45 -0800 (PST) Subject: Re: [PATCH 1/8] userdomain: Add watch on home dirs To: Jason Zaman , selinux-refpolicy@vger.kernel.org Cc: Jason Zaman References: <20201117034628.2461-1-jason@perfinion.com> From: Chris PeBenito Message-ID: <5ec7fa05-dbbd-1049-c0b0-445da465ea77@ieee.org> Date: Sun, 22 Nov 2020 14:03:30 -0500 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Thunderbird/78.4.0 MIME-Version: 1.0 In-Reply-To: <20201117034628.2461-1-jason@perfinion.com> Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-US Content-Transfer-Encoding: 7bit Precedence: bulk List-ID: X-Mailing-List: selinux-refpolicy@vger.kernel.org On 11/16/20 10:46 PM, Jason Zaman wrote: > From: Jason Zaman > > avc: denied { watch } for pid=12351 comm="gmain" path="/usr/share/backgrounds/xfce" dev="zfs" ino=366749 scontext=staff_u:staff_r:staff_t:s0-s0:c0.c1023 tcontext=system_u:object_r:usr_t:s0 tclass=dir permissive=0 > avc: denied { watch } for pid=11646 comm="gmain" path="/etc/fonts" dev="zfs" ino=237700 scontext=staff_u:staff_r:staff_t:s0-s0:c0.c1023 tcontext=system_u:object_r:fonts_t:s0 tclass=dir permissive=0 > avc: denied { watch } for pid=12351 comm="gmain" path="/home/jason/Desktop" dev="zfs" ino=33153 scontext=staff_u:staff_r:staff_t:s0-s0:c0.c1023 tcontext=staff_u:object_r:user_home_t:s0 tclass=dir permissive=0 > avc: denied { watch } for pid=12574 comm="gmain" path="/home/jason/.local/share/icc" dev="zfs" ino=1954514 scontext=staff_u:staff_r:staff_t:s0-s0:c0.c1023 tcontext=staff_u:object_r:xdg_data_t:s0 tclass=dir permissive=0 > avc: denied { watch } for pid=11795 comm="gmain" path="/home/jason/.config/xfce4/panel/launcher-19" dev="zfs" ino=35464 scontext=staff_u:staff_r:staff_t:s0-s0:c0.c1023 tcontext=staff_u:object_r:xdg_config_t:s0 tclass=dir permissive=0 > avc: denied { watch } for pid=12351 comm="gmain" path="/home/jason/downloads/pics" dev="zfs" ino=38173 scontext=staff_u:staff_r:staff_t:s0-s0:c0.c1023 tcontext=staff_u:object_r:xdg_downloads_t:s0 tclass=dir permissive=0 > Signed-off-by: Jason Zaman > Signed-off-by: Jason Zaman > --- > policy/modules/services/xserver.if | 11 +- > policy/modules/system/miscfiles.if | 18 +++ > policy/modules/system/userdomain.if | 15 ++- > policy/modules/system/xdg.if | 198 ++++++++++++++++++++++++++++ > 4 files changed, 240 insertions(+), 2 deletions(-) > > diff --git a/policy/modules/services/xserver.if b/policy/modules/services/xserver.if > index baa39ef87..d5d6c7914 100644 > --- a/policy/modules/services/xserver.if > +++ b/policy/modules/services/xserver.if > @@ -95,6 +95,7 @@ interface(`xserver_restricted_role',` > dev_rw_usbfs($2) > > miscfiles_read_fonts($2) > + miscfiles_watch_fonts_dirs($2) > > xserver_common_x_domain_template(user, $2) #selint-disable:S-004 > xserver_domtrans($2) > @@ -186,10 +187,13 @@ interface(`xserver_role',` > optional_policy(` > xdg_manage_all_cache($2) > xdg_relabel_all_cache($2) > + xdg_watch_all_cache_dirs($2) > xdg_manage_all_config($2) > xdg_relabel_all_config($2) > + xdg_watch_all_config_dirs($2) > xdg_manage_all_data($2) > xdg_relabel_all_data($2) > + xdg_watch_all_data_dirs($2) > > xdg_generic_user_home_dir_filetrans_cache($2, dir, ".cache") > xdg_generic_user_home_dir_filetrans_config($2, dir, ".config") > @@ -203,14 +207,19 @@ interface(`xserver_role',` > > xdg_manage_documents($2) > xdg_relabel_documents($2) > + xdg_watch_documents_dirs($2) > xdg_manage_downloads($2) > xdg_relabel_downloads($2) > + xdg_watch_downloads_dirs($2) > xdg_manage_music($2) > xdg_relabel_music($2) > + xdg_watch_music_dirs($2) > xdg_manage_pictures($2) > xdg_relabel_pictures($2) > + xdg_watch_pictures_dirs($2) > xdg_manage_videos($2) > xdg_relabel_videos($2) > + xdg_watch_videos_dirs($2) > > xdg_cache_filetrans($2, mesa_shader_cache_t, dir, "mesa_shader_cache") > ') > @@ -508,7 +517,7 @@ interface(`xserver_use_user_fonts',` > ') > > # Read per user fonts > - allow $1 user_fonts_t:dir list_dir_perms; > + allow $1 user_fonts_t:dir { list_dir_perms watch }; > allow $1 user_fonts_t:file { map read_file_perms }; > > # Manipulate the global font cache > diff --git a/policy/modules/system/miscfiles.if b/policy/modules/system/miscfiles.if > index e633217fe..354fe6fb3 100644 > --- a/policy/modules/system/miscfiles.if > +++ b/policy/modules/system/miscfiles.if > @@ -824,6 +824,24 @@ interface(`miscfiles_manage_public_files',` > manage_lnk_files_pattern($1, public_content_rw_t, public_content_rw_t) > ') > > +######################################## > +## > +## Watch public files > +## > +## > +## > +## Domain allowed access. > +## > +## > +# > +interface(`miscfiles_watch_public_dirs',` > + gen_require(` > + type public_content_rw_t; > + ') > + > + allow $1 public_content_rw_t:dir watch; > +') > + > ######################################## > ## > ## Read TeX data > diff --git a/policy/modules/system/userdomain.if b/policy/modules/system/userdomain.if > index 02ead5b2a..482af588b 100644 > --- a/policy/modules/system/userdomain.if > +++ b/policy/modules/system/userdomain.if > @@ -289,6 +289,12 @@ interface(`userdom_ro_home_role',` > read_sock_files_pattern($2, { user_home_t user_home_dir_t }, user_home_t) > files_list_home($2) > > + allow $2 { user_home_t user_home_dir_t }:dir { watch watch_mount watch_sb watch_with_perm watch_reads }; > + allow $2 user_home_t:file { watch watch_mount watch_sb watch_with_perm watch_reads }; > + allow $2 user_home_t:lnk_file { watch watch_mount watch_sb watch_with_perm watch_reads }; > + allow $2 user_home_t:sock_file { watch watch_mount watch_sb watch_with_perm watch_reads }; > + allow $2 user_home_t:fifo_file { watch watch_mount watch_sb watch_with_perm watch_reads }; > + > tunable_policy(`use_nfs_home_dirs',` > fs_list_nfs($2) > fs_read_nfs_files($2) > @@ -368,7 +374,11 @@ interface(`userdom_manage_home_role',` > # cjp: this should probably be removed: > allow $2 user_home_dir_t:dir { manage_dir_perms relabel_dir_perms }; > > - allow $2 user_home_dir_t:dir watch; > + allow $2 { user_home_t user_home_dir_t }:dir { watch watch_mount watch_sb watch_with_perm watch_reads }; > + allow $2 user_home_t:file { watch watch_mount watch_sb watch_with_perm watch_reads }; > + allow $2 user_home_t:lnk_file { watch watch_mount watch_sb watch_with_perm watch_reads }; > + allow $2 user_home_t:sock_file { watch watch_mount watch_sb watch_with_perm watch_reads }; > + allow $2 user_home_t:fifo_file { watch watch_mount watch_sb watch_with_perm watch_reads }; > > userdom_manage_user_certs($2) > userdom_user_home_dir_filetrans($2, user_cert_t, dir, ".pki") > @@ -623,6 +633,8 @@ template(`userdom_common_user_template',` > files_read_var_lib_files($1_t) > # Stat lost+found. > files_getattr_lost_found_dirs($1_t) > + files_watch_etc_dirs($1_t) > + files_watch_usr_dirs($1_t) > > fs_rw_cgroup_files($1_t) > > @@ -1171,6 +1183,7 @@ template(`userdom_unpriv_user_template', ` > files_exec_usr_files($1_t) > > miscfiles_manage_public_files($1_t) > + miscfiles_watch_public_dirs($1_t) > > tunable_policy(`user_dmesg',` > kernel_read_ring_buffer($1_t) > diff --git a/policy/modules/system/xdg.if b/policy/modules/system/xdg.if > index 11fc43069..823042414 100644 > --- a/policy/modules/system/xdg.if > +++ b/policy/modules/system/xdg.if > @@ -83,6 +83,42 @@ interface(`xdg_search_cache_dirs',` > userdom_search_user_home_dirs($1) > ') > > +######################################## > +## > +## Watch the xdg cache home directories > +## > +## > +## > +## Domain allowed access. > +## > +## > +# > +interface(`xdg_watch_cache_dirs',` > + gen_require(` > + type xdg_cache_t; > + ') > + > + allow $1 xdg_cache_t:dir watch; > +') > + > +######################################## > +## > +## Watch all the xdg cache home directories > +## > +## > +## > +## Domain allowed access. > +## > +## > +# > +interface(`xdg_watch_all_cache_dirs',` > + gen_require(` > + attribute xdg_cache_type; > + ') > + > + allow $1 xdg_cache_type:dir watch; > +') > + > ######################################## > ## > ## Read the xdg cache home files > @@ -333,6 +369,42 @@ interface(`xdg_search_config_dirs',` > userdom_search_user_home_dirs($1) > ') > > +######################################## > +## > +## Watch the xdg config home directories > +## > +## > +## > +## Domain allowed access. > +## > +## > +# > +interface(`xdg_watch_config_dirs',` > + gen_require(` > + type xdg_config_t; > + ') > + > + allow $1 xdg_config_t:dir watch; > +') > + > +######################################## > +## > +## Watch all the xdg config home directories > +## > +## > +## > +## Domain allowed access. > +## > +## > +# > +interface(`xdg_watch_all_config_dirs',` > + gen_require(` > + attribute xdg_config_type; > + ') > + > + allow $1 xdg_config_type:dir watch; > +') > + > ######################################## > ## > ## Read the xdg config home files > @@ -563,6 +635,42 @@ interface(`xdg_relabel_all_config',` > userdom_search_user_home_dirs($1) > ') > > +######################################## > +## > +## Watch the xdg data home directories > +## > +## > +## > +## Domain allowed access. > +## > +## > +# > +interface(`xdg_watch_data_dirs',` > + gen_require(` > + type xdg_data_t; > + ') > + > + allow $1 xdg_data_t:dir watch; > +') > + > +######################################## > +## > +## Watch all the xdg data home directories > +## > +## > +## > +## Domain allowed access. > +## > +## > +# > +interface(`xdg_watch_all_data_dirs',` > + gen_require(` > + attribute xdg_data_type; > + ') > + > + allow $1 xdg_data_type:dir watch; > +') > + > ######################################## > ## > ## Read the xdg data home files > @@ -793,6 +901,24 @@ interface(`xdg_relabel_all_data',` > userdom_search_user_home_dirs($1) > ') > > +######################################## > +## > +## Watch the xdg documents home directories > +## > +## > +## > +## Domain allowed access. > +## > +## > +# > +interface(`xdg_watch_documents_dirs',` > + gen_require(` > + type xdg_documents_t; > + ') > + > + allow $1 xdg_documents_t:dir watch; > +') > + > ######################################## > ## > ## Create objects in the user home dir with an automatic type transition to > @@ -865,6 +991,24 @@ interface(`xdg_relabel_documents',` > userdom_search_user_home_dirs($1) > ') > > +######################################## > +## > +## Watch the xdg downloads home directories > +## > +## > +## > +## Domain allowed access. > +## > +## > +# > +interface(`xdg_watch_downloads_dirs',` > + gen_require(` > + type xdg_downloads_t; > + ') > + > + allow $1 xdg_downloads_t:dir watch; > +') > + > ######################################### > ## > ## Read downloaded content > @@ -1006,6 +1150,24 @@ interface(`xdg_relabel_downloads',` > userdom_search_user_home_dirs($1) > ') > > +######################################## > +## > +## Watch the xdg pictures home directories > +## > +## > +## > +## Domain allowed access. > +## > +## > +# > +interface(`xdg_watch_pictures_dirs',` > + gen_require(` > + type xdg_pictures_t; > + ') > + > + allow $1 xdg_pictures_t:dir watch; > +') > + > ######################################### > ## > ## Read user pictures content > @@ -1101,6 +1263,24 @@ interface(`xdg_relabel_pictures',` > userdom_search_user_home_dirs($1) > ') > > +######################################## > +## > +## Watch the xdg music home directories > +## > +## > +## > +## Domain allowed access. > +## > +## > +# > +interface(`xdg_watch_music_dirs',` > + gen_require(` > + type xdg_music_t; > + ') > + > + allow $1 xdg_music_t:dir watch; > +') > + > ######################################### > ## > ## Read user music content > @@ -1196,6 +1376,24 @@ interface(`xdg_relabel_music',` > userdom_search_user_home_dirs($1) > ') > > +######################################## > +## > +## Watch the xdg video content > +## > +## > +## > +## Domain allowed access. > +## > +## > +# > +interface(`xdg_watch_videos_dirs',` > + gen_require(` > + type xdg_videos_t; > + ') > + > + allow $1 xdg_videos_t:dir watch; > +') > + > ######################################### > ## > ## Read user video content Merged. -- Chris PeBenito