From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-8.4 required=3.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH, MAILING_LIST_MULTI,SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED, USER_AGENT_SANE_1 autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id EE5A2C34024 for ; Mon, 17 Feb 2020 18:34:44 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id CADC62467E for ; Mon, 17 Feb 2020 18:34:44 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (1024-bit key) header.d=ieee.org header.i=@ieee.org header.b="MUx8X1Go" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1729324AbgBQSeo (ORCPT ); Mon, 17 Feb 2020 13:34:44 -0500 Received: from mail-qv1-f67.google.com ([209.85.219.67]:42890 "EHLO mail-qv1-f67.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1729252AbgBQSeo (ORCPT ); Mon, 17 Feb 2020 13:34:44 -0500 Received: by mail-qv1-f67.google.com with SMTP id dc14so7989483qvb.9 for ; Mon, 17 Feb 2020 10:34:44 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ieee.org; s=google; h=subject:to:references:from:message-id:date:user-agent:mime-version :in-reply-to:content-language:content-transfer-encoding; bh=N/htde2QhyqQjR9d/7eikCwcsYOYWovTerqOCXC4xkc=; b=MUx8X1GorUI/l0Bf+bxASzc/DJghYlQxeWbXO1+uQLIlS0hWBfsGVydfO69i/rTHB9 0Bi0NxlxzMHY04D7gmiTbJbki/JKdDbnR3ELXl9q34AFiCOY8SaOll3kN457BvLkRrzH HMS8bCrTfisUAjehXRdnK1JpOmYpmBYZxzXHU= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:to:references:from:message-id:date :user-agent:mime-version:in-reply-to:content-language :content-transfer-encoding; bh=N/htde2QhyqQjR9d/7eikCwcsYOYWovTerqOCXC4xkc=; b=neOc6DyouS7J/9SuA91VLpWTVRh0c62K+z4v65RrxtLOfrKhp4MVMWaGxSQMMeNA4a Or1R8xA3e9d3uMxkoJnfNbWVdvIhJ8FF1OF3NAT0wodO36Q91I//+9aLEDq3xl7dCAU8 oFAr2ZCyWlrAQJiTMOv2BRN+Jh6lyFweyhiNpi2zQdiQCtXa/AhSan9WBuJiDID5wBbP zNWVmhmHCVi1P3IcLJutFllfPMUwdcehiCoZd+vx/qMVDOCHgx6Xo5aott/l3PoMy5pi CnNcCzmznjMu5NFfo0DlbHQWnEzkEK1DzxLAcqhDC1iOQRqen55Mu4wgpG0zOO54jjUn hkpA== X-Gm-Message-State: APjAAAWTkTm/Faxt9ureEMXbxvxnr4zDJ5L7L5J/b8n5DNKo0oZZX4mO oclknXGluSWr33b9wEH1Vq1oNptYmPg= X-Google-Smtp-Source: APXvYqx9Ml/Ea8LH2gJ+jO/cLzdEAckm02LvmATihEl743LQzXPM1zSEXwnNnNKrRTnbHfFVfaU7Sw== X-Received: by 2002:a0c:b920:: with SMTP id u32mr13087838qvf.173.1581964483274; Mon, 17 Feb 2020 10:34:43 -0800 (PST) Received: from fedora.pebenito.net (pool-108-15-23-247.bltmmd.fios.verizon.net. [108.15.23.247]) by smtp.gmail.com with ESMTPSA id r1sm581589qtu.83.2020.02.17.10.34.42 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Mon, 17 Feb 2020 10:34:43 -0800 (PST) Subject: Re: [PATCH 06/10] policykit devicekit: Add watch perms To: Jason Zaman , selinux-refpolicy@vger.kernel.org References: <20200216200319.39337-1-jason@perfinion.com> <20200216200319.39337-6-jason@perfinion.com> From: Chris PeBenito Message-ID: <6a095c4f-6323-5ade-0aae-88d3f10c770d@ieee.org> Date: Mon, 17 Feb 2020 13:28:26 -0500 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.3.1 MIME-Version: 1.0 In-Reply-To: <20200216200319.39337-6-jason@perfinion.com> Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-US Content-Transfer-Encoding: 7bit Sender: selinux-refpolicy-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: selinux-refpolicy@vger.kernel.org On 2/16/20 3:03 PM, Jason Zaman wrote: > avc: denied { watch } for pid=12488 comm="gmain" path="/etc" dev="zfs" ino=1436 scontext=system_u:system_r:devicekit_disk_t:s0-s0:c0.c1023 tcontext=system_u:object_r:etc_t:s0 tclass=dir permissive=0 > avc: denied { watch } for pid=6452 comm="gmain" path="/run/ConsoleKit" dev="tmpfs" ino=17611 scontext=system_u:system_r:policykit_t:s0-s0:c0.c1023 tcontext=system_u:object_r:consolekit_runtime_t:s0 tclass=dir permissive=0 > avc: denied { watch } for pid=6452 comm="gmain" path="/usr/share/polkit-1/actions" dev="zfs" ino=235638 scontext=system_u:system_r:policykit_t:s0-s0:c0.c1023 tcontext=system_u:object_r:usr_t:s0 tclass=dir permissive=0 > avc: denied { watch } for pid=6452 comm="gmain" path="/etc/polkit-1/rules.d" dev="zfs" ino=268215 scontext=system_u:system_r:policykit_t:s0-s0:c0.c1023 tcontext=system_u:object_r:etc_t:s0 tclass=dir permissive=0 > Signed-off-by: Jason Zaman > --- > policy/modules/services/consolekit.if | 18 ++++++++++++++++++ > policy/modules/services/devicekit.te | 1 + > policy/modules/services/policykit.te | 3 +++ > 3 files changed, 22 insertions(+) > > diff --git a/policy/modules/services/consolekit.if b/policy/modules/services/consolekit.if > index 9aa0dbce..422c19cd 100644 > --- a/policy/modules/services/consolekit.if > +++ b/policy/modules/services/consolekit.if > @@ -121,3 +121,21 @@ interface(`consolekit_read_pid_files',` > allow $1 consolekit_runtime_t:dir list_dir_perms; > read_files_pattern($1, consolekit_runtime_t, consolekit_runtime_t) > ') > + > +######################################## > +## > +## Watch consolekit runtime dir. > +## > +## > +## > +## Domain allowed access. > +## > +## > +# > +interface(`consolekit_watch_runtime_dir',` > + gen_require(` > + type consolekit_runtime_t; > + ') > + > + allow $1 consolekit_runtime_t:dir watch; > +') > diff --git a/policy/modules/services/devicekit.te b/policy/modules/services/devicekit.te > index f58a7a19..ed88f10b 100644 > --- a/policy/modules/services/devicekit.te > +++ b/policy/modules/services/devicekit.te > @@ -127,6 +127,7 @@ files_manage_boot_dirs(devicekit_disk_t) > files_manage_mnt_dirs(devicekit_disk_t) > files_read_etc_runtime_files(devicekit_disk_t) > files_read_usr_files(devicekit_disk_t) > +files_watch_etc_dirs(devicekit_disk_t) > > fs_getattr_all_fs(devicekit_disk_t) > fs_list_inotifyfs(devicekit_disk_t) > diff --git a/policy/modules/services/policykit.te b/policy/modules/services/policykit.te > index 04e88500..4989157c 100644 > --- a/policy/modules/services/policykit.te > +++ b/policy/modules/services/policykit.te > @@ -95,6 +95,8 @@ dev_read_urand(policykit_t) > domain_read_all_domains_state(policykit_t) > > files_dontaudit_search_all_mountpoints(policykit_t) > +files_watch_etc_dirs(policykit_t) > +files_watch_usr_dirs(policykit_t) > > fs_getattr_xattr_fs(policykit_t) > fs_list_inotifyfs(policykit_t) > @@ -127,6 +129,7 @@ optional_policy(` > > optional_policy(` > consolekit_read_pid_files(policykit_t) > + consolekit_watch_runtime_dir(policykit_t) > ') > > optional_policy(` Merged. -- Chris PeBenito