selinux.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Petr Lautrbach <plautrba@redhat.com>
To: Nicolas Iooss <nicolas.iooss@m4x.org>
Cc: selinux@vger.kernel.org
Subject: Re: .desktop files installed by gui/
Date: Wed, 27 Feb 2019 15:02:06 +0100	[thread overview]
Message-ID: <pjdimx5l481.fsf@redhat.com> (raw)
In-Reply-To: <CAJfZ7=n7c8s-uiGjD=FRMahRQBQANzSa5FbRKSov4w=EZj+f-w@mail.gmail.com>


Nicolas Iooss <nicolas.iooss@m4x.org> writes:

> Hello,
>
> Currently, gui/Makefile installs three .desktop files:
> * /usr/share/system-config-selinux/selinux-polgengui.desktop 
> (with
> "Exec=/usr/bin/selinux-polgengui")
> * /usr/share/system-config-selinux/sepolicy.desktop (with
> "Exec=/usr/bin/sepolicy gui")
> * /usr/share/system-config-selinux/system-config-selinux.desktop 
> (with
> Exec=/usr/bin/system-config-selinux)
>
> There are several issues about them:
> * The first one does not work because "make install" does not 
> create
> /usr/bin/selinux-polgengui. It creates
> /usr/share/system-config-selinux/polgengui.py instead.
> * The first two ones do not work on Arch Linux because the 
> commands
> they use need to be run as root in order to load.
> * None of them are seen by GNOME or XFCE, which look for 
> .desktop
> files in /usr/share/applications/. This has been reported for 
> Arch
> Linux on https://github.com/archlinuxhardened/selinux/issues/20.
>
> Are these files used by other distributions? Would it break 
> things if
> these files are moved to /usr/share/applications/ 

This is from Fedora policycoreutils.spec:

---
ln -sf /usr/share/system-config-selinux/polgengui.py 
%{buildroot}%{_bindir}/selinux-polgengui

desktop-file-install --dir %{buildroot}%{_datadir}/applications 
--add-category Settings \
    %{buildroot}%{_datadir}/system-config-selinux/system-config-selinux.desktop

desktop-file-install --dir %{buildroot}%{_datadir}/applications 
--add-category Settings \
    %{buildroot}%{_datadir}/system-config-selinux/sepolicy.desktop

desktop-file-install --dir %{buildroot}%{_datadir}/applications \
    %{buildroot}%{_datadir}/system-config-selinux/selinux-polgengui.desktop

rm -f 
%{buildroot}%{_datadir}/system-config-selinux/selinux-polgengui.desktop
rm -f 
%{buildroot}%{_datadir}/system-config-selinux/sepolicy.desktop
rm -f 
%{buildroot}%{_datadir}/system-config-selinux/system-config-selinux.desktop
---

It's been like that for more than 6 years already.

Given that it addresses almost all the described problems I can 
say that
your proposed changes won't break anything in Fedora.

> and if pkexec is
> introduced in order to run commands as root (ie.
> selinux-polgengui.desktop is changed to "Exec=/usr/bin/pkexec
> /usr/share/system-config-selinux/polgengui.py" and 
> sepolicy.desktop to
> "Exec=/usr/bin/pkexec /usr/bin/sepolicy gui")?
>

/usr/share/system-config-selinux/polgengui.py works without root 
on
Fedora.

sepolicy gui asks for privileges on "Action:
org.selinux.customized" which is decorated by
@slip.dbus.polkit.require_auth so I'm not sure if pkexec is really 
needed.




> Nicolas


  reply	other threads:[~2019-02-27 14:02 UTC|newest]

Thread overview: 11+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2019-02-21 20:31 .desktop files installed by gui/ Nicolas Iooss
2019-02-27 14:02 ` Petr Lautrbach [this message]
2019-02-28  5:14   ` Jason Zaman
2019-03-05 16:38   ` [PATCH 1/2] gui: Install polgengui.py to /usr/bin/selinux-polgengui Petr Lautrbach
2019-03-05 16:38     ` [PATCH 2/2] gui: Install .desktop files to /usr/share/applications by default Petr Lautrbach
2019-03-17 13:35       ` Nicolas Iooss
2019-03-18 13:39         ` [PATCH v2] " Petr Lautrbach
2019-03-18 15:26           ` Petr Lautrbach
2019-03-18 21:39             ` Nicolas Iooss
2019-03-26 21:22               ` Nicolas Iooss
2019-03-17 19:11     ` [PATCH 1/2] gui: Install polgengui.py to /usr/bin/selinux-polgengui Nicolas Iooss

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=pjdimx5l481.fsf@redhat.com \
    --to=plautrba@redhat.com \
    --cc=nicolas.iooss@m4x.org \
    --cc=selinux@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).