Date:   Sun, 23 Dec 2018 17:33:59 +0100
From:   Dominick Grift <dac.override@gmail.com>
To:     Chris PeBenito <pebenito@ieee.org>
Cc:     David Sugar <dsugar@tresys.com>,
        "selinux-refpolicy@vger.kernel.org" 
        <selinux-refpolicy@vger.kernel.org>
Subject: Re: [PATCH 1/2] Allow greeter to start dbus and transition
Message-ID: <20181223163359.GF20992@brutus.lan>
Mail-Followup-To: Chris PeBenito <pebenito@ieee.org>,
        David Sugar <dsugar@tresys.com>,
        "selinux-refpolicy@vger.kernel.org" <selinux-refpolicy@vger.kernel.org>
References: <20181221014026.2867-1-dsugar@tresys.com>
 <d3540f39-c75b-ea1b-6a63-f507b71a9f5c@ieee.org>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha256;
        protocol="application/pgp-signature"; boundary="1Y7d0dPL928TPQbc"
Content-Disposition: inline
In-Reply-To: <d3540f39-c75b-ea1b-6a63-f507b71a9f5c@ieee.org>
User-Agent: Every email client sucks, this one just sucks less.
Sender: selinux-refpolicy-owner@vger.kernel.org
Precedence: bulk


--1Y7d0dPL928TPQbc
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Sat, Dec 22, 2018 at 02:28:15PM -0500, Chris PeBenito wrote:
> On 12/20/18 8:41 PM, David Sugar wrote:
> > The display manager lightdm (and I think gdm) start a dbus binary.
> > This allows that to happen in a special dbus domain.
> >=20
> > type=3DAVC msg=3Daudit(1544626796.378:201): avc:  denied  { execute } f=
or  pid=3D9973 comm=3D"dbus-launch" name=3D"dbus-daemon" dev=3D"dm-1" ino=
=3D6695040 scontext=3Dsystem_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=3Dsys=
tem_u:object_r:dbusd_exec_t:s0 tclass=3Dfile permissive=3D1
> > type=3DAVC msg=3Daudit(1544626796.378:201): avc:  denied  { read open }=
 for  pid=3D9973 comm=3D"dbus-launch" path=3D"/usr/bin/dbus-daemon" dev=3D"=
dm-1" ino=3D6695040 scontext=3Dsystem_u:system_r:xdm_t:s0-s0:c0.c1023 tcont=
ext=3Dsystem_u:object_r:dbusd_exec_t:s0 tclass=3Dfile permissive=3D1
> > type=3DAVC msg=3Daudit(1544626796.378:201): avc:  denied  { execute_no_=
trans } for  pid=3D9973 comm=3D"dbus-launch" path=3D"/usr/bin/dbus-daemon" =
dev=3D"dm-1" ino=3D6695040 scontext=3Dsystem_u:system_r:xdm_t:s0-s0:c0.c102=
3 tcontext=3Dsystem_u:object_r:dbusd_exec_t:s0 tclass=3Dfile permissive=3D1
> > type=3DAVC msg=3Daudit(1544626796.378:201): avc:  denied  { map } for  =
pid=3D9973 comm=3D"dbus-daemon" path=3D"/usr/bin/dbus-daemon" dev=3D"dm-1" =
ino=3D6695040 scontext=3Dsystem_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=3D=
system_u:object_r:dbusd_exec_t:s0 tclass=3Dfile permissive=3D1
> > type=3DAVC msg=3Daudit(1544628523.635:3208): avc:  denied  { execute } =
for  pid=3D16376 comm=3D"at-spi-bus-laun" name=3D"dbus-daemon" dev=3D"dm-1"=
 ino=3D6695040 scontext=3Dsystem_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=
=3Dsystem_u:object_r:dbusd_exec_t:s0 tclass=3Dfile permissive=3D1
> > type=3DAVC msg=3Daudit(1544628523.635:3208): avc:  denied  { read open =
} for  pid=3D16376 comm=3D"at-spi-bus-laun" path=3D"/usr/bin/dbus-daemon" d=
ev=3D"dm-1" ino=3D6695040 scontext=3Dsystem_u:system_r:xdm_t:s0-s0:c0.c1023=
 tcontext=3Dsystem_u:object_r:dbusd_exec_t:s0 tclass=3Dfile permissive=3D1
> > type=3DAVC msg=3Daudit(1544628523.635:3208): avc:  denied  { execute_no=
_trans } for  pid=3D16376 comm=3D"at-spi-bus-laun" path=3D"/usr/bin/dbus-da=
emon" dev=3D"dm-1" ino=3D6695040 scontext=3Dsystem_u:system_r:xdm_t:s0-s0:c=
0.c1023 tcontext=3Dsystem_u:object_r:dbusd_exec_t:s0 tclass=3Dfile permissi=
ve=3D1
> > type=3DAVC msg=3Daudit(1544628523.635:3208): avc:  denied  { map } for =
 pid=3D16376 comm=3D"dbus-daemon" path=3D"/usr/bin/dbus-daemon" dev=3D"dm-1=
" ino=3D6695040 scontext=3Dsystem_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=
=3Dsystem_u:object_r:dbusd_exec_t:s0 tclass=3Dfile permissive=3D1
> >=20
> > Signed-off-by: Dave Sugar <dsugar@tresys.com>
> > ---
> >   policy/modules/services/xserver.te | 1 +
> >   1 file changed, 1 insertion(+)
> >=20
> > diff --git a/policy/modules/services/xserver.te b/policy/modules/servic=
es/xserver.te
> > index fa7ce88e..12ad3a87 100644
> > --- a/policy/modules/services/xserver.te
> > +++ b/policy/modules/services/xserver.te
> > @@ -568,6 +568,7 @@ optional_policy(`
> >   optional_policy(`
> >   	dbus_system_bus_client(xdm_t)
> >   	dbus_connect_system_bus(xdm_t)
> > +	dbus_role_template(xdm, system_r, xdm_t)
> >   	optional_policy(`
> >   		accountsd_dbus_chat(xdm_t)
>=20
> This doesn't sit well with me.  XDM isn't a user, or is system_r a user
> role, so it shouldn't be using this template.  On my system,
> at-spi-bus-launcher is running as part of my user session, not as part of
> XDM.  It seems like this may be a transition problem.

It does not sit well with me either but gdm is actually a "user" in way's. =
and it has a session.

the gdm DM policy should never have been merged with XDM DM policy as XDM i=
s much cleaner.

GDM is nasty

>=20
> --=20
> Chris PeBenito

--=20
Key fingerprint =3D 5F4D 3CDB D3F8 3652 FBD8 02D5 3B6C 5F1D 2C7B 6B02
https://sks-keyservers.net/pks/lookup?op=3Dget&search=3D0x3B6C5F1D2C7B6B02
Dominick Grift

--1Y7d0dPL928TPQbc
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQGzBAEBCAAdFiEEujmXliIBLFTc2Y4AJXSOVTf5R2kFAlwfuPMACgkQJXSOVTf5
R2nUyQv/Y92xiqqVoppBFsKTBLErX4eYpWfbY3QCEcybyQ6RKiZW2JDKuhWiKaiu
m3XWKwL6HOMHintxRVJH/2UOp3ioNKNu2lm5x680gObn1M1XsrtXdR+0kCY477+N
bgPhzwRLPoID0Xwoqylxb0nSrRr4zQPwg7LH1zB7vMwyHgkMrbwrxYKFc9IbaYmG
OCabR3i1P1pSzN/6xnnzbIXtGeNDxXi9DVLERkZ+JsfUYmLNj9Pr0BjJYzHoa6+N
tB1Y4oC8RnN8EmkirZAYIa2Jc5HVEFIFlY64IejVCoF1kjhKHlUO4Zkx6EkCla/6
WMTfvLyO3JfsxAyjmRur2+gEc6A5O+ublIOYtV1tyA/EOoo1mb5blwG2Wn3mOrbg
MfxIRWxLfJyRIafUPdCQ5kqC7Ki8IExbqNptoKvNglFPYgBQtCRq1eA9OM8JmZwO
M5/3bzJOL5kHp1ztqgWNhGTiOhE4qD9raR6jCEC5Xl+vWjDIWc9qX32vqSCti0Sz
eFNy9QDS
=Z5D4
-----END PGP SIGNATURE-----

--1Y7d0dPL928TPQbc--