Date:   Sun, 23 Dec 2018 17:45:12 +0100
From:   Dominick Grift <dac.override@gmail.com>
To:     Chris PeBenito <pebenito@ieee.org>,
        David Sugar <dsugar@tresys.com>,
        "selinux-refpolicy@vger.kernel.org" 
        <selinux-refpolicy@vger.kernel.org>
Subject: Re: [PATCH 1/2] Allow greeter to start dbus and transition
Message-ID: <20181223164512.GG20992@brutus.lan>
Mail-Followup-To: Chris PeBenito <pebenito@ieee.org>,
        David Sugar <dsugar@tresys.com>,
        "selinux-refpolicy@vger.kernel.org" <selinux-refpolicy@vger.kernel.org>
References: <20181221014026.2867-1-dsugar@tresys.com>
 <d3540f39-c75b-ea1b-6a63-f507b71a9f5c@ieee.org>
 <20181223163359.GF20992@brutus.lan>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha256;
        protocol="application/pgp-signature"; boundary="VACxsDaSTfeluoxK"
Content-Disposition: inline
In-Reply-To: <20181223163359.GF20992@brutus.lan>
User-Agent: Every email client sucks, this one just sucks less.
Sender: selinux-refpolicy-owner@vger.kernel.org
Precedence: bulk


--VACxsDaSTfeluoxK
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Sun, Dec 23, 2018 at 05:33:59PM +0100, Dominick Grift wrote:
> On Sat, Dec 22, 2018 at 02:28:15PM -0500, Chris PeBenito wrote:
> > On 12/20/18 8:41 PM, David Sugar wrote:
> > > The display manager lightdm (and I think gdm) start a dbus binary.
> > > This allows that to happen in a special dbus domain.
> > >=20
> > > type=3DAVC msg=3Daudit(1544626796.378:201): avc:  denied  { execute }=
 for  pid=3D9973 comm=3D"dbus-launch" name=3D"dbus-daemon" dev=3D"dm-1" ino=
=3D6695040 scontext=3Dsystem_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=3Dsys=
tem_u:object_r:dbusd_exec_t:s0 tclass=3Dfile permissive=3D1
> > > type=3DAVC msg=3Daudit(1544626796.378:201): avc:  denied  { read open=
 } for  pid=3D9973 comm=3D"dbus-launch" path=3D"/usr/bin/dbus-daemon" dev=
=3D"dm-1" ino=3D6695040 scontext=3Dsystem_u:system_r:xdm_t:s0-s0:c0.c1023 t=
context=3Dsystem_u:object_r:dbusd_exec_t:s0 tclass=3Dfile permissive=3D1
> > > type=3DAVC msg=3Daudit(1544626796.378:201): avc:  denied  { execute_n=
o_trans } for  pid=3D9973 comm=3D"dbus-launch" path=3D"/usr/bin/dbus-daemon=
" dev=3D"dm-1" ino=3D6695040 scontext=3Dsystem_u:system_r:xdm_t:s0-s0:c0.c1=
023 tcontext=3Dsystem_u:object_r:dbusd_exec_t:s0 tclass=3Dfile permissive=
=3D1
> > > type=3DAVC msg=3Daudit(1544626796.378:201): avc:  denied  { map } for=
  pid=3D9973 comm=3D"dbus-daemon" path=3D"/usr/bin/dbus-daemon" dev=3D"dm-1=
" ino=3D6695040 scontext=3Dsystem_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=
=3Dsystem_u:object_r:dbusd_exec_t:s0 tclass=3Dfile permissive=3D1
> > > type=3DAVC msg=3Daudit(1544628523.635:3208): avc:  denied  { execute =
} for  pid=3D16376 comm=3D"at-spi-bus-laun" name=3D"dbus-daemon" dev=3D"dm-=
1" ino=3D6695040 scontext=3Dsystem_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=
=3Dsystem_u:object_r:dbusd_exec_t:s0 tclass=3Dfile permissive=3D1
> > > type=3DAVC msg=3Daudit(1544628523.635:3208): avc:  denied  { read ope=
n } for  pid=3D16376 comm=3D"at-spi-bus-laun" path=3D"/usr/bin/dbus-daemon"=
 dev=3D"dm-1" ino=3D6695040 scontext=3Dsystem_u:system_r:xdm_t:s0-s0:c0.c10=
23 tcontext=3Dsystem_u:object_r:dbusd_exec_t:s0 tclass=3Dfile permissive=3D1
> > > type=3DAVC msg=3Daudit(1544628523.635:3208): avc:  denied  { execute_=
no_trans } for  pid=3D16376 comm=3D"at-spi-bus-laun" path=3D"/usr/bin/dbus-=
daemon" dev=3D"dm-1" ino=3D6695040 scontext=3Dsystem_u:system_r:xdm_t:s0-s0=
:c0.c1023 tcontext=3Dsystem_u:object_r:dbusd_exec_t:s0 tclass=3Dfile permis=
sive=3D1
> > > type=3DAVC msg=3Daudit(1544628523.635:3208): avc:  denied  { map } fo=
r  pid=3D16376 comm=3D"dbus-daemon" path=3D"/usr/bin/dbus-daemon" dev=3D"dm=
-1" ino=3D6695040 scontext=3Dsystem_u:system_r:xdm_t:s0-s0:c0.c1023 tcontex=
t=3Dsystem_u:object_r:dbusd_exec_t:s0 tclass=3Dfile permissive=3D1
> > >=20
> > > Signed-off-by: Dave Sugar <dsugar@tresys.com>
> > > ---
> > >   policy/modules/services/xserver.te | 1 +
> > >   1 file changed, 1 insertion(+)
> > >=20
> > > diff --git a/policy/modules/services/xserver.te b/policy/modules/serv=
ices/xserver.te
> > > index fa7ce88e..12ad3a87 100644
> > > --- a/policy/modules/services/xserver.te
> > > +++ b/policy/modules/services/xserver.te
> > > @@ -568,6 +568,7 @@ optional_policy(`
> > >   optional_policy(`
> > >   	dbus_system_bus_client(xdm_t)
> > >   	dbus_connect_system_bus(xdm_t)
> > > +	dbus_role_template(xdm, system_r, xdm_t)
> > >   	optional_policy(`
> > >   		accountsd_dbus_chat(xdm_t)
> >=20
> > This doesn't sit well with me.  XDM isn't a user, or is system_r a user
> > role, so it shouldn't be using this template.  On my system,
> > at-spi-bus-launcher is running as part of my user session, not as part =
of
> > XDM.  It seems like this may be a transition problem.
>=20
> It does not sit well with me either but gdm is actually a "user" in way's=
=2E and it has a session.
>=20
> the gdm DM policy should never have been merged with XDM DM policy as XDM=
 is much cleaner.
>=20
> GDM is nasty

In dssp2 i actually have a seuser for gdm:

# seinfo -xugdm.id

Users: 1
   user gdm.id roles sys.role level s0 range s0;

And believe me, I did not do that for fun. In distributions with systemd --=
user this is just needed because
systemd will spawn a --user instance for gdm and this user instance spawns =
all kinds of processes on gdm's behalf

for example dbus instance, the last thing you want is to have a gdm dbus in=
stance running with system_dbusd_t

>=20
> >=20
> > --=20
> > Chris PeBenito
>=20
> --=20
> Key fingerprint =3D 5F4D 3CDB D3F8 3652 FBD8 02D5 3B6C 5F1D 2C7B 6B02
> https://sks-keyservers.net/pks/lookup?op=3Dget&search=3D0x3B6C5F1D2C7B6B02
> Dominick Grift


--=20
Key fingerprint =3D 5F4D 3CDB D3F8 3652 FBD8 02D5 3B6C 5F1D 2C7B 6B02
https://sks-keyservers.net/pks/lookup?op=3Dget&search=3D0x3B6C5F1D2C7B6B02
Dominick Grift

--VACxsDaSTfeluoxK
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQGzBAEBCAAdFiEEujmXliIBLFTc2Y4AJXSOVTf5R2kFAlwfu5QACgkQJXSOVTf5
R2m9GQv/YZCSdZ21/GZ9H79o1m0JcOW4ruGbeP7pW1QavxgLaSYz9z1GNU7WSRFQ
43uZwLGIB6PRz+Xmjgkg42MMeT1SuJzdPz6cDPGh0WG+7lyr2wFJO9R7KVjQLC9F
sK30tJ2H8HIRwYwJ3eHvNIL30v61P6EL/SqYmJzqUBW4gx+RLyehpjEMhVra9i+H
QKgwTh3NrUhlw0qiOur3HGXQfbBMB9HJZzlZaO5QoiNBplOWpD7g3k0EQcX4/e0L
bggFLrN0XJ4h53tmWmxHNtzMJ/rbYwxjJRjXKAR54kgUeFViFk5CopLtpJgqKY9b
wvQq/q7WmOoh66qBCTeZVATGR8usq95ySg6q0asF6Tsktm1cfixCoeIadSFMxFRk
VcaOKwKWsTRCg6NZCx5/b62MUbhNfG25OtBpwNKoHHzx54aCzyRKBxZA4XyHLu0X
m/WCGAlBtKrjgEFcd6W74w1kriBAGli8J5fCGi/P6ENUMrF6ScowVxNc+O1wSe6d
y5ttSi4b
=VJtb
-----END PGP SIGNATURE-----

--VACxsDaSTfeluoxK--