Date:   Sun, 23 Dec 2018 17:52:06 +0100
From:   Dominick Grift <dac.override@gmail.com>
To:     Chris PeBenito <pebenito@ieee.org>,
        David Sugar <dsugar@tresys.com>,
        "selinux-refpolicy@vger.kernel.org" 
        <selinux-refpolicy@vger.kernel.org>
Subject: Re: [PATCH 1/2] Allow greeter to start dbus and transition
Message-ID: <20181223165206.GH20992@brutus.lan>
Mail-Followup-To: Chris PeBenito <pebenito@ieee.org>,
        David Sugar <dsugar@tresys.com>,
        "selinux-refpolicy@vger.kernel.org" <selinux-refpolicy@vger.kernel.org>
References: <20181221014026.2867-1-dsugar@tresys.com>
 <d3540f39-c75b-ea1b-6a63-f507b71a9f5c@ieee.org>
 <20181223163359.GF20992@brutus.lan>
 <20181223164512.GG20992@brutus.lan>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha256;
        protocol="application/pgp-signature"; boundary="3ecMC0kzqsE2ddMN"
Content-Disposition: inline
In-Reply-To: <20181223164512.GG20992@brutus.lan>
User-Agent: Every email client sucks, this one just sucks less.
Sender: selinux-refpolicy-owner@vger.kernel.org
Precedence: bulk


--3ecMC0kzqsE2ddMN
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Sun, Dec 23, 2018 at 05:45:12PM +0100, Dominick Grift wrote:
> On Sun, Dec 23, 2018 at 05:33:59PM +0100, Dominick Grift wrote:
> > On Sat, Dec 22, 2018 at 02:28:15PM -0500, Chris PeBenito wrote:
> > > On 12/20/18 8:41 PM, David Sugar wrote:
> > > > The display manager lightdm (and I think gdm) start a dbus binary.
> > > > This allows that to happen in a special dbus domain.
> > > >=20
> > > > type=3DAVC msg=3Daudit(1544626796.378:201): avc:  denied  { execute=
 } for  pid=3D9973 comm=3D"dbus-launch" name=3D"dbus-daemon" dev=3D"dm-1" i=
no=3D6695040 scontext=3Dsystem_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=3Ds=
ystem_u:object_r:dbusd_exec_t:s0 tclass=3Dfile permissive=3D1
> > > > type=3DAVC msg=3Daudit(1544626796.378:201): avc:  denied  { read op=
en } for  pid=3D9973 comm=3D"dbus-launch" path=3D"/usr/bin/dbus-daemon" dev=
=3D"dm-1" ino=3D6695040 scontext=3Dsystem_u:system_r:xdm_t:s0-s0:c0.c1023 t=
context=3Dsystem_u:object_r:dbusd_exec_t:s0 tclass=3Dfile permissive=3D1
> > > > type=3DAVC msg=3Daudit(1544626796.378:201): avc:  denied  { execute=
_no_trans } for  pid=3D9973 comm=3D"dbus-launch" path=3D"/usr/bin/dbus-daem=
on" dev=3D"dm-1" ino=3D6695040 scontext=3Dsystem_u:system_r:xdm_t:s0-s0:c0.=
c1023 tcontext=3Dsystem_u:object_r:dbusd_exec_t:s0 tclass=3Dfile permissive=
=3D1
> > > > type=3DAVC msg=3Daudit(1544626796.378:201): avc:  denied  { map } f=
or  pid=3D9973 comm=3D"dbus-daemon" path=3D"/usr/bin/dbus-daemon" dev=3D"dm=
-1" ino=3D6695040 scontext=3Dsystem_u:system_r:xdm_t:s0-s0:c0.c1023 tcontex=
t=3Dsystem_u:object_r:dbusd_exec_t:s0 tclass=3Dfile permissive=3D1
> > > > type=3DAVC msg=3Daudit(1544628523.635:3208): avc:  denied  { execut=
e } for  pid=3D16376 comm=3D"at-spi-bus-laun" name=3D"dbus-daemon" dev=3D"d=
m-1" ino=3D6695040 scontext=3Dsystem_u:system_r:xdm_t:s0-s0:c0.c1023 tconte=
xt=3Dsystem_u:object_r:dbusd_exec_t:s0 tclass=3Dfile permissive=3D1
> > > > type=3DAVC msg=3Daudit(1544628523.635:3208): avc:  denied  { read o=
pen } for  pid=3D16376 comm=3D"at-spi-bus-laun" path=3D"/usr/bin/dbus-daemo=
n" dev=3D"dm-1" ino=3D6695040 scontext=3Dsystem_u:system_r:xdm_t:s0-s0:c0.c=
1023 tcontext=3Dsystem_u:object_r:dbusd_exec_t:s0 tclass=3Dfile permissive=
=3D1
> > > > type=3DAVC msg=3Daudit(1544628523.635:3208): avc:  denied  { execut=
e_no_trans } for  pid=3D16376 comm=3D"at-spi-bus-laun" path=3D"/usr/bin/dbu=
s-daemon" dev=3D"dm-1" ino=3D6695040 scontext=3Dsystem_u:system_r:xdm_t:s0-=
s0:c0.c1023 tcontext=3Dsystem_u:object_r:dbusd_exec_t:s0 tclass=3Dfile perm=
issive=3D1
> > > > type=3DAVC msg=3Daudit(1544628523.635:3208): avc:  denied  { map } =
for  pid=3D16376 comm=3D"dbus-daemon" path=3D"/usr/bin/dbus-daemon" dev=3D"=
dm-1" ino=3D6695040 scontext=3Dsystem_u:system_r:xdm_t:s0-s0:c0.c1023 tcont=
ext=3Dsystem_u:object_r:dbusd_exec_t:s0 tclass=3Dfile permissive=3D1
> > > >=20
> > > > Signed-off-by: Dave Sugar <dsugar@tresys.com>
> > > > ---
> > > >   policy/modules/services/xserver.te | 1 +
> > > >   1 file changed, 1 insertion(+)
> > > >=20
> > > > diff --git a/policy/modules/services/xserver.te b/policy/modules/se=
rvices/xserver.te
> > > > index fa7ce88e..12ad3a87 100644
> > > > --- a/policy/modules/services/xserver.te
> > > > +++ b/policy/modules/services/xserver.te
> > > > @@ -568,6 +568,7 @@ optional_policy(`
> > > >   optional_policy(`
> > > >   	dbus_system_bus_client(xdm_t)
> > > >   	dbus_connect_system_bus(xdm_t)
> > > > +	dbus_role_template(xdm, system_r, xdm_t)
> > > >   	optional_policy(`
> > > >   		accountsd_dbus_chat(xdm_t)
> > >=20
> > > This doesn't sit well with me.  XDM isn't a user, or is system_r a us=
er
> > > role, so it shouldn't be using this template.  On my system,
> > > at-spi-bus-launcher is running as part of my user session, not as par=
t of
> > > XDM.  It seems like this may be a transition problem.
> >=20
> > It does not sit well with me either but gdm is actually a "user" in way=
's. and it has a session.
> >=20
> > the gdm DM policy should never have been merged with XDM DM policy as X=
DM is much cleaner.
> >=20
> > GDM is nasty
>=20
> In dssp2 i actually have a seuser for gdm:
>=20
> # seinfo -xugdm.id
>=20
> Users: 1
>    user gdm.id roles sys.role level s0 range s0;
>=20
> And believe me, I did not do that for fun. In distributions with systemd =
--user this is just needed because
> systemd will spawn a --user instance for gdm and this user instance spawn=
s all kinds of processes on gdm's behalf
>=20
> for example dbus instance, the last thing you want is to have a gdm dbus =
instance running with system_dbusd_t

then again, in dssp2 i just run pretty much everything in "gdm_t"
so maybe a dbus_exec() is more appropriate (and simpler)

>=20
> >=20
> > >=20
> > > --=20
> > > Chris PeBenito
> >=20
> > --=20
> > Key fingerprint =3D 5F4D 3CDB D3F8 3652 FBD8 02D5 3B6C 5F1D 2C7B 6B02
> > https://sks-keyservers.net/pks/lookup?op=3Dget&search=3D0x3B6C5F1D2C7B6=
B02
> > Dominick Grift
>=20
>=20
>=20
> --=20
> Key fingerprint =3D 5F4D 3CDB D3F8 3652 FBD8 02D5 3B6C 5F1D 2C7B 6B02
> https://sks-keyservers.net/pks/lookup?op=3Dget&search=3D0x3B6C5F1D2C7B6B02
> Dominick Grift


--=20
Key fingerprint =3D 5F4D 3CDB D3F8 3652 FBD8 02D5 3B6C 5F1D 2C7B 6B02
https://sks-keyservers.net/pks/lookup?op=3Dget&search=3D0x3B6C5F1D2C7B6B02
Dominick Grift

--3ecMC0kzqsE2ddMN
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQGzBAEBCAAdFiEEujmXliIBLFTc2Y4AJXSOVTf5R2kFAlwfvTIACgkQJXSOVTf5
R2ktZQv/UnobR8H2bhwJu2rIW/JLiv6NWQ4X6WNFQ0WtQtwHIOyYLt3fzsEsn/S1
mBIXxdIl/7FpQiwAu+qSQuvysH3Drnphd0Dtkwpa4Nd/XZuVI1b4IQnErxV1hxb2
uQG2n/XXliooKVFfLt8YPBHUPYQTUeGd/TKOSFDrSCxmvjIS5AQ6aTL6DzSK9XQx
kqnpNbGIXI59XOfcXjNESyRibRFvK4kdqcZi/H1PK8KxBWJv5PmSlaEHsqaMTlPO
pftURJT5bitXLCThnvnBe2ks2w+mqsLE9TqB+Ah09h0KZFZ8GPpIWY03Xl5Cff0+
uDYREmyMpZPhY3HX4J7+o4EOb3mDBvbCvfYklsPvRkg117MQCE8eKxNBUBFPgDvE
oW4CgYw5EU15NFQ43tWXLJ+7kij063oRKsAjrhvzGBQkGfur1EPRb8X+rkhk9Xka
IA3ccDyN/sgbmgaFTlHHZXPQ7XOD0/qTF6/mgVT/2XkIZ1L3spIyY2F12F05HEUq
3XyAfYXz
=b6Td
-----END PGP SIGNATURE-----

--3ecMC0kzqsE2ddMN--