Date:   Sun, 23 Dec 2018 17:55:10 +0100
From:   Dominick Grift <dac.override@gmail.com>
To:     Chris PeBenito <pebenito@ieee.org>,
        David Sugar <dsugar@tresys.com>,
        "selinux-refpolicy@vger.kernel.org" 
        <selinux-refpolicy@vger.kernel.org>
Subject: Re: [PATCH 1/2] Allow greeter to start dbus and transition
Message-ID: <20181223165510.GI20992@brutus.lan>
Mail-Followup-To: Chris PeBenito <pebenito@ieee.org>,
        David Sugar <dsugar@tresys.com>,
        "selinux-refpolicy@vger.kernel.org" <selinux-refpolicy@vger.kernel.org>
References: <20181221014026.2867-1-dsugar@tresys.com>
 <d3540f39-c75b-ea1b-6a63-f507b71a9f5c@ieee.org>
 <20181223163359.GF20992@brutus.lan>
 <20181223164512.GG20992@brutus.lan>
 <20181223165206.GH20992@brutus.lan>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha256;
        protocol="application/pgp-signature"; boundary="BWWlCdgt6QLN7tv3"
Content-Disposition: inline
In-Reply-To: <20181223165206.GH20992@brutus.lan>
User-Agent: Every email client sucks, this one just sucks less.
Sender: selinux-refpolicy-owner@vger.kernel.org
Precedence: bulk


--BWWlCdgt6QLN7tv3
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Sun, Dec 23, 2018 at 05:52:06PM +0100, Dominick Grift wrote:
> On Sun, Dec 23, 2018 at 05:45:12PM +0100, Dominick Grift wrote:
> > On Sun, Dec 23, 2018 at 05:33:59PM +0100, Dominick Grift wrote:
> > > On Sat, Dec 22, 2018 at 02:28:15PM -0500, Chris PeBenito wrote:
> > > > On 12/20/18 8:41 PM, David Sugar wrote:
> > > > > The display manager lightdm (and I think gdm) start a dbus binary.
> > > > > This allows that to happen in a special dbus domain.
> > > > >=20
> > > > > type=3DAVC msg=3Daudit(1544626796.378:201): avc:  denied  { execu=
te } for  pid=3D9973 comm=3D"dbus-launch" name=3D"dbus-daemon" dev=3D"dm-1"=
 ino=3D6695040 scontext=3Dsystem_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=
=3Dsystem_u:object_r:dbusd_exec_t:s0 tclass=3Dfile permissive=3D1
> > > > > type=3DAVC msg=3Daudit(1544626796.378:201): avc:  denied  { read =
open } for  pid=3D9973 comm=3D"dbus-launch" path=3D"/usr/bin/dbus-daemon" d=
ev=3D"dm-1" ino=3D6695040 scontext=3Dsystem_u:system_r:xdm_t:s0-s0:c0.c1023=
 tcontext=3Dsystem_u:object_r:dbusd_exec_t:s0 tclass=3Dfile permissive=3D1
> > > > > type=3DAVC msg=3Daudit(1544626796.378:201): avc:  denied  { execu=
te_no_trans } for  pid=3D9973 comm=3D"dbus-launch" path=3D"/usr/bin/dbus-da=
emon" dev=3D"dm-1" ino=3D6695040 scontext=3Dsystem_u:system_r:xdm_t:s0-s0:c=
0.c1023 tcontext=3Dsystem_u:object_r:dbusd_exec_t:s0 tclass=3Dfile permissi=
ve=3D1
> > > > > type=3DAVC msg=3Daudit(1544626796.378:201): avc:  denied  { map }=
 for  pid=3D9973 comm=3D"dbus-daemon" path=3D"/usr/bin/dbus-daemon" dev=3D"=
dm-1" ino=3D6695040 scontext=3Dsystem_u:system_r:xdm_t:s0-s0:c0.c1023 tcont=
ext=3Dsystem_u:object_r:dbusd_exec_t:s0 tclass=3Dfile permissive=3D1
> > > > > type=3DAVC msg=3Daudit(1544628523.635:3208): avc:  denied  { exec=
ute } for  pid=3D16376 comm=3D"at-spi-bus-laun" name=3D"dbus-daemon" dev=3D=
"dm-1" ino=3D6695040 scontext=3Dsystem_u:system_r:xdm_t:s0-s0:c0.c1023 tcon=
text=3Dsystem_u:object_r:dbusd_exec_t:s0 tclass=3Dfile permissive=3D1
> > > > > type=3DAVC msg=3Daudit(1544628523.635:3208): avc:  denied  { read=
 open } for  pid=3D16376 comm=3D"at-spi-bus-laun" path=3D"/usr/bin/dbus-dae=
mon" dev=3D"dm-1" ino=3D6695040 scontext=3Dsystem_u:system_r:xdm_t:s0-s0:c0=
=2Ec1023 tcontext=3Dsystem_u:object_r:dbusd_exec_t:s0 tclass=3Dfile permiss=
ive=3D1
> > > > > type=3DAVC msg=3Daudit(1544628523.635:3208): avc:  denied  { exec=
ute_no_trans } for  pid=3D16376 comm=3D"at-spi-bus-laun" path=3D"/usr/bin/d=
bus-daemon" dev=3D"dm-1" ino=3D6695040 scontext=3Dsystem_u:system_r:xdm_t:s=
0-s0:c0.c1023 tcontext=3Dsystem_u:object_r:dbusd_exec_t:s0 tclass=3Dfile pe=
rmissive=3D1
> > > > > type=3DAVC msg=3Daudit(1544628523.635:3208): avc:  denied  { map =
} for  pid=3D16376 comm=3D"dbus-daemon" path=3D"/usr/bin/dbus-daemon" dev=
=3D"dm-1" ino=3D6695040 scontext=3Dsystem_u:system_r:xdm_t:s0-s0:c0.c1023 t=
context=3Dsystem_u:object_r:dbusd_exec_t:s0 tclass=3Dfile permissive=3D1
> > > > >=20
> > > > > Signed-off-by: Dave Sugar <dsugar@tresys.com>
> > > > > ---
> > > > >   policy/modules/services/xserver.te | 1 +
> > > > >   1 file changed, 1 insertion(+)
> > > > >=20
> > > > > diff --git a/policy/modules/services/xserver.te b/policy/modules/=
services/xserver.te
> > > > > index fa7ce88e..12ad3a87 100644
> > > > > --- a/policy/modules/services/xserver.te
> > > > > +++ b/policy/modules/services/xserver.te
> > > > > @@ -568,6 +568,7 @@ optional_policy(`
> > > > >   optional_policy(`
> > > > >   	dbus_system_bus_client(xdm_t)
> > > > >   	dbus_connect_system_bus(xdm_t)
> > > > > +	dbus_role_template(xdm, system_r, xdm_t)
> > > > >   	optional_policy(`
> > > > >   		accountsd_dbus_chat(xdm_t)
> > > >=20
> > > > This doesn't sit well with me.  XDM isn't a user, or is system_r a =
user
> > > > role, so it shouldn't be using this template.  On my system,
> > > > at-spi-bus-launcher is running as part of my user session, not as p=
art of
> > > > XDM.  It seems like this may be a transition problem.
> > >=20
> > > It does not sit well with me either but gdm is actually a "user" in w=
ay's. and it has a session.
> > >=20
> > > the gdm DM policy should never have been merged with XDM DM policy as=
 XDM is much cleaner.
> > >=20
> > > GDM is nasty
> >=20
> > In dssp2 i actually have a seuser for gdm:
> >=20
> > # seinfo -xugdm.id
> >=20
> > Users: 1
> >    user gdm.id roles sys.role level s0 range s0;
> >=20
> > And believe me, I did not do that for fun. In distributions with system=
d --user this is just needed because
> > systemd will spawn a --user instance for gdm and this user instance spa=
wns all kinds of processes on gdm's behalf
> >=20
> > for example dbus instance, the last thing you want is to have a gdm dbu=
s instance running with system_dbusd_t
>=20
> then again, in dssp2 i just run pretty much everything in "gdm_t"
> so maybe a dbus_exec() is more appropriate (and simpler)

https://github.com/DefenSec/dssp2-standard/blob/master/policy/gnome/g/gdm.c=
il#L218

>=20
> >=20
> > >=20
> > > >=20
> > > > --=20
> > > > Chris PeBenito
> > >=20
> > > --=20
> > > Key fingerprint =3D 5F4D 3CDB D3F8 3652 FBD8 02D5 3B6C 5F1D 2C7B 6B02
> > > https://sks-keyservers.net/pks/lookup?op=3Dget&search=3D0x3B6C5F1D2C7=
B6B02
> > > Dominick Grift
> >=20
> >=20
> >=20
> > --=20
> > Key fingerprint =3D 5F4D 3CDB D3F8 3652 FBD8 02D5 3B6C 5F1D 2C7B 6B02
> > https://sks-keyservers.net/pks/lookup?op=3Dget&search=3D0x3B6C5F1D2C7B6=
B02
> > Dominick Grift
>=20
>=20
>=20
> --=20
> Key fingerprint =3D 5F4D 3CDB D3F8 3652 FBD8 02D5 3B6C 5F1D 2C7B 6B02
> https://sks-keyservers.net/pks/lookup?op=3Dget&search=3D0x3B6C5F1D2C7B6B02
> Dominick Grift


--=20
Key fingerprint =3D 5F4D 3CDB D3F8 3652 FBD8 02D5 3B6C 5F1D 2C7B 6B02
https://sks-keyservers.net/pks/lookup?op=3Dget&search=3D0x3B6C5F1D2C7B6B02
Dominick Grift

--BWWlCdgt6QLN7tv3
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQGzBAEBCAAdFiEEujmXliIBLFTc2Y4AJXSOVTf5R2kFAlwfveoACgkQJXSOVTf5
R2k1Qgv+LIAtCn5kPH3QPqAJVKyAzZH+7PBbgkrj8KB1w1cCJejaK9r6VTqPTPLt
tDl90t1nlvigHZ2IVJZMMemCf+XKp6YH435hfeKqKw8MpTDhPrVZmed8zynB9VSt
Rx/e79WeMmxb8v6QQBiBL94fHHbGU0GhSj+IkzzAg79J5ZkXmbq3rGnKuQ/7mI4j
gT3A1VcgpSvrlQcJD8cjpAdAUBtsyqcHGU9CVI7w/Pj3DyQanbMZ+8PJKDDNp4TC
D714h6bFKRmow7KOAGXi6LY9l4KqlvOslgyNSPUlGpUVdlhP4Pl56ibaMqppjMRG
+xAAALoP5JvBaRJeGdWSas4lLg+Fq1ssFsXQ8aSaXks642UTngI45fSDUrCRvjE4
s18npG3Rg45xUNA4wE1L0hQz/Xt6IZRpM0ZzWbCYkGPo+oZTioyIarT8cUczRwPA
q8hRDIInNSNBrdGl5zMhhpdozlyGs6FFOXdvR5tnjQ5bLEfziCkL841L+Uzf9ZNg
zTSkHtYa
=JFtZ
-----END PGP SIGNATURE-----

--BWWlCdgt6QLN7tv3--