Date:   Sun, 23 Dec 2018 18:02:37 +0100
From:   Dominick Grift <dac.override@gmail.com>
To:     Chris PeBenito <pebenito@ieee.org>,
        David Sugar <dsugar@tresys.com>,
        "selinux-refpolicy@vger.kernel.org" 
        <selinux-refpolicy@vger.kernel.org>
Subject: Re: [PATCH 1/2] Allow greeter to start dbus and transition
Message-ID: <20181223170237.GJ20992@brutus.lan>
Mail-Followup-To: Chris PeBenito <pebenito@ieee.org>,
        David Sugar <dsugar@tresys.com>,
        "selinux-refpolicy@vger.kernel.org" <selinux-refpolicy@vger.kernel.org>
References: <20181221014026.2867-1-dsugar@tresys.com>
 <d3540f39-c75b-ea1b-6a63-f507b71a9f5c@ieee.org>
 <20181223163359.GF20992@brutus.lan>
 <20181223164512.GG20992@brutus.lan>
 <20181223165206.GH20992@brutus.lan>
 <20181223165510.GI20992@brutus.lan>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha256;
        protocol="application/pgp-signature"; boundary="8tZVdKiiYitVG083"
Content-Disposition: inline
In-Reply-To: <20181223165510.GI20992@brutus.lan>
User-Agent: Every email client sucks, this one just sucks less.
Sender: selinux-refpolicy-owner@vger.kernel.org
Precedence: bulk


--8tZVdKiiYitVG083
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Sun, Dec 23, 2018 at 05:55:10PM +0100, Dominick Grift wrote:
> On Sun, Dec 23, 2018 at 05:52:06PM +0100, Dominick Grift wrote:
> > On Sun, Dec 23, 2018 at 05:45:12PM +0100, Dominick Grift wrote:
> > > On Sun, Dec 23, 2018 at 05:33:59PM +0100, Dominick Grift wrote:
> > > > On Sat, Dec 22, 2018 at 02:28:15PM -0500, Chris PeBenito wrote:
> > > > > On 12/20/18 8:41 PM, David Sugar wrote:
> > > > > > The display manager lightdm (and I think gdm) start a dbus bina=
ry.
> > > > > > This allows that to happen in a special dbus domain.
> > > > > >=20
> > > > > > type=3DAVC msg=3Daudit(1544626796.378:201): avc:  denied  { exe=
cute } for  pid=3D9973 comm=3D"dbus-launch" name=3D"dbus-daemon" dev=3D"dm-=
1" ino=3D6695040 scontext=3Dsystem_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=
=3Dsystem_u:object_r:dbusd_exec_t:s0 tclass=3Dfile permissive=3D1
> > > > > > type=3DAVC msg=3Daudit(1544626796.378:201): avc:  denied  { rea=
d open } for  pid=3D9973 comm=3D"dbus-launch" path=3D"/usr/bin/dbus-daemon"=
 dev=3D"dm-1" ino=3D6695040 scontext=3Dsystem_u:system_r:xdm_t:s0-s0:c0.c10=
23 tcontext=3Dsystem_u:object_r:dbusd_exec_t:s0 tclass=3Dfile permissive=3D1
> > > > > > type=3DAVC msg=3Daudit(1544626796.378:201): avc:  denied  { exe=
cute_no_trans } for  pid=3D9973 comm=3D"dbus-launch" path=3D"/usr/bin/dbus-=
daemon" dev=3D"dm-1" ino=3D6695040 scontext=3Dsystem_u:system_r:xdm_t:s0-s0=
:c0.c1023 tcontext=3Dsystem_u:object_r:dbusd_exec_t:s0 tclass=3Dfile permis=
sive=3D1
> > > > > > type=3DAVC msg=3Daudit(1544626796.378:201): avc:  denied  { map=
 } for  pid=3D9973 comm=3D"dbus-daemon" path=3D"/usr/bin/dbus-daemon" dev=
=3D"dm-1" ino=3D6695040 scontext=3Dsystem_u:system_r:xdm_t:s0-s0:c0.c1023 t=
context=3Dsystem_u:object_r:dbusd_exec_t:s0 tclass=3Dfile permissive=3D1
> > > > > > type=3DAVC msg=3Daudit(1544628523.635:3208): avc:  denied  { ex=
ecute } for  pid=3D16376 comm=3D"at-spi-bus-laun" name=3D"dbus-daemon" dev=
=3D"dm-1" ino=3D6695040 scontext=3Dsystem_u:system_r:xdm_t:s0-s0:c0.c1023 t=
context=3Dsystem_u:object_r:dbusd_exec_t:s0 tclass=3Dfile permissive=3D1
> > > > > > type=3DAVC msg=3Daudit(1544628523.635:3208): avc:  denied  { re=
ad open } for  pid=3D16376 comm=3D"at-spi-bus-laun" path=3D"/usr/bin/dbus-d=
aemon" dev=3D"dm-1" ino=3D6695040 scontext=3Dsystem_u:system_r:xdm_t:s0-s0:=
c0.c1023 tcontext=3Dsystem_u:object_r:dbusd_exec_t:s0 tclass=3Dfile permiss=
ive=3D1
> > > > > > type=3DAVC msg=3Daudit(1544628523.635:3208): avc:  denied  { ex=
ecute_no_trans } for  pid=3D16376 comm=3D"at-spi-bus-laun" path=3D"/usr/bin=
/dbus-daemon" dev=3D"dm-1" ino=3D6695040 scontext=3Dsystem_u:system_r:xdm_t=
:s0-s0:c0.c1023 tcontext=3Dsystem_u:object_r:dbusd_exec_t:s0 tclass=3Dfile =
permissive=3D1
> > > > > > type=3DAVC msg=3Daudit(1544628523.635:3208): avc:  denied  { ma=
p } for  pid=3D16376 comm=3D"dbus-daemon" path=3D"/usr/bin/dbus-daemon" dev=
=3D"dm-1" ino=3D6695040 scontext=3Dsystem_u:system_r:xdm_t:s0-s0:c0.c1023 t=
context=3Dsystem_u:object_r:dbusd_exec_t:s0 tclass=3Dfile permissive=3D1
> > > > > >=20
> > > > > > Signed-off-by: Dave Sugar <dsugar@tresys.com>
> > > > > > ---
> > > > > >   policy/modules/services/xserver.te | 1 +
> > > > > >   1 file changed, 1 insertion(+)
> > > > > >=20
> > > > > > diff --git a/policy/modules/services/xserver.te b/policy/module=
s/services/xserver.te
> > > > > > index fa7ce88e..12ad3a87 100644
> > > > > > --- a/policy/modules/services/xserver.te
> > > > > > +++ b/policy/modules/services/xserver.te
> > > > > > @@ -568,6 +568,7 @@ optional_policy(`
> > > > > >   optional_policy(`
> > > > > >   	dbus_system_bus_client(xdm_t)
> > > > > >   	dbus_connect_system_bus(xdm_t)
> > > > > > +	dbus_role_template(xdm, system_r, xdm_t)
> > > > > >   	optional_policy(`
> > > > > >   		accountsd_dbus_chat(xdm_t)
> > > > >=20
> > > > > This doesn't sit well with me.  XDM isn't a user, or is system_r =
a user
> > > > > role, so it shouldn't be using this template.  On my system,
> > > > > at-spi-bus-launcher is running as part of my user session, not as=
 part of
> > > > > XDM.  It seems like this may be a transition problem.
> > > >=20
> > > > It does not sit well with me either but gdm is actually a "user" in=
 way's. and it has a session.
> > > >=20
> > > > the gdm DM policy should never have been merged with XDM DM policy =
as XDM is much cleaner.
> > > >=20
> > > > GDM is nasty
> > >=20
> > > In dssp2 i actually have a seuser for gdm:
> > >=20
> > > # seinfo -xugdm.id
> > >=20
> > > Users: 1
> > >    user gdm.id roles sys.role level s0 range s0;
> > >=20
> > > And believe me, I did not do that for fun. In distributions with syst=
emd --user this is just needed because
> > > systemd will spawn a --user instance for gdm and this user instance s=
pawns all kinds of processes on gdm's behalf
> > >=20
> > > for example dbus instance, the last thing you want is to have a gdm d=
bus instance running with system_dbusd_t
> >=20
> > then again, in dssp2 i just run pretty much everything in "gdm_t"
> > so maybe a dbus_exec() is more appropriate (and simpler)
>=20
> https://github.com/DefenSec/dssp2-standard/blob/master/policy/gnome/g/gdm=
=2Ecil#L218

My last comment on this: my advice is to stay in the xdm_t domain and to no=
t transition out of it. just run that whole session in xdm_t, all of it.

>=20
> >=20
> > >=20
> > > >=20
> > > > >=20
> > > > > --=20
> > > > > Chris PeBenito
> > > >=20
> > > > --=20
> > > > Key fingerprint =3D 5F4D 3CDB D3F8 3652 FBD8 02D5 3B6C 5F1D 2C7B 6B=
02
> > > > https://sks-keyservers.net/pks/lookup?op=3Dget&search=3D0x3B6C5F1D2=
C7B6B02
> > > > Dominick Grift
> > >=20
> > >=20
> > >=20
> > > --=20
> > > Key fingerprint =3D 5F4D 3CDB D3F8 3652 FBD8 02D5 3B6C 5F1D 2C7B 6B02
> > > https://sks-keyservers.net/pks/lookup?op=3Dget&search=3D0x3B6C5F1D2C7=
B6B02
> > > Dominick Grift
> >=20
> >=20
> >=20
> > --=20
> > Key fingerprint =3D 5F4D 3CDB D3F8 3652 FBD8 02D5 3B6C 5F1D 2C7B 6B02
> > https://sks-keyservers.net/pks/lookup?op=3Dget&search=3D0x3B6C5F1D2C7B6=
B02
> > Dominick Grift
>=20
>=20
>=20
> --=20
> Key fingerprint =3D 5F4D 3CDB D3F8 3652 FBD8 02D5 3B6C 5F1D 2C7B 6B02
> https://sks-keyservers.net/pks/lookup?op=3Dget&search=3D0x3B6C5F1D2C7B6B02
> Dominick Grift


--=20
Key fingerprint =3D 5F4D 3CDB D3F8 3652 FBD8 02D5 3B6C 5F1D 2C7B 6B02
https://sks-keyservers.net/pks/lookup?op=3Dget&search=3D0x3B6C5F1D2C7B6B02
Dominick Grift

--8tZVdKiiYitVG083
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQGzBAEBCAAdFiEEujmXliIBLFTc2Y4AJXSOVTf5R2kFAlwfv6kACgkQJXSOVTf5
R2nKDgwAkY3RB48BXmqmMpfdRigL19+OvYnzf8xCYHFjqJLeEfzhozXrw4G0kApj
1fdVxsbvjx/yvJ4Z0JHX3eDaNwFGNOxKV/h82HwflADid3KUuuku4ax3ElK9E/aa
GJ4gNKDzsjdI6gu4aj25C5NCyxuPN0fru6QM+ET1Gf4BYQbRHQlIYvLyaBej07xW
54tKOVTAYx6lqT3BOomvvjoavQZ9LMXg0gWz8xFQ/Gemcjv7ix8+CVkMaXZTbbS8
SbqoiXhvVSI80flIrM44G5d1FDQ1Lj5WjHD3c6+XDovn7GpXbx933RW/wsEqEyVg
tWRMM//qmfykDZguNiUXQdO5kKzSRFZ8vr1xoic9LzUguImUAxznQd91RNMBxkyq
E5vsL3RFz2qfNEqyGbNhGCN25CKhWFbawSOHu/d9XpuqLZA3Ey8Q42DE93xEB+f1
gNY/qHQFL6c2kVzrJLZ4CtjWQFSbfotd8ask0/bm1CBtPeY/Q2lGx3q6ajNgUUbi
FE1eplwk
=9iw+
-----END PGP SIGNATURE-----

--8tZVdKiiYitVG083--