From:   Russell Coker <russell@coker.com.au>
To:     Jason Zaman <jason@perfinion.com>
Cc:     Chris PeBenito <pebenito@ieee.org>,
        selinux-refpolicy@vger.kernel.org
Subject: Re: [PATCH misc 2/3] selinuxutil sysnetwork consolekit apt dpkg udev iptables logrotate, and gpm
Date:   Fri, 04 Jan 2019 18:06:35 +1100
Message-ID: <7161443.mtQlH2pOMG@liv>
In-Reply-To: <20190103051614.GB19860@baraddur.perfinion.com>
References: <20190102084500.GB31076@aaa.coker.com.au> <ff620905-5c53-8b3d-749e-d04719195fba@ieee.org> <20190103051614.GB19860@baraddur.perfinion.com>
MIME-Version: 1.0
Content-Transfer-Encoding: 7Bit
Content-Type: text/plain; charset="us-ascii"
Sender: selinux-refpolicy-owner@vger.kernel.org
Precedence: bulk

On Thursday, 3 January 2019 4:16:14 PM AEDT Jason Zaman wrote:
> > > -allow consolekit_t self:capability { chown dac_override fowner setgid
> > > setuid sys_admin sys_nice sys_ptrace sys_tty_config }; +allow
> > > consolekit_t self:capability { chown dac_override dac_read_search
> > > fowner setgid setuid sys_admin sys_nice sys_ptrace sys_tty_config };> 
> > Since you're getting the dac_read_search denial, the dac_override
> > probably isn't necessary anymore.  Can you retest without it?
> 
> No, consolekit definitely needs dac_override. It needs to be able to
> nuke /run/user/1000/*. it perhaps doesnt need to read only nuke but i'd
> say grant the perm instead of dontaudit makes things easier if doing
> semodule -DB.

Thanks for that comment.

As an aside we might consider a policy of having all capabilities documented 
in future.  For the existing policy it's going to be an unpleasant task to 
comment things.  But for greenfields stuff I think it makes sense to require 
it.

-- 
My Main Blog         http://etbe.coker.com.au/
My Documents Blog    http://doc.coker.com.au/