Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-7.1 required=3.0 tests=DKIM_SIGNED,DKIM_VALID, DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH,MAILING_LIST_MULTI, SIGNED_OFF_BY,SPF_PASS autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id D8C54C10F0E for ; Sat, 13 Apr 2019 02:33:35 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 8A1DF20869 for ; Sat, 13 Apr 2019 02:33:35 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (1024-bit key) header.d=coker.com.au header.i=@coker.com.au header.b="UVXhmIWZ" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726925AbfDMCdf (ORCPT ); Fri, 12 Apr 2019 22:33:35 -0400 Received: from smtp.sws.net.au ([46.4.88.250]:54780 "EHLO smtp.sws.net.au" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726902AbfDMCde (ORCPT ); Fri, 12 Apr 2019 22:33:34 -0400 Received: from liv.localnet (localhost [127.0.0.1]) by smtp.sws.net.au (Postfix) with ESMTP id EBA1CED83; Sat, 13 Apr 2019 12:33:31 +1000 (AEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=coker.com.au; s=2008; t=1555122813; bh=fQfl0XoFeEOVcrkOqASZqBqTdsSdGNIADUQHKUUUzgs=; l=2486; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=UVXhmIWZY7bUOZky8Dhre+tpb94dQzukAGymGkypogJMpfK04hTmjMyR3fsiHaWwQ M/ld5OT2vkCf4zETRlE1bYnnK8Fr2rMlAJ2qcm5JGAIFT+sfjVR85WGAUBL2A4K2bY vH2Rr1aIdOEoel6cGeeJg5OtYBVc6FtP/d6dwPfs= From: Russell Coker To: "Sugar, David" Cc: "selinux-refpolicy@vger.kernel.org" Subject: Re: [PATCH 3/3] Some items that seem they can be dontaudited for plymouthd Date: Sat, 13 Apr 2019 12:33:25 +1000 Message-ID: <2319520.MOiGnKPAe5@liv> In-Reply-To: <20190412193917.23886-4-dsugar@tresys.com> References: <20190412193917.23886-1-dsugar@tresys.com> <20190412193917.23886-4-dsugar@tresys.com> MIME-Version: 1.0 Content-Transfer-Encoding: 7Bit Content-Type: text/plain; charset="us-ascii" Sender: selinux-refpolicy-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: selinux-refpolicy@vger.kernel.org What is netlink_kobject_uevent_socket? Do we have a place we can document this sort of thing to make it easier to determine whether access is required and what the implications of such access are? On Saturday, 13 April 2019 5:39:32 AM AEST Sugar, David wrote: > type=AVC msg=audit(1554983723.772:784): avc: denied { create } for > pid=8123 comm="plymouthd" scontext=system_u:system_r:plymouthd_t:s0 > tcontext=system_u:system_r:plymouthd_t:s0 > tclass=netlink_kobject_uevent_socket permissive=0 > type=AVC msg=audit(1555070131.882:1648): avc: denied { getattr } for > pid=8634 comm="plymouthd" path="/run/udev/data/c226:0" dev="tmpfs" > ino=29946 scontext=system_u:system_r:plymouthd_t:s0 > tcontext=system_u:object_r:udev_var_run_t:s0 tclass=file permissive=1 > type=AVC msg=audit(1555070131.903:1652): avc: denied { open } for > pid=8634 comm="plymouthd" path="/run/udev/data/+drm:card0-DP-1" dev="tmpfs" > ino=31856 scontext=system_u:system_r:plymouthd_t:s0 > tcontext=system_u:object_r:udev_var_run_t:s0 tclass=file permissive=1 > type=AVC msg=audit(1555070131.903:1652): avc: denied { read } for > pid=8634 comm="plymouthd" name="+drm:card0-DP-1" dev="tmpfs" ino=31856 > scontext=system_u:system_r:plymouthd_t:s0 > tcontext=system_u:object_r:udev_var_run_t:s0 tclass=file permissive=1 > Signed-off-by: Dave Sugar > --- > policy/modules/services/plymouthd.te | 5 +++++ > 1 file changed, 5 insertions(+) > > diff --git a/policy/modules/services/plymouthd.te > b/policy/modules/services/plymouthd.te index 835ee035..6352375d 100644 > --- a/policy/modules/services/plymouthd.te > +++ b/policy/modules/services/plymouthd.te > @@ -38,6 +38,7 @@ dontaudit plymouthd_t self:capability dac_override; > allow plymouthd_t self:capability2 block_suspend; > allow plymouthd_t self:process { signal getsched }; > allow plymouthd_t self:fifo_file rw_fifo_file_perms; > +dontaudit plymouthd_t self:netlink_kobject_uevent_socket create; > allow plymouthd_t self:unix_stream_socket create_stream_socket_perms; > > manage_dirs_pattern(plymouthd_t, plymouthd_spool_t, plymouthd_spool_t) > @@ -87,6 +88,10 @@ optional_policy(` > gnome_read_generic_home_content(plymouthd_t) > ') > > +optional_policy(` > + udev_dontaudit_rw_pid_files(plymouthd_t) > +') > + > optional_policy(` > sssd_stream_connect(plymouthd_t) > ') > -- > 2.20.1 > -- My Main Blog http://etbe.coker.com.au/ My Documents Blog http://doc.coker.com.au/