Received-SPF: pass (google.com: best guess record for domain of selinux-refpolicy-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
Date:   Sun, 6 Oct 2019 12:01:25 +0200
From:   Dominick Grift <dac.override@gmail.com>
To:     Laurent Bigonville <bigon@debian.org>,
        selinux-refpolicy@vger.kernel.org
Subject: Re: systemd --user for GDM started as unconfined_t instead of xdm_t
Message-ID: <20191006100125.GC469820@brutus.lan>
Mail-Followup-To: Laurent Bigonville <bigon@debian.org>,
        selinux-refpolicy@vger.kernel.org
References: <a8196af0-1615-e78c-c21d-7525252d0441@debian.org>
 <20191006094156.GB469820@brutus.lan>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha256;
        protocol="application/pgp-signature"; boundary="w7PDEPdKQumQfZlR"
Content-Disposition: inline
In-Reply-To: <20191006094156.GB469820@brutus.lan>
User-Agent: Every email client sucks, this one just sucks less.
Sender: selinux-refpolicy-owner@vger.kernel.org
Precedence: bulk


--w7PDEPdKQumQfZlR
Content-Type: text/plain; charset=iso-8859-1
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Sun, Oct 06, 2019 at 11:41:56AM +0200, Dominick Grift wrote:
> On Sun, Oct 06, 2019 at 11:22:00AM +0200, Laurent Bigonville wrote:
> > Hello,
> >=20
> > I discovered today that the GDM own processes are started as unconfined=
_t
> > instead of xdm_t because systemd --user process itself is started in th=
at
> > context.
> >=20
> > This is probably related to:
> >=20
> > commit da156aea1e89a6ff6025be7e50c9c8173e5a6dcf
> > Author: Chris PeBenito <Christopher.PeBenito@microsoft.com>
> > Date:=A0=A0 Fri Apr 19 11:50:59 2019 -0400
> >=20
> > =A0=A0=A0 systemd: Add initial policy for systemd --user.
> >=20
> > =A0=A0=A0 This is just a start; it does not cover all uses.
> >=20
> > =A0=A0=A0 Signed-off-by: Chris PeBenito <Christopher.PeBenito@microsoft=
=2Ecom>
> >=20
> > Was that expected and/or wanted?
>=20
> It just means that gdm hooks into pam, and since 1. your __default__ id i=
s set to unconfined_u and 2. you do not have a private id for gdm (and gnom=
e-initial-setup) systemd will start gdm's systemd --user instance with unco=
nfined_u:unconfined_r:unconfined_t.
>=20
> One (ugly but arguable less ugly than the alternative) solution is to cre=
ate a "xdm_u" and allow systemd to run a systemd --user instance on behalf =
of gdm with "xdm_u:system_r:xdm_t"
>=20
> That way you can tell selinux that gdm's systemd --user instance should n=
ever transition out of xdm_u:system_r:xdm_t
>=20
> echo "system_r:init_t:s0 system_r:xdm_t:s0" > /etc/selinux/TYPE/contexts/=
users/xdm_u
>=20
> Then all processes in the gdm session should stay in xdm_t (but some proc=
esses will be associate with xdm_u and other with system_u).
>=20
> You would probably also want to add to semanage.conf:
>=20
> ignoredirs =3D /var/lib/gdm;/run/gnome-initial-setup
>=20
> and make sure that selinux does not relabel /run/user/$(id -u gdm)

Just to clarify. The patch you reference is not responsible for the uglynes=
s that is GDM/Gnome
Without this patch, the systemd --user instance of GDM (and any other users=
) would run in "init_t". This is obviously also not desirable.

>=20
> >=20
> > Kind regards,
> >=20
> > Laurent Bigonville
> >=20
>=20
> --=20
> Key fingerprint =3D 5F4D 3CDB D3F8 3652 FBD8 02D5 3B6C 5F1D 2C7B 6B02
> https://sks-keyservers.net/pks/lookup?op=3Dget&search=3D0x3B6C5F1D2C7B6B02
> Dominick Grift


--=20
Key fingerprint =3D 5F4D 3CDB D3F8 3652 FBD8 02D5 3B6C 5F1D 2C7B 6B02
https://sks-keyservers.net/pks/lookup?op=3Dget&search=3D0x3B6C5F1D2C7B6B02
Dominick Grift

--w7PDEPdKQumQfZlR
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQGzBAEBCAAdFiEEujmXliIBLFTc2Y4AJXSOVTf5R2kFAl2Zu3AACgkQJXSOVTf5
R2muTwv/cgAFLRALx+wLqrNiQ8GG0vcxJfVNkdnSprQIG4PBGQlF3iVSBTO7e/pk
mNaajb98pkuvtBr7lK004mDjxdaNRB8xyaXWUVv1G5YtuDfm53d7i8MrCLqz/gn5
2Wd99zEAMDx2o/eG7Rec8E1GIUMdrjjfkpRd29CaKB3s1Uh1Hc0rtmt6/2WKYkrz
DDiuY4h5i3hJqNLH/hWhPF/ubiBpBa/FjHPWM5zCEhw3BArtvu+eVbFiUcoeZDNI
loo2ySV5sy/dBaOmZ9rnmA4GFXYb8W710TZHmoqEbrMpHQiAPwau7uggE56OrqB4
iGr7mU9ponjhCGzOUbXQz0FHN6y/8i/BAq7KxQT+fgUEk23+qRJK5lpQHm5CRhdH
8ISFKgW03DAoeIxMp5ns98j7+lDJhD+Rf6+iqTCFFp+pcR5PEKRm+Ejj/MOFNQgf
u4wNn9XBX5CieObooAXY1yO4/Bki30TFd+4YYc3AcRJlPfPwog4vrhZ1t6LQ9HqY
FcPhBPTy
=kh3k
-----END PGP SIGNATURE-----

--w7PDEPdKQumQfZlR--