Received-SPF: pass (google.com: best guess record for domain of selinux-refpolicy-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
Date:   Fri, 11 Oct 2019 14:54:23 +0200
From:   Dominick Grift <dac.override@gmail.com>
To:     Laurent Bigonville <bigon@debian.org>
Cc:     selinux-refpolicy@vger.kernel.org
Subject: Re: [PATCH 05/10] Allow colord_t to read the color profile stored in
 ~/.local/share/icc/
Message-ID: <20191011125423.GA279944@brutus.lan>
Mail-Followup-To: Laurent Bigonville <bigon@debian.org>,
        selinux-refpolicy@vger.kernel.org
References: <20191011122416.14651-1-bigon@debian.org>
 <20191011122416.14651-5-bigon@debian.org>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha256;
        protocol="application/pgp-signature"; boundary="IS0zKkzwUGydFO0o"
Content-Disposition: inline
In-Reply-To: <20191011122416.14651-5-bigon@debian.org>
User-Agent: Every email client sucks, this one just sucks less.
Sender: selinux-refpolicy-owner@vger.kernel.org
Precedence: bulk


--IS0zKkzwUGydFO0o
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Fri, Oct 11, 2019 at 02:24:11PM +0200, Laurent Bigonville wrote:
> From: Laurent Bigonville <bigon@bigon.be>
>=20
> colord reads the color profiles files that are stored in
> ~/.local/share/icc/, The file descriptor to that file is passed over
> D-Bus so it needs to be inherited

This patch is cutting corners a little. It only takes unconfined_t into acc=
ount and not the confined users (an alternative would be to call "userdom_u=
se_all_users_fds(colord_t)" instead. Which is arguable too broad as well bu=
t closest you can get to "common users" without surgery.
Secondly xdg_read_data_files() is a little broad.
Also if this patch implies that whatever maintains XDG_DATA_DIR/icc is able=
 to maintain generic xdg data files, which is arguable broad as well.

The second and third argument are subject to how far you want to take thing=
s, and so I won't object if that is not addressed.
The fd use issue, in my view, should be addressed for all login (common) us=
ers with colord access.

>=20
> ----
> time->Sat Oct  5 11:35:54 2019
> type=3DAVC msg=3Daudit(1570268154.991:223): avc:  denied  { read } for  p=
id=3D852 comm=3D"gdbus" path=3D"/home/bigon/.local/share/icc/edid-fcd2cc06d=
ec015794261e6b7756cbcec.icc" dev=3D"dm-3" ino=3D413402 scontext=3Dsystem_u:=
system_r:colord_t:s0 tcontext=3Dunconfined_u:object_r:xdg_data_t:s0 tclass=
=3Dfile permissive=3D1
> type=3DAVC msg=3Daudit(1570268154.991:223): avc:  denied  { use } for  pi=
d=3D852 comm=3D"gdbus" path=3D"/home/bigon/.local/share/icc/edid-fcd2cc06de=
c015794261e6b7756cbcec.icc" dev=3D"dm-3" ino=3D413402 scontext=3Dsystem_u:s=
ystem_r:colord_t:s0 tcontext=3Dunconfined_u:unconfined_r:unconfined_t:s0-s0=
:c0.c1023 tclass=3Dfd permissive=3D1
> ----
> time->Sat Oct  5 11:35:55 2019
> type=3DAVC msg=3Daudit(1570268155.007:225): avc:  denied  { getattr } for=
  pid=3D852 comm=3D"colord" path=3D"/home/bigon/.local/share/icc/edid-fcd2c=
c06dec015794261e6b7756cbcec.icc" dev=3D"dm-3" ino=3D413402 scontext=3Dsyste=
m_u:system_r:colord_t:s0 tcontext=3Dunconfined_u:object_r:xdg_data_t:s0 tcl=
ass=3Dfile permissive=3D1
> ----
> time->Sat Oct  5 11:35:55 2019
> type=3DAVC msg=3Daudit(1570268155.007:226): avc:  denied  { map } for  pi=
d=3D852 comm=3D"colord" path=3D"/home/bigon/.local/share/icc/edid-fcd2cc06d=
ec015794261e6b7756cbcec.icc" dev=3D"dm-3" ino=3D413402 scontext=3Dsystem_u:=
system_r:colord_t:s0 tcontext=3Dunconfined_u:object_r:xdg_data_t:s0 tclass=
=3Dfile permissive=3D1
> ----
>=20
> Signed-off-by: Laurent Bigonville <bigon@bigon.be>
> ---
>  policy/modules/services/colord.te | 7 +++++++
>  1 file changed, 7 insertions(+)
>=20
> diff --git a/policy/modules/services/colord.te b/policy/modules/services/=
colord.te
> index fada3fb8..2fbb1835 100644
> --- a/policy/modules/services/colord.te
> +++ b/policy/modules/services/colord.te
> @@ -141,6 +141,13 @@ optional_policy(`
>  	udev_read_pid_files(colord_t)
>  ')
> =20
> +# colord reads the color profiles files that are stored in ~/.local/shar=
e/icc/,
> +# The file descriptor to that file is passed over D-Bus so it needs to b=
e inherited
> +optional_policy(`
> +	unconfined_use_fds(colord_t)
> +	xdg_read_data_files(colord_t)
> +')
> +
>  optional_policy(`
>  	xserver_read_xdm_lib_files(colord_t)
>  	xserver_use_xdm_fds(colord_t)
> --=20
> 2.23.0
>=20

--=20
Key fingerprint =3D 5F4D 3CDB D3F8 3652 FBD8 02D5 3B6C 5F1D 2C7B 6B02
https://sks-keyservers.net/pks/lookup?op=3Dget&search=3D0x3B6C5F1D2C7B6B02
Dominick Grift

--IS0zKkzwUGydFO0o
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQGzBAEBCAAdFiEEujmXliIBLFTc2Y4AJXSOVTf5R2kFAl2ge3sACgkQJXSOVTf5
R2kYoQv/SaP0PY5L04YMku6l370ElpxMI7uVrvUyKpM2Cf0Qpq0i7WqlO2LLbXg9
tx+MwCoe9F+BV/HzI9pe5co+kVGyTH17JFuGoLdueMDtTQ/oRlG3GMLuM2ditltY
S+2wVgoV456kjynLovADPwBrNFzicNEa7BAsVrW6Bk3l8Anjzig2fyggtzIE++oW
PxTs2TaQS6Yu4P0hipm9wGgieSvvaPq4Y5OcTLhuk6LXgLbriPGstviAbSRHKfwJ
YfDbe+vkgrRlbfvbRB32v5EGgmE3s6Dz3jtvJByzag1nSf8bgl8e8j5q3VsCyu33
fdOO+Fpg+WstTADmx1YYQ3xaQVHie8rePkeeoVgVo0pPba4Ks5k/J/KXesD2BrKl
cTJhdQNikNY9iHiqiO27JlO4kCfSidjYQrz2AbeiTSJDdrJZ5s0ey+2HCvHGuRs3
aNxrP4NW7rzcJWRxTfIiZItx+z3vgfmkwwVBZcNZf5rxXg5S7j8HDCLZ8LPGCq3p
MsE0YBal
=Qt0f
-----END PGP SIGNATURE-----

--IS0zKkzwUGydFO0o--