Received-SPF: pass (google.com: best guess record for domain of selinux-refpolicy-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
Subject: Re: [PATCH 05/10] Allow colord_t to read the color profile stored in
 ~/.local/share/icc/
To:     Laurent Bigonville <bigon@debian.org>,
        selinux-refpolicy@vger.kernel.org
References: <20191011122416.14651-1-bigon@debian.org>
 <20191011122416.14651-5-bigon@debian.org>
 <20191011125423.GA279944@brutus.lan> <20191012075320.GA716332@brutus.lan>
From:   Chris PeBenito <pebenito@ieee.org>
Message-ID: <f0b189cf-81d6-c567-2224-45ce70bcc796@ieee.org>
Date:   Sat, 12 Oct 2019 11:51:43 -0400
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101
 Thunderbird/60.6.1
MIME-Version: 1.0
In-Reply-To: <20191012075320.GA716332@brutus.lan>
Content-Type: text/plain; charset=windows-1252; format=flowed
Content-Language: en-US
Content-Transfer-Encoding: 7bit
Sender: selinux-refpolicy-owner@vger.kernel.org
Precedence: bulk

On 10/12/19 3:53 AM, Dominick Grift wrote:
> On Fri, Oct 11, 2019 at 02:54:23PM +0200, Dominick Grift wrote:
>> On Fri, Oct 11, 2019 at 02:24:11PM +0200, Laurent Bigonville wrote:
>>> From: Laurent Bigonville <bigon@bigon.be>
>>>
>>> colord reads the color profiles files that are stored in
>>> ~/.local/share/icc/, The file descriptor to that file is passed over
>>> D-Bus so it needs to be inherited
>>
>> This patch is cutting corners a little. It only takes unconfined_t into account and not the confined users (an alternative would be to call "userdom_use_all_users_fds(colord_t)" instead. Which is arguable too broad as well but closest you can get to "common users" without surgery.
>> Secondly xdg_read_data_files() is a little broad.
>> Also if this patch implies that whatever maintains XDG_DATA_DIR/icc is able to maintain generic xdg data files, which is arguable broad as well.
>>
>> The second and third argument are subject to how far you want to take things, and so I won't object if that is not addressed.
>> The fd use issue, in my view, should be addressed for all login (common) users with colord access.
> 
> Actually, I take this review back. I am not sure how to best deal with this fd.

It seems that going to a colord_role() would be the way to go.  There 
already is a colord_dbus_chat($1_t) in userdomain.if, so you could put 
those dbus rules plus the rules to address the fds together.

I agree the xdg_read_data_files() is somewhat broad, but it seems like 
xdg_data_t files aren't sensitive.  Maybe that's just how it is on 
system?  I don't feel strongly on this.

-- 
Chris PeBenito