Received: by 2002:a25:1506:0:0:0:0:0 with SMTP id 6csp3588921ybv; Sun, 16 Feb 2020 00:54:58 -0800 (PST) X-Google-Smtp-Source: APXvYqwODlIKO65sDbOPvKmZXEGxeKs+6vk2UaM7kkAmNATixoQv5ZZ0MJBRf1XBwRgb2xYmo2uR X-Received: by 2002:a05:6830:1f1c:: with SMTP id u28mr8675161otg.143.1581843298500; Sun, 16 Feb 2020 00:54:58 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1581843298; cv=none; d=google.com; s=arc-20160816; b=qUdxv/iy0LqFyV8/fsJda0LRMQyr9cGhqnqDoUIPFwOWO1kKe7yZcNKRKprq5MgZr6 y3aWqBfJgwXaOQ/Ub11TAsrRvgnYhnl1H4sKlJNLrf3lw3SKqRb9SDJCBmAsmy7Sd54t 45LQ7aUlYZl/YVlVW59SMA2f53NOxWcOGD9VferW9/sfsz0IJ2LKBzc/QEN090lhuieI z1EFKHTF2YFwjSpy7mEueLInkb5l6Iyk075tjTjIVTKpIFehF8Y37t3FFCxR/zcqZhFs JZpR3J6hEAsoIq+jIb8dU3I4DRBfSItXmoWve9SgoqCiRQodhhutAesKaODkln/SDe+P mHwg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from :dkim-signature; bh=2Pu/8HM147HJtZ57xOZVgiNs9d/RGwQW6Ozl2+VrFi8=; b=yKJXsem84ouHyoIkmRWkCQ9+ZtS9yZQ2waold6zYX12JAiRD44fxKpEAIi0r+ItGYh veSwL3Vh+50JKHLgY3BT+uMooV6QYpu7juLEUIl+8MBke3n1CxI2Z+7ZQ5sSaea6Nlib 42efF6jzwB42yS0zlzwVfpI0XnGkCOlKfXKBVGXIAH+OQuvsoTVhDZfmCxLA/1IkLPxu 3tffjfQ01k3sbhvgDA/Jg2ZFR81cTSBxLiPL66csF/t1a9ZevGW5xaI9NF1GWjI7hEGo Fn1xFNAE09+r8OOLSro932HN3RvNI86UXiX49K8wCi8/z6lKjnBcHYg6qT1SzmFW7zhh 01sA== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@perfinion-com.20150623.gappssmtp.com header.s=20150623 header.b=ltg5Ldlh; spf=pass (google.com: best guess record for domain of selinux-refpolicy-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=selinux-refpolicy-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id y73si4846029oia.246.2020.02.16.00.54.56; Sun, 16 Feb 2020 00:54:58 -0800 (PST) Received-SPF: pass (google.com: best guess record for domain of selinux-refpolicy-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@perfinion-com.20150623.gappssmtp.com header.s=20150623 header.b=ltg5Ldlh; spf=pass (google.com: best guess record for domain of selinux-refpolicy-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=selinux-refpolicy-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1725899AbgBPIy4 (ORCPT + 13 others); Sun, 16 Feb 2020 03:54:56 -0500 Received: from mail-pg1-f177.google.com ([209.85.215.177]:34543 "EHLO mail-pg1-f177.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726128AbgBPIy4 (ORCPT ); Sun, 16 Feb 2020 03:54:56 -0500 Received: by mail-pg1-f177.google.com with SMTP id j4so7448800pgi.1 for ; Sun, 16 Feb 2020 00:54:55 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=perfinion-com.20150623.gappssmtp.com; s=20150623; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=2Pu/8HM147HJtZ57xOZVgiNs9d/RGwQW6Ozl2+VrFi8=; b=ltg5LdlhD4vHw/UcX4Zi5VV0nNcmHGSjSkkuTuf8Q/kBPYK7ZDh5DwcGKKwBTRtw+p qehFRUzHur0c9lCd9E17BZxfYySBSS640tABL7OXrOxHGveic2blzGofeX7iguB8WW4v 95EgcCwWo6tBFmCwSgR3Ex66gr3K0FxKTyX53qeU8MQNCHMorGj2b5mmMC6L8NoY9upS cwLVSLYPrmgqJX2YosoZXRhS3uU8MdpUoKyafCJKyKtF+7x9lHdKMVaIY0sf+GO2zeGK +Vhr0eh767ieehhQaotY7ehCoMspQX0F+su88/4/+TJ4wSsjlDaZRms7PmNPOmgsadOE 6slg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=2Pu/8HM147HJtZ57xOZVgiNs9d/RGwQW6Ozl2+VrFi8=; b=ffXmGywdgilUMKgh9qogfb93eEkO/N5mQJ3eBRhqCU+FRVN1sn18nLsW2fNzfYsCas NSABqSb80bIN2qNPk6T2x4U82iBxaObj+96ej9FNv69SHyIYac5hwkmgPP51Zhnc3n5g wIvS5p7ipOaL9KenTtY8ABDZ+auotpQnV35mFkHUesjvH1k1kr19tu7CyGHi/a03ores TvWunnEu8qQhvrYBL8XUINorSKuoy7RmyUas95JvJXQfYfs6aTZmN7L8BBq1mtqEzf5X egYoRTsbPi/fqn9qp1A1ldERAWjvPig3xsF+4fKVTNfyv19TnFnD6LttbSE1IgtkjIOC Tbgw== X-Gm-Message-State: APjAAAVAJvENoewx9dao0wNxaRiKVpfOCwT2jKDjKkGSQeYg5oiHQ3pf HQ9ll32IFHOJg/M/pomqco0+nzUT7RjfsA== X-Received: by 2002:a63:5220:: with SMTP id g32mr11928875pgb.116.1581843294626; Sun, 16 Feb 2020 00:54:54 -0800 (PST) Received: from localhost ([101.127.140.252]) by smtp.gmail.com with ESMTPSA id i6sm12960487pgm.93.2020.02.16.00.54.53 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 16 Feb 2020 00:54:54 -0800 (PST) From: Jason Zaman To: selinux-refpolicy@vger.kernel.org Cc: Jason Zaman Subject: [PATCH 07/10] userdomain: Add watch on home dirs Date: Sun, 16 Feb 2020 16:54:19 +0800 Message-Id: <20200216085422.36530-7-jason@perfinion.com> X-Mailer: git-send-email 2.24.1 In-Reply-To: <20200216085422.36530-1-jason@perfinion.com> References: <20200216085422.36530-1-jason@perfinion.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Sender: selinux-refpolicy-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: selinux-refpolicy@vger.kernel.org From: Jason Zaman avc: denied { watch } for pid=12351 comm="gmain" path="/usr/share/backgrounds/xfce" dev="zfs" ino=366749 scontext=staff_u:staff_r:staff_t:s0-s0:c0.c1023 tcontext=system_u:object_r:usr_t:s0 tclass=dir permissive=0 avc: denied { watch } for pid=11646 comm="gmain" path="/etc/fonts" dev="zfs" ino=237700 scontext=staff_u:staff_r:staff_t:s0-s0:c0.c1023 tcontext=system_u:object_r:fonts_t:s0 tclass=dir permissive=0 avc: denied { watch } for pid=12351 comm="gmain" path="/home/jason/Desktop" dev="zfs" ino=33153 scontext=staff_u:staff_r:staff_t:s0-s0:c0.c1023 tcontext=staff_u:object_r:user_home_t:s0 tclass=dir permissive=0 avc: denied { watch } for pid=12574 comm="gmain" path="/home/jason/.local/share/icc" dev="zfs" ino=1954514 scontext=staff_u:staff_r:staff_t:s0-s0:c0.c1023 tcontext=staff_u:object_r:xdg_data_t:s0 tclass=dir permissive=0 avc: denied { watch } for pid=11795 comm="gmain" path="/home/jason/.config/xfce4/panel/launcher-19" dev="zfs" ino=35464 scontext=staff_u:staff_r:staff_t:s0-s0:c0.c1023 tcontext=staff_u:object_r:xdg_config_t:s0 tclass=dir permissive=0 avc: denied { watch } for pid=12351 comm="gmain" path="/home/jason/downloads/pics" dev="zfs" ino=38173 scontext=staff_u:staff_r:staff_t:s0-s0:c0.c1023 tcontext=staff_u:object_r:xdg_downloads_t:s0 tclass=dir permissive=0 --- policy/modules/services/xserver.if | 11 +- policy/modules/system/miscfiles.if | 37 ++++++ policy/modules/system/userdomain.if | 5 + policy/modules/system/xdg.if | 198 ++++++++++++++++++++++++++++ 4 files changed, 250 insertions(+), 1 deletion(-) diff --git a/policy/modules/services/xserver.if b/policy/modules/services/xserver.if index c95a6b04..6c22b3c6 100644 --- a/policy/modules/services/xserver.if +++ b/policy/modules/services/xserver.if @@ -95,6 +95,7 @@ interface(`xserver_restricted_role',` dev_rw_usbfs($2) miscfiles_read_fonts($2) + miscfiles_watch_fonts($2) xserver_common_x_domain_template(user, $2) xserver_domtrans($2) @@ -186,10 +187,13 @@ interface(`xserver_role',` optional_policy(` xdg_manage_all_cache($2) xdg_relabel_all_cache($2) + xdg_watch_all_cache_dirs($2) xdg_manage_all_config($2) xdg_relabel_all_config($2) + xdg_watch_all_config_dirs($2) xdg_manage_all_data($2) xdg_relabel_all_data($2) + xdg_watch_all_data_dirs($2) xdg_generic_user_home_dir_filetrans_cache($2, dir, ".cache") xdg_generic_user_home_dir_filetrans_config($2, dir, ".config") @@ -203,14 +207,19 @@ interface(`xserver_role',` xdg_manage_documents($2) xdg_relabel_documents($2) + xdg_watch_documents_dirs($2) xdg_manage_downloads($2) xdg_relabel_downloads($2) + xdg_watch_downloads_dirs($2) xdg_manage_music($2) xdg_relabel_music($2) + xdg_watch_music_dirs($2) xdg_manage_pictures($2) xdg_relabel_pictures($2) + xdg_watch_pictures_dirs($2) xdg_manage_videos($2) xdg_relabel_videos($2) + xdg_watch_videos_dirs($2) xdg_cache_filetrans($2, mesa_shader_cache_t, dir, "mesa_shader_cache") ') @@ -508,7 +517,7 @@ interface(`xserver_use_user_fonts',` ') # Read per user fonts - allow $1 user_fonts_t:dir list_dir_perms; + allow $1 user_fonts_t:dir { list_dir_perms watch }; allow $1 user_fonts_t:file { map read_file_perms }; # Manipulate the global font cache diff --git a/policy/modules/system/miscfiles.if b/policy/modules/system/miscfiles.if index 47330a48..f11fee25 100644 --- a/policy/modules/system/miscfiles.if +++ b/policy/modules/system/miscfiles.if @@ -252,6 +252,25 @@ interface(`miscfiles_manage_generic_tls_privkey_files',` read_lnk_files_pattern($1, tls_privkey_t, tls_privkey_t) ') +######################################## +## +## Watch fonts. +## +## +## +## Domain allowed access. +## +## +## +# +interface(`miscfiles_watch_fonts',` + gen_require(` + type fonts_t; + ') + + allow $1 fonts_t:dir watch; +') + ######################################## ## ## Read fonts. @@ -805,6 +824,24 @@ interface(`miscfiles_manage_public_files',` manage_lnk_files_pattern($1, public_content_rw_t, public_content_rw_t) ') +######################################## +## +## Watch public files +## +## +## +## Domain allowed access. +## +## +# +interface(`miscfiles_watch_public_dirs',` + gen_require(` + type public_content_rw_t; + ') + + allow $1 public_content_rw_t:dir watch; +') + ######################################## ## ## Read TeX data diff --git a/policy/modules/system/userdomain.if b/policy/modules/system/userdomain.if index dd555850..0ffa000f 100644 --- a/policy/modules/system/userdomain.if +++ b/policy/modules/system/userdomain.if @@ -364,6 +364,8 @@ interface(`userdom_manage_home_role',` # cjp: this should probably be removed: allow $2 user_home_dir_t:dir { manage_dir_perms relabel_dir_perms }; + allow $2 { user_home_t user_home_dir_t }:dir watch; + userdom_manage_user_certs($2) userdom_user_home_dir_filetrans($2, user_cert_t, dir, ".pki") @@ -618,6 +620,8 @@ template(`userdom_common_user_template',` files_read_var_lib_files($1_t) # Stat lost+found. files_getattr_lost_found_dirs($1_t) + files_watch_etc_dirs($1_t) + files_watch_usr_dirs($1_t) fs_rw_cgroup_files($1_t) @@ -1166,6 +1170,7 @@ template(`userdom_unpriv_user_template', ` files_exec_usr_files($1_t) miscfiles_manage_public_files($1_t) + miscfiles_watch_public_dirs($1_t) tunable_policy(`user_dmesg',` kernel_read_ring_buffer($1_t) diff --git a/policy/modules/system/xdg.if b/policy/modules/system/xdg.if index 11fc4306..82304241 100644 --- a/policy/modules/system/xdg.if +++ b/policy/modules/system/xdg.if @@ -83,6 +83,42 @@ interface(`xdg_search_cache_dirs',` userdom_search_user_home_dirs($1) ') +######################################## +## +## Watch the xdg cache home directories +## +## +## +## Domain allowed access. +## +## +# +interface(`xdg_watch_cache_dirs',` + gen_require(` + type xdg_cache_t; + ') + + allow $1 xdg_cache_t:dir watch; +') + +######################################## +## +## Watch all the xdg cache home directories +## +## +## +## Domain allowed access. +## +## +# +interface(`xdg_watch_all_cache_dirs',` + gen_require(` + attribute xdg_cache_type; + ') + + allow $1 xdg_cache_type:dir watch; +') + ######################################## ## ## Read the xdg cache home files @@ -333,6 +369,42 @@ interface(`xdg_search_config_dirs',` userdom_search_user_home_dirs($1) ') +######################################## +## +## Watch the xdg config home directories +## +## +## +## Domain allowed access. +## +## +# +interface(`xdg_watch_config_dirs',` + gen_require(` + type xdg_config_t; + ') + + allow $1 xdg_config_t:dir watch; +') + +######################################## +## +## Watch all the xdg config home directories +## +## +## +## Domain allowed access. +## +## +# +interface(`xdg_watch_all_config_dirs',` + gen_require(` + attribute xdg_config_type; + ') + + allow $1 xdg_config_type:dir watch; +') + ######################################## ## ## Read the xdg config home files @@ -563,6 +635,42 @@ interface(`xdg_relabel_all_config',` userdom_search_user_home_dirs($1) ') +######################################## +## +## Watch the xdg data home directories +## +## +## +## Domain allowed access. +## +## +# +interface(`xdg_watch_data_dirs',` + gen_require(` + type xdg_data_t; + ') + + allow $1 xdg_data_t:dir watch; +') + +######################################## +## +## Watch all the xdg data home directories +## +## +## +## Domain allowed access. +## +## +# +interface(`xdg_watch_all_data_dirs',` + gen_require(` + attribute xdg_data_type; + ') + + allow $1 xdg_data_type:dir watch; +') + ######################################## ## ## Read the xdg data home files @@ -793,6 +901,24 @@ interface(`xdg_relabel_all_data',` userdom_search_user_home_dirs($1) ') +######################################## +## +## Watch the xdg documents home directories +## +## +## +## Domain allowed access. +## +## +# +interface(`xdg_watch_documents_dirs',` + gen_require(` + type xdg_documents_t; + ') + + allow $1 xdg_documents_t:dir watch; +') + ######################################## ## ## Create objects in the user home dir with an automatic type transition to @@ -865,6 +991,24 @@ interface(`xdg_relabel_documents',` userdom_search_user_home_dirs($1) ') +######################################## +## +## Watch the xdg downloads home directories +## +## +## +## Domain allowed access. +## +## +# +interface(`xdg_watch_downloads_dirs',` + gen_require(` + type xdg_downloads_t; + ') + + allow $1 xdg_downloads_t:dir watch; +') + ######################################### ## ## Read downloaded content @@ -1006,6 +1150,24 @@ interface(`xdg_relabel_downloads',` userdom_search_user_home_dirs($1) ') +######################################## +## +## Watch the xdg pictures home directories +## +## +## +## Domain allowed access. +## +## +# +interface(`xdg_watch_pictures_dirs',` + gen_require(` + type xdg_pictures_t; + ') + + allow $1 xdg_pictures_t:dir watch; +') + ######################################### ## ## Read user pictures content @@ -1101,6 +1263,24 @@ interface(`xdg_relabel_pictures',` userdom_search_user_home_dirs($1) ') +######################################## +## +## Watch the xdg music home directories +## +## +## +## Domain allowed access. +## +## +# +interface(`xdg_watch_music_dirs',` + gen_require(` + type xdg_music_t; + ') + + allow $1 xdg_music_t:dir watch; +') + ######################################### ## ## Read user music content @@ -1196,6 +1376,24 @@ interface(`xdg_relabel_music',` userdom_search_user_home_dirs($1) ') +######################################## +## +## Watch the xdg video content +## +## +## +## Domain allowed access. +## +## +# +interface(`xdg_watch_videos_dirs',` + gen_require(` + type xdg_videos_t; + ') + + allow $1 xdg_videos_t:dir watch; +') + ######################################### ## ## Read user video content -- 2.24.1