Received: by 2002:a25:1506:0:0:0:0:0 with SMTP id 6csp3588968ybv; Sun, 16 Feb 2020 00:55:02 -0800 (PST) X-Google-Smtp-Source: APXvYqzPryqrsRhVbR+cHplCNCvjV8esUr8LYqwgg/FmlfZli8iWKWiI4Dat3BRS7FZrYYlknASL X-Received: by 2002:a54:4f14:: with SMTP id e20mr6664482oiy.84.1581843302728; Sun, 16 Feb 2020 00:55:02 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1581843302; cv=none; d=google.com; s=arc-20160816; b=EILiOs0q9QCHaD11qd4HxCSGg9D0yl27IckRhFDQNHVs06dHAEZUd/iulaSJrr9RtI GnbCnkp/XjL2SjKQhCCQnT190DCPpJNHnIbFPosuMKu/S0xhm4goLC+Lm36x1/haD/YF 2QwQyCiEeQcbyEbBL5+Mz6TtN/nHvBqcxgl3VvwTb5OGu/V/PskpSXSycIrSto2djA93 jG57GCkzFcZ13ndXLUZVSxOqQfs1N0h8JIWrP0sSyY+IBT/EuC85zWd17A/wAe+Ckpkf lWJQWQGRCRujJp24Cpmovpz3QTK+z5pZX0YTdbqclMOBmHb21YsbJcSL10DdVR3BJBzJ RYJw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from :dkim-signature; bh=SJhXgSMm0h/lfoqth47F6Kk+3Gd1AXMlzDabVTHAJNM=; b=owtUTZiWtTzHaNw0tSELQqECF33mRG6Y12kzNeBXJNJYVQ055N+oiALB5F5RXD5QZ3 UOEHXVIW/ukFnfJdvrHvpvXhLRE3sSUcfvGp7nfPutJv69N1vDVwrA7QvHvlq3C+CH0C DAn8F49UDFnOzaAtj1VL57sG5HWINUVWwTWyZFR0ZImDhYuX8EFziuHy2EOLCmBxKmRY mvjg3F19jMH/808zGVnk2+mTkQyDDUcVyWCSNpoGZFsnZqZgbXBUTcpxnFyRODv2Nunt fhVQk6hkeER4ARtWhBb25/WlVZfydbswf/6exp70BpNBC+FDcKOZEIjLXw/NfGNSVadO 4yQg== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@perfinion-com.20150623.gappssmtp.com header.s=20150623 header.b="kz/ta8Rt"; spf=pass (google.com: best guess record for domain of selinux-refpolicy-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=selinux-refpolicy-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id y73si4846029oia.246.2020.02.16.00.55.00; Sun, 16 Feb 2020 00:55:02 -0800 (PST) Received-SPF: pass (google.com: best guess record for domain of selinux-refpolicy-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@perfinion-com.20150623.gappssmtp.com header.s=20150623 header.b="kz/ta8Rt"; spf=pass (google.com: best guess record for domain of selinux-refpolicy-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=selinux-refpolicy-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726128AbgBPIzA (ORCPT + 13 others); Sun, 16 Feb 2020 03:55:00 -0500 Received: from mail-pf1-f181.google.com ([209.85.210.181]:38652 "EHLO mail-pf1-f181.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1725989AbgBPIzA (ORCPT ); Sun, 16 Feb 2020 03:55:00 -0500 Received: by mail-pf1-f181.google.com with SMTP id x185so7264129pfc.5 for ; Sun, 16 Feb 2020 00:54:58 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=perfinion-com.20150623.gappssmtp.com; s=20150623; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=SJhXgSMm0h/lfoqth47F6Kk+3Gd1AXMlzDabVTHAJNM=; b=kz/ta8Rt9a4ANGJSW5xlT14RC9VIxYSkI2WSPgsW+ZTljrmog4TtFaquMHB4rI1aPU RHL1c1O3rjKIHF0qBDlk0DHYDiC0cXef/a7qbN6Otkx2MA7yHXZLLVHzqkr/dHMLSK53 YiD1To+4/3ubTaeQTTTXjT0bHBYgZ/r3G9CkHZGX7KV9YfaH9OHYBYdW8kVDEsHBBW1v BT5SPPvCMfa/UE5ykmnZKakmOKLMaatKaTZjeEK/ymdhMPlQQ6VXirV+TJkFPVqw7Sew VkklNraxXvCVy9hN7d2k9mdS1ivgGiBH4H/5xOvTM6kQRDPHvwTGNRsDxjgJ6Tkp+tBY mW6g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=SJhXgSMm0h/lfoqth47F6Kk+3Gd1AXMlzDabVTHAJNM=; b=OqzsEO8dSKIX8c0fdUaq8lYkMOntAPMo4Tsd6k53tXqShxY9zaWaY+9nslg8w0+KbF t3iaTe0TH7BRlaqPVqK/dNsKE+iWTKb0OpnXn9VEWcrgcm4Fvk+tyB6DYdspODXxKNIq H5/lGP4ZjibxPtPRHZLLehKSZUETOGaLWoKBvd8OF74f7mlsAY9uiUKd0sbNTV3Emv2W 9DwBzmXlOAZkcI+tBGWkW6t++SFcpnE4p2uExhs1OMRlX90XIVRHMSBAk817qEtuctMc yp2NckH9mIvTy2b1jFN0+Hj8R581T9kow3KwWakzCBt+tllCRP9CCxJNXx1ufTvhf8Hr dqfw== X-Gm-Message-State: APjAAAUoVFWepU37V7kJG2MEpaHB7Fm2vOTvsRf7cjB6OJLMtKcj1Dt2 hmBd7FRLcmAj96WCPm6v6GtjGs0N2j4GMA== X-Received: by 2002:a63:4385:: with SMTP id q127mr11347938pga.404.1581843297795; Sun, 16 Feb 2020 00:54:57 -0800 (PST) Received: from localhost ([101.127.140.252]) by smtp.gmail.com with ESMTPSA id f8sm12571896pfn.2.2020.02.16.00.54.56 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 16 Feb 2020 00:54:57 -0800 (PST) From: Jason Zaman To: selinux-refpolicy@vger.kernel.org Cc: Jason Zaman Subject: [PATCH 08/10] dbus: add watch perms Date: Sun, 16 Feb 2020 16:54:20 +0800 Message-Id: <20200216085422.36530-8-jason@perfinion.com> X-Mailer: git-send-email 2.24.1 In-Reply-To: <20200216085422.36530-1-jason@perfinion.com> References: <20200216085422.36530-1-jason@perfinion.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Sender: selinux-refpolicy-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: selinux-refpolicy@vger.kernel.org From: Jason Zaman avc: denied { watch } for pid=10630 comm="dbus-daemon" path="/usr/share/dbus-1/accessibility-services" dev="zfs" ino=244551 scontext=staff_u:staff_r:staff_dbusd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:usr_t:s0 tclass=dir permissive=0 avc: denied { watch } for pid=10622 comm="dbus-daemon" path="/etc/dbus-1/session.d" dev="zfs" ino=262694 scontext=staff_u:staff_r:staff_dbusd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:dbusd_etc_t:s0 tclass=dir permissive=0 --- policy/modules/services/dbus.te | 2 ++ 1 file changed, 2 insertions(+) diff --git a/policy/modules/services/dbus.te b/policy/modules/services/dbus.te index 4e395f7f..6f9835c6 100644 --- a/policy/modules/services/dbus.te +++ b/policy/modules/services/dbus.te @@ -219,6 +219,7 @@ allow session_bus_type self:netlink_selinux_socket create_socket_perms; allow session_bus_type dbusd_etc_t:dir list_dir_perms; read_files_pattern(session_bus_type, dbusd_etc_t, dbusd_etc_t) read_lnk_files_pattern(session_bus_type, dbusd_etc_t, dbusd_etc_t) +allow session_bus_type dbusd_etc_t:dir watch; manage_dirs_pattern(session_bus_type, session_dbusd_home_t, session_dbusd_home_t) manage_files_pattern(session_bus_type, session_dbusd_home_t, session_dbusd_home_t) @@ -258,6 +259,7 @@ domain_use_interactive_fds(session_bus_type) files_list_home(session_bus_type) files_read_usr_files(session_bus_type) +files_watch_usr_dirs(session_bus_type) files_dontaudit_search_var(session_bus_type) fs_getattr_romfs(session_bus_type) -- 2.24.1