Received: by 2002:a25:1506:0:0:0:0:0 with SMTP id 6csp4035516ybv; Sun, 16 Feb 2020 12:04:10 -0800 (PST) X-Google-Smtp-Source: APXvYqxTBOH1DgTp5mYxaRQEwnyIsP3lkinr0+G/8scRx1HfEHFbUrRn1wnp8LzgKn/P0eXYiudX X-Received: by 2002:a05:6830:200d:: with SMTP id e13mr9885704otp.364.1581883450891; Sun, 16 Feb 2020 12:04:10 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1581883450; cv=none; d=google.com; s=arc-20160816; b=tkALVpctrJUzNtjloEzkI9d8EUjiiUiCeGVDEgGjfkUDfq3U+p90aIDu81HoLQoTx8 7PSv9mHer5AvgabDqhcY3xwtmbTLJXilK9J2Kq/wq3cDESb65w0vECjTjAS7qOYdq8k1 7s0djfMk84bvJPqVTFfuOOI++g3yF4N0/YTzeo/BEme4foGWwMe/YrWeqCBdiWxKDxgb kGDy6YTl40si/HGzxJg1yPTQql7dlw3lv7l3ikxW17eSFrraPnt+LjTwVtItpClLkRAn wD+gfEtKwwKABIfuUONY4J60dLbxrvzV5mDmLPB7CaHrFMDYlddnonAyYFAw5K2zARYD 2UrA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from :dkim-signature; bh=HhWNR1JzKMZDFCHenq5mcr3MRD0TSQ7C2Q4yEHEv0+w=; b=aRbMxvDQNDvQ6wJD0bcFyeM1qYlS71SQGwxaTTGbwnqOr36a0578YQKCsFsHwkp2XZ 0r1LlDsOVn75OZh29lR122O55MD7ZYVhIHlFVnHtr4AzuUm1eANXbGga5X62IFd4GhsQ OI+Ih+xVe9B8B3dwUqe0Ba0yjHG5bH31yVlEkF6kxnVx0hSURZaUamcJzyrhShU5v6Ej 66MMM5uv6pxXGppJmhRUSL30p+iaJW53BXEtHLmmzSNRN4o/dv0SOpt0pxbXCWT8FovK 0mFoNs85SRwtE6+7mz2EuiRk46Q1abdEFgknxRqbsTmOrXjoqzAlYAXRYBXbA7SsbN4y gzuA== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@perfinion-com.20150623.gappssmtp.com header.s=20150623 header.b=0NYGC+UP; spf=pass (google.com: best guess record for domain of selinux-refpolicy-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=selinux-refpolicy-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id s22si5287396oij.35.2020.02.16.12.04.08; Sun, 16 Feb 2020 12:04:10 -0800 (PST) Received-SPF: pass (google.com: best guess record for domain of selinux-refpolicy-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@perfinion-com.20150623.gappssmtp.com header.s=20150623 header.b=0NYGC+UP; spf=pass (google.com: best guess record for domain of selinux-refpolicy-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=selinux-refpolicy-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726142AbgBPUEI (ORCPT + 13 others); Sun, 16 Feb 2020 15:04:08 -0500 Received: from mail-pg1-f173.google.com ([209.85.215.173]:46130 "EHLO mail-pg1-f173.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1725989AbgBPUEI (ORCPT ); Sun, 16 Feb 2020 15:04:08 -0500 Received: by mail-pg1-f173.google.com with SMTP id b35so7764864pgm.13 for ; Sun, 16 Feb 2020 12:04:08 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=perfinion-com.20150623.gappssmtp.com; s=20150623; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=HhWNR1JzKMZDFCHenq5mcr3MRD0TSQ7C2Q4yEHEv0+w=; b=0NYGC+UPPHhDNgDkPckLtiZoze1rJCQOnVjG3ou3hY+yZYu3PfLqvZ0pbzHKPlRdvW 5v8lTu8V10Eee6KcT2t6+Jtc3lAUX6NsAT/OwgmF5fyyt+HlSIE75w+R32zCBsNpzXGB /7aQY8CM1VSm8mQVr4DYRJ/XFW4InCVYx2E7veo+mQsxL2lbUylPNiIBbpHSj2NKkinm 5rxHP1WJH8VLFTozR1WNt0XIw/aM4UzqgP6ziVijUCEIMaEbT0KnwuxKdwwmxVBtSHMq i03qpst5OUVP+7yU5AXAwbVts1xo+0BfxsNXbsU1hOZqHn9coAEBRuOsOgqFF516BVEJ CFpQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=HhWNR1JzKMZDFCHenq5mcr3MRD0TSQ7C2Q4yEHEv0+w=; b=hke219ltNHQhnFMBwQ6FTy0XiE7Y+MlvXs5qbD2+SQHjKcfK8rZSAlIyhkggAKj01i VnUxGLouwhLPv8dRCpemy3B+aQw3vVNFZBjNYyYUw/ofVbnOckQosQg6sgVpzk9yQTw9 zCx/UnsDemmfUUke3g9LJvzT5nGlXwWgb2++67RQhuSLGUcmSWkQnXd9qT1FoVF8SdjO E3zv/O6+gPUHsmPdyVIkZKeMlGO9ozoNnSCSKmYEa9ramECCmOas+AvQX2TMF1WlXVhb Jj6eI8ccfNPYJXCZR7rYK/mueW6RWd48qeDWJlXDeofTLnpdy/TvNc6ozb+W6GO7fV2U 7oOw== X-Gm-Message-State: APjAAAUj/iyR5XPKgZkAKm4FGztbe0wfgzIIDWGjD2jECrqgf4AMsLls ZuFHw7f2mrVEwJtUt3n/bTnLidqmRT4= X-Received: by 2002:a63:b047:: with SMTP id z7mr14374364pgo.431.1581883447463; Sun, 16 Feb 2020 12:04:07 -0800 (PST) Received: from localhost ([101.127.140.252]) by smtp.gmail.com with ESMTPSA id p24sm13658116pff.69.2020.02.16.12.04.06 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 16 Feb 2020 12:04:06 -0800 (PST) From: Jason Zaman To: selinux-refpolicy@vger.kernel.org Cc: Jason Zaman Subject: [PATCH 08/10] dbus: add watch perms Date: Mon, 17 Feb 2020 04:03:17 +0800 Message-Id: <20200216200319.39337-8-jason@perfinion.com> X-Mailer: git-send-email 2.24.1 In-Reply-To: <20200216200319.39337-1-jason@perfinion.com> References: <20200216200319.39337-1-jason@perfinion.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Sender: selinux-refpolicy-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: selinux-refpolicy@vger.kernel.org avc: denied { watch } for pid=10630 comm="dbus-daemon" path="/usr/share/dbus-1/accessibility-services" dev="zfs" ino=244551 scontext=staff_u:staff_r:staff_dbusd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:usr_t:s0 tclass=dir permissive=0 avc: denied { watch } for pid=10622 comm="dbus-daemon" path="/etc/dbus-1/session.d" dev="zfs" ino=262694 scontext=staff_u:staff_r:staff_dbusd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:dbusd_etc_t:s0 tclass=dir permissive=0 Signed-off-by: Jason Zaman --- policy/modules/services/dbus.te | 2 ++ 1 file changed, 2 insertions(+) diff --git a/policy/modules/services/dbus.te b/policy/modules/services/dbus.te index 4e395f7f..6f9835c6 100644 --- a/policy/modules/services/dbus.te +++ b/policy/modules/services/dbus.te @@ -219,6 +219,7 @@ allow session_bus_type self:netlink_selinux_socket create_socket_perms; allow session_bus_type dbusd_etc_t:dir list_dir_perms; read_files_pattern(session_bus_type, dbusd_etc_t, dbusd_etc_t) read_lnk_files_pattern(session_bus_type, dbusd_etc_t, dbusd_etc_t) +allow session_bus_type dbusd_etc_t:dir watch; manage_dirs_pattern(session_bus_type, session_dbusd_home_t, session_dbusd_home_t) manage_files_pattern(session_bus_type, session_dbusd_home_t, session_dbusd_home_t) @@ -258,6 +259,7 @@ domain_use_interactive_fds(session_bus_type) files_list_home(session_bus_type) files_read_usr_files(session_bus_type) +files_watch_usr_dirs(session_bus_type) files_dontaudit_search_var(session_bus_type) fs_getattr_romfs(session_bus_type) -- 2.24.1