Received-SPF: pass (google.com: domain of selinux-refpolicy-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Message-ID: <25751c9c-5c83-b7e2-a261-d2b7f8d8883d@linux.microsoft.com>
Date:   Wed, 16 Feb 2022 10:40:59 -0500
MIME-Version: 1.0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101
 Thunderbird/91.6.0
Subject: Re: [PATCH] sddm role
Content-Language: en-US
To:     Russell Coker <russell@coker.com.au>,
        selinux-refpolicy@vger.kernel.org
References: <Ygz4RDgrMQ6dDVQZ@xev.coker.com.au>
From:   Chris PeBenito <chpebeni@linux.microsoft.com>
In-Reply-To: <Ygz4RDgrMQ6dDVQZ@xev.coker.com.au>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
Precedence: bulk

On 2/16/2022 08:12, Russell Coker wrote:
> This patch adds a role for the xdm program.  It's needed by sddm because
> it uses PAM to run it's own worker process and thus needs to do all the
> checks for a valid session for it's own UID.

IMO this is a bug in the code.


> Index: refpolicy-2.20220216/config/appconfig-mcs/seusers
> ===================================================================
> --- refpolicy-2.20220216.orig/config/appconfig-mcs/seusers
> +++ refpolicy-2.20220216/config/appconfig-mcs/seusers
> @@ -1,2 +1,3 @@
>   root:unconfined_u:s0-mcs_systemhigh
>   __default__:unconfined_u:s0-mcs_systemhigh
> +sddm:xdm:s0

Did you try sddm:system_u instead?  That seems like it could make the 
change a bit simpler, since we won't need the additional xdm_r.

Also, config changes should be reflected in the appconfig-standard and 
appconfig-mls configs, in addition to -mcs.


-- 
Chris PeBenito