Received-SPF: pass (google.com: domain of selinux-refpolicy-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
From:   Russell Coker <russell@coker.com.au>
To:     selinux-refpolicy@vger.kernel.org,
        Chris PeBenito <pebenito@ieee.org>
Reply-To: russell@coker.com.au
Subject: Re: [PATCH] new sddm pam patch
Date:   Sun, 27 Mar 2022 22:42:50 +1100
Message-ID: <3136581.m74T952WcD@xev>
In-Reply-To: <da3ba04d-9e76-677a-b1b2-2b65f9dc3892@ieee.org>
References: <Yg3w0gpFvUWATmA2@xev.coker.com.au> <da3ba04d-9e76-677a-b1b2-2b65f9dc3892@ieee.org>
MIME-Version: 1.0
Content-Transfer-Encoding: 7Bit
Content-Type: text/plain; charset="us-ascii"
Precedence: bulk

On Friday, 18 February 2022 00:48:44 AEDT Chris PeBenito wrote:
> > +# for sddm to use pam for greeter, sddm greeter needs execmod
> > +allow xdm_t xdm_tmpfs_t:file execmod;
> > +
> > # Run Xorg.wrap
> > can_exec(xserver_t, xserver_exec_t)
> > 
> > Index: refpolicy-2.20220217/config/appconfig-mcs/seusers
> > ===================================================================
> > --- refpolicy-2.20220217.orig/config/appconfig-mcs/seusers
> > +++ refpolicy-2.20220217/config/appconfig-mcs/seusers
> > @@ -1,2 +1,3 @@
> > root:unconfined_u:s0-mcs_systemhigh
> > __default__:unconfined_u:s0-mcs_systemhigh
> > +sddm:xdm:s0
> 
> Did sddm:system_u fail?

Yes, there's several programs that end up in the wrong domains (or try to) if 
you do that.

> If we must have a new seuser, please place it in
> the xserver module.  The build system supports declaring users in modules.

OK, that's in the next version.

> The changes for seusers changes for standard and mls are missing.

OK, done that too.

-- 
My Main Blog         http://etbe.coker.com.au/
My Documents Blog    http://doc.coker.com.au/