Received-SPF: pass (google.com: domain of selinux-refpolicy-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Message-ID: <9eaf8204-0462-9ebf-b0b7-66099cca81a6@ieee.org>
Date:   Mon, 25 Apr 2022 09:31:03 -0400
MIME-Version: 1.0
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101
 Thunderbird/91.8.0
Subject: Re: [PATCH] wm domains and sddm fixes
Content-Language: en-US
To:     Russell Coker <russell@coker.com.au>,
        selinux-refpolicy@vger.kernel.org
References: <Yk2JSK9nsIoPJ/QK@xev.coker.com.au>
From:   Chris PeBenito <pebenito@ieee.org>
In-Reply-To: <Yk2JSK9nsIoPJ/QK@xev.coker.com.au>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
Precedence: bulk

On 4/6/22 08:36, Russell Coker wrote:
> These patches make a sddm login with the $1_wm_t domain work.  Most of this
> is for X11 but there is a bit for Wayland too.
> 
> Signed-off-by: Russell Coker <russell@coker.com.au>
> 
> Index: refpolicy-2.20220322/policy/modules/apps/wm.if
> ===================================================================
> --- refpolicy-2.20220322.orig/policy/modules/apps/wm.if
> +++ refpolicy-2.20220322/policy/modules/apps/wm.if
> @@ -61,6 +61,8 @@ template(`wm_role_template',`
>   	allow $3 $1_wm_t:process { ptrace signal_perms };
>   	ps_process_pattern($3, $1_wm_t)
>   
> +	kernel_read_kernel_sysctls($1_wm_t)
> +
>   	allow $1_wm_t $3:process { signull sigkill };
>   
>   	domtrans_pattern($3, wm_exec_t, $1_wm_t)
> @@ -81,6 +83,10 @@ template(`wm_role_template',`
>   
>   	wm_write_pipes($1, $3)
>   
> +	tunable_policy(`wm_write_xdg_data', `
> +		xdg_manage_data($1_wm_t)
> +	')
> +
>   	optional_policy(`
>   		dbus_connect_spec_session_bus($1, $1_wm_t)
>   		dbus_spec_session_bus_client($1, $1_wm_t)
> @@ -115,6 +121,17 @@ template(`wm_role_template',`
>   	optional_policy(`
>   		xdg_watch_config_files($1_wm_t)
>   	')
> +
> +	optional_policy(`
> +		systemd_dbus_chat_logind($1_wm_t)
> +	')
> +
> +	optional_policy(`
> +		xdg_read_data_files($1_wm_t)
> +		xdg_manage_cache($1_wm_t)
> +		xdg_manage_config($1_wm_t)
> +		xdg_watch_data_files($1_wm_t)
> +	')
>   ')


Please merge all the xdg calls into a single optional block.  The added tunable 
should be in this optional too.

>   ########################################
> Index: refpolicy-2.20220322/policy/modules/kernel/corecommands.fc
> ===================================================================
> --- refpolicy-2.20220322.orig/policy/modules/kernel/corecommands.fc
> +++ refpolicy-2.20220322/policy/modules/kernel/corecommands.fc
> @@ -256,6 +256,7 @@ ifdef(`distro_gentoo',`
>   /usr/lib/xfce4/session/xfsm-shutdown-helper -- gen_context(system_u:object_r:bin_t,s0)
>   /usr/lib/xfce4/xfconf/xfconfd	--	gen_context(system_u:object_r:bin_t,s0)
>   /usr/lib/xfce4/xfwm4/helper-dialog --	gen_context(system_u:object_r:bin_t,s0)
> +/usr/lib/x86_64-linux-gnu/libexec/.* -- gen_context(system_u:object_r:bin_t,s0)
>   
>   ifdef(`distro_debian',`
>   /usr/lib/[^/]+/tumbler-1/tumblerd --	gen_context(system_u:object_r:bin_t,s0)
> Index: refpolicy-2.20220322/policy/modules/system/unconfined.if
> ===================================================================
> --- refpolicy-2.20220322.orig/policy/modules/system/unconfined.if
> +++ refpolicy-2.20220322/policy/modules/system/unconfined.if
> @@ -40,6 +40,7 @@ interface(`unconfined_domain_noaudit',`
>   	allow $1 self:{ capability cap_userns } { chown dac_override dac_read_search fowner fsetid kill setgid setuid setpcap linux_immutable net_bind_service net_broadcast net_admin net_raw ipc_lock ipc_owner sys_rawio sys_chroot sys_ptrace sys_pacct sys_admin sys_boot sys_nice sys_resource sys_time sys_tty_config mknod lease audit_write audit_control setfcap };
>   	allow $1 self:{ capability2 cap2_userns } { syslog wake_alarm bpf perfmon };
>   	allow $1 self:fifo_file manage_fifo_file_perms;
> +	allow $1 self:system status;
>   
>   	# Manage most namespace capabilities
>   	allow $1 self:cap_userns { audit_write chown dac_override dac_read_search fowner fsetid ipc_lock ipc_owner kill lease linux_immutable mknod net_admin net_bind_service net_raw setfcap setgid setpcap setuid sys_admin sys_boot sys_chroot sys_module sys_nice sys_pacct sys_ptrace sys_rawio sys_resource sys_time sys_tty_config };
> Index: refpolicy-2.20220322/policy/modules/apps/gnome.if
> ===================================================================
> --- refpolicy-2.20220322.orig/policy/modules/apps/gnome.if
> +++ refpolicy-2.20220322/policy/modules/apps/gnome.if
> @@ -112,6 +112,10 @@ template(`gnome_role_template',`
>   		')
>   
>   		optional_policy(`
> +			systemd_dbus_chat_logind($1_gkeyringd_t)
> +		')
> +
> +		optional_policy(`
>   			wm_dbus_chat($1, $1_gkeyringd_t)
>   		')
>   	')
> @@ -814,3 +818,21 @@ interface(`gnome_mmap_gstreamer_orcexec'
>   
>   	allow $1 gstreamer_orcexec_t:file mmap_exec_file_perms;
>   ')
> +
> +########################################
> +## <summary>
> +##	watch gnome_xdg_config_t dirs
> +## </summary>
> +## <param name="domain">
> +##	<summary>
> +##	Domain allowed access.
> +##	</summary>
> +## </param>
> +#
> +interface(`gnome_watch_xdg_config_dirs',`
> +	gen_require(`
> +		type gnome_xdg_config_t;
> +	')
> +
> +	allow $1 gnome_xdg_config_t:dir watch;
> +')
> Index: refpolicy-2.20220322/policy/modules/services/xserver.if
> ===================================================================
> --- refpolicy-2.20220322.orig/policy/modules/services/xserver.if
> +++ refpolicy-2.20220322/policy/modules/services/xserver.if
> @@ -213,7 +213,7 @@ template(`xserver_role',`
>   
>   	xserver_read_xkb_libs($2)
>   
> -	allow $2 xdm_t:unix_stream_socket accept;
> +	allow $2 xdm_t:unix_stream_socket { getattr accept };
>   
>   	optional_policy(`
>   		systemd_user_app_status($1, xserver_t)
> Index: refpolicy-2.20220322/policy/modules/system/miscfiles.if
> ===================================================================
> --- refpolicy-2.20220322.orig/policy/modules/system/miscfiles.if
> +++ refpolicy-2.20220322/policy/modules/system/miscfiles.if
> @@ -634,6 +634,7 @@ interface(`miscfiles_watch_localization'
>   		type locale_t;
>   	')
>   
> +	allow $1 locale_t:dir watch;
>   	allow $1 locale_t:file watch;
>   ')
>   
> Index: refpolicy-2.20220322/policy/modules/system/userdomain.if
> ===================================================================
> --- refpolicy-2.20220322.orig/policy/modules/system/userdomain.if
> +++ refpolicy-2.20220322/policy/modules/system/userdomain.if
> @@ -121,6 +121,8 @@ template(`userdom_base_user_template',`
>   	miscfiles_read_generic_certs($1_t)
>   	miscfiles_watch_fonts_dirs($1_t)
>   
> +	userdom_write_user_runtime_sockets($1_t)
> +
>   	sysnet_read_config($1_t)
>   
>   	# kdeinit wants systemd status
> @@ -960,6 +962,7 @@ template(`userdom_login_user_template',
>   	userdom_exec_user_tmp_files($1_t)
>   	userdom_exec_user_home_content_files($1_t)
>   
> +	userdom_execmod_user_tmpfs_files($1_t)
>   	userdom_map_user_tmpfs_files($1_t)
>   
>   	userdom_change_password_template($1)
> @@ -1214,8 +1217,10 @@ template(`userdom_unpriv_user_template',
>   	corenet_tcp_bind_xserver_port($1_t)
>   
>   	files_exec_usr_files($1_t)
> +	files_watch_etc_symlinks($1_t)
>   
>   	miscfiles_manage_public_files($1_t)
> +	miscfiles_watch_localization($1_t)
>   	miscfiles_watch_public_dirs($1_t)
>   
>   	tunable_policy(`user_dmesg',`
> @@ -1234,6 +1239,7 @@ template(`userdom_unpriv_user_template',
>   	tunable_policy(`user_tcp_server',`
>   		corenet_tcp_bind_generic_node($1_t)
>   		corenet_tcp_bind_generic_port($1_t)
> +		corenet_tcp_bind_all_unreserved_ports($1_t)
>   	')
>   
>   	# Allow users to run UDP servers (bind to ports and accept connection from
> @@ -1241,6 +1247,7 @@ template(`userdom_unpriv_user_template',
>   	tunable_policy(`user_udp_server',`
>   		corenet_udp_bind_generic_node($1_t)
>   		corenet_udp_bind_generic_port($1_t)
> +		corenet_udp_bind_all_unreserved_ports($1_t)
>   	')
>   
>   	optional_policy(`
> @@ -1582,6 +1589,8 @@ template(`userdom_xdg_user_template',`
>   	xdg_manage_all_data($1_t)
>   	xdg_relabel_all_data($1_t)
>   	xdg_watch_all_data_dirs($1_t)
> +	xdg_watch_all_data_files($1_t)
> +	xdg_exec_data($1_t)
>   
>   	xdg_generic_user_home_dir_filetrans_cache($1_t, dir, ".cache")
>   	xdg_generic_user_home_dir_filetrans_config($1_t, dir, ".config")
> @@ -3686,6 +3695,24 @@ interface(`userdom_delete_user_runtime_f
>   
>   ########################################
>   ## <summary>
> +##	write user runtime sockets
> +## </summary>
> +## <param name="domain">
> +##	<summary>
> +##	Domain allowed access.
> +##	</summary>
> +## </param>
> +#
> +interface(`userdom_write_user_runtime_sockets',`
> +	gen_require(`
> +		type user_runtime_t;
> +	')
> +
> +	allow $1 user_runtime_t:sock_file write;

No associated unix socket access?


> +')
> +
> +########################################
> +## <summary>
>   ##	Search users runtime directories.
>   ## </summary>
>   ## <param name="domain">
> @@ -4094,6 +4121,24 @@ interface(`userdom_manage_user_tmpfs_fil
>   ')
>   
>   ########################################
> +## <summary>
> +##	execute and execmod user tmpfs files
> +## </summary>
> +## <param name="domain">
> +##	<summary>
> +##	Domain allowed access.
> +##	</summary>
> +## </param>
> +#
> +interface(`userdom_execmod_user_tmpfs_files',`
> +	gen_require(`
> +		type user_tmpfs_t;
> +	')
> +
> +	allow $1 user_tmpfs_t:file { execute execmod };
> +')
> +
> +########################################
>   ## <summary>
>   ##	Get the attributes of a user domain tty.
>   ## </summary>
> Index: refpolicy-2.20220322/policy/modules/apps/pulseaudio.te
> ===================================================================
> --- refpolicy-2.20220322.orig/policy/modules/apps/pulseaudio.te
> +++ refpolicy-2.20220322/policy/modules/apps/pulseaudio.te
> @@ -222,6 +222,7 @@ optional_policy(`
>   	systemd_read_logind_sessions_files(pulseaudio_t)
>   	# for /run/systemd/users/$PID
>   	systemd_read_logind_runtime_files(pulseaudio_t)
> +	systemd_watch_logind_sessions_dirs(pulseaudio_t)
>   ')
>   
>   optional_policy(`
> Index: refpolicy-2.20220322/policy/modules/system/xdg.if
> ===================================================================
> --- refpolicy-2.20220322.orig/policy/modules/system/xdg.if
> +++ refpolicy-2.20220322/policy/modules/system/xdg.if
> @@ -691,6 +691,24 @@ interface(`xdg_watch_data_dirs',`
>   
>   ########################################
>   ## <summary>
> +##	Watch the xdg data home files
> +## </summary>
> +## <param name="domain">
> +##	<summary>
> +##	Domain allowed access.
> +##	</summary>
> +## </param>
> +#
> +interface(`xdg_watch_data_files',`
> +	gen_require(`
> +		type xdg_data_t;
> +	')
> +
> +	allow $1 xdg_data_t:file watch;
> +')
> +
> +########################################
> +## <summary>
>   ##	Watch all the xdg data home directories
>   ## </summary>
>   ## <param name="domain">
> @@ -709,6 +727,24 @@ interface(`xdg_watch_all_data_dirs',`
>   
>   ########################################
>   ## <summary>
> +##	Watch all the xdg data home files
> +## </summary>
> +## <param name="domain">
> +##	<summary>
> +##	Domain allowed access.
> +##	</summary>
> +## </param>
> +#
> +interface(`xdg_watch_all_data_files',`
> +	gen_require(`
> +		attribute xdg_data_type;
> +	')
> +
> +	allow $1 xdg_data_type:file watch;
> +')
> +
> +########################################
> +## <summary>
>   ##	Read the xdg data home files
>   ## </summary>
>   ## <param name="domain">
> @@ -914,6 +950,24 @@ interface(`xdg_relabel_data',`
>   ')
>   
>   ########################################
> +## <summary>
> +##	Allow domain to execute xdg_data_t, for some application config in kde
> +## </summary>
> +## <param name="domain">
> +##	<summary>
> +##	Domain allowed access.
> +##	</summary>
> +## </param>
> +#
> +interface(`xdg_exec_data',`
> +	gen_require(`
> +		type xdg_data_t;
> +	')
> +
> +	can_exec($1, xdg_data_t)
> +')
> +
> +########################################
>   ## <summary>
>   ##	Allow relabeling the xdg data home files, regardless of their type
>   ## </summary>
> Index: refpolicy-2.20220322/policy/modules/apps/wm.te
> ===================================================================
> --- refpolicy-2.20220322.orig/policy/modules/apps/wm.te
> +++ refpolicy-2.20220322/policy/modules/apps/wm.te
> @@ -7,6 +7,14 @@ policy_module(wm)
>   
>   attribute wm_domain;
>   
> +
> +## <desc>
> +##      <p>
> +##      Grant the window manager domains write access to xdg data
> +##      </p>
> +## </desc>
> +gen_tunable(`wm_write_xdg_data', false)
> +
>   type wm_exec_t;
>   corecmd_executable_file(wm_exec_t)
>   
> Index: refpolicy-2.20220322/policy/modules/apps/chromium.te
> ===================================================================
> --- refpolicy-2.20220322.orig/policy/modules/apps/chromium.te
> +++ refpolicy-2.20220322/policy/modules/apps/chromium.te
> @@ -275,6 +275,7 @@ optional_policy(`
>   
>   	optional_policy(`
>   		gnome_dbus_chat_all_gkeyringd(chromium_t)
> +		gnome_watch_xdg_config_dirs(chromium_t)
>   	')
>   
>   	optional_policy(`
> Index: refpolicy-2.20220322/policy/modules/services/xserver.fc
> ===================================================================
> --- refpolicy-2.20220322.orig/policy/modules/services/xserver.fc
> +++ refpolicy-2.20220322/policy/modules/services/xserver.fc
> @@ -37,6 +37,7 @@ HOME_DIR/\.Xauthority.*	--	gen_context(s
>   /etc/kde[34]?/kdm/backgroundrc	gen_context(system_u:object_r:xdm_var_run_t,s0)
>   
>   /etc/rc\.d/init\.d/x11-common -- gen_context(system_u:object_r:xdm_exec_t,s0)
> +/etc/sddm/wayland-session --	gen_context(system_u:object_r:xsession_exec_t,s0)
>   /etc/sddm/Xsession	--	gen_context(system_u:object_r:xsession_exec_t,s0)
>   
>   /etc/X11/[wx]dm/Xreset.* --	gen_context(system_u:object_r:xsession_exec_t,s0)


-- 
Chris PeBenito