From: Laurent Bigonville <[email protected]>
This is necessary for at least pulseaudio and libvirtd running in the
user session.
---
policy/users | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/policy/users b/policy/users
index c4ebc7e..8d13fbc 100644
--- a/policy/users
+++ b/policy/users
@@ -25,11 +25,11 @@ gen_user(system_u,, system_r, s0, s0 - mls_systemhigh, mcs_allcats)
# permit any access to such users, then remove this entry.
#
gen_user(user_u, user, user_r, s0, s0)
-gen_user(staff_u, staff, staff_r sysadm_r ifdef(`enable_mls',`secadm_r auditadm_r'), s0, s0 - mls_systemhigh, mcs_allcats)
+gen_user(staff_u, staff, staff_r sysadm_r system_r ifdef(`enable_mls',`secadm_r auditadm_r'), s0, s0 - mls_systemhigh, mcs_allcats)
gen_user(sysadm_u, sysadm, sysadm_r, s0, s0 - mls_systemhigh, mcs_allcats)
# Until order dependence is fixed for users:
-gen_user(unconfined_u, unconfined, unconfined_r, s0, s0 - mls_systemhigh, mcs_allcats)
+gen_user(unconfined_u, unconfined, unconfined_r system_r, s0, s0 - mls_systemhigh, mcs_allcats)
#
# The following users correspond to Unix identities.
--
1.7.10.4
Le Sat, 22 Sep 2012 15:21:32 +0200,
Laurent Bigonville <[email protected]> a ?crit :
> From: Laurent Bigonville <[email protected]>
>
> This is necessary for at least pulseaudio and libvirtd running in the
> user session.
> ---
> policy/users | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/policy/users b/policy/users
> index c4ebc7e..8d13fbc 100644
> --- a/policy/users
> +++ b/policy/users
> @@ -25,11 +25,11 @@ gen_user(system_u,, system_r, s0, s0 -
> mls_systemhigh, mcs_allcats) # permit any access to such users, then
> remove this entry. #
> gen_user(user_u, user, user_r, s0, s0)
> -gen_user(staff_u, staff, staff_r sysadm_r
> ifdef(`enable_mls',`secadm_r auditadm_r'), s0, s0 - mls_systemhigh,
> mcs_allcats) +gen_user(staff_u, staff, staff_r sysadm_r system_r
> ifdef(`enable_mls',`secadm_r auditadm_r'), s0, s0 - mls_systemhigh,
> mcs_allcats) gen_user(sysadm_u, sysadm, sysadm_r, s0, s0 -
> mls_systemhigh, mcs_allcats) # Until order dependence is fixed for
> users: -gen_user(unconfined_u, unconfined, unconfined_r, s0, s0 -
> mls_systemhigh, mcs_allcats) +gen_user(unconfined_u, unconfined,
> unconfined_r system_r, s0, s0 - mls_systemhigh, mcs_allcats) #
> # The following users correspond to Unix identities.
Any thoughts on that patch?
Cheers
Laurent Bigonville
On 10/08/12 17:21, Laurent Bigonville wrote:
> Le Sat, 22 Sep 2012 15:21:32 +0200,
> Laurent Bigonville <[email protected]> a ??crit :
>
>> From: Laurent Bigonville <[email protected]>
>>
>> This is necessary for at least pulseaudio and libvirtd running in the
>> user session.
>> ---
>> policy/users | 4 ++--
>> 1 file changed, 2 insertions(+), 2 deletions(-)
>>
>> diff --git a/policy/users b/policy/users
>> index c4ebc7e..8d13fbc 100644
>> --- a/policy/users
>> +++ b/policy/users
>> @@ -25,11 +25,11 @@ gen_user(system_u,, system_r, s0, s0 -
>> mls_systemhigh, mcs_allcats) # permit any access to such users, then
>> remove this entry. #
>> gen_user(user_u, user, user_r, s0, s0)
>> -gen_user(staff_u, staff, staff_r sysadm_r
>> ifdef(`enable_mls',`secadm_r auditadm_r'), s0, s0 - mls_systemhigh,
>> mcs_allcats) +gen_user(staff_u, staff, staff_r sysadm_r system_r
>> ifdef(`enable_mls',`secadm_r auditadm_r'), s0, s0 - mls_systemhigh,
>> mcs_allcats) gen_user(sysadm_u, sysadm, sysadm_r, s0, s0 -
>> mls_systemhigh, mcs_allcats) # Until order dependence is fixed for
>> users: -gen_user(unconfined_u, unconfined, unconfined_r, s0, s0 -
>> mls_systemhigh, mcs_allcats) +gen_user(unconfined_u, unconfined,
>> unconfined_r system_r, s0, s0 - mls_systemhigh, mcs_allcats) #
>> # The following users correspond to Unix identities.
>
> Any thoughts on that patch?
The patch would need to be updated to be controlled by the direct_sysadm_daemon build option, as it is with the root seuser.
--
Chris PeBenito
Tresys Technology, LLC
http://www.tresys.com | oss.tresys.com
Le Tue, 9 Oct 2012 10:00:21 -0400,
"Christopher J. PeBenito" <[email protected]> a ?crit :
> On 10/08/12 17:21, Laurent Bigonville wrote:
> >
> > Any thoughts on that patch?
>
> The patch would need to be updated to be controlled by the
> direct_sysadm_daemon build option, as it is with the root seuser.
>
My initial issue was that when dbus was starting pulseaudio and libvirt,
logged-in using my unconfined user, it was trying to transition the
process to unconfined_u:system_r:{pulseaudio_t,virtd_t} and it was
exploding as the label was invalid.
So if the policy is compiled without direct_sysadm_daemon I guess that
this issue will persist.
Also I've added the system_r role to the staff_u to be consistant (and
because it's also done in the Fedora policy)
Laurent Bigonville
On Tue, Oct 9, 2012 at 8:57 PM, Laurent Bigonville <[email protected]> wrote:
> Also I've added the system_r role to the staff_u to be consistant (and
> because it's also done in the Fedora policy)
It also makes sense the moment you use init scripts that are "named"
for a specific service, like nscd_initrc_exec_t. For a user to be able
to use this, he needs to be granted the *_admin() towards his user
domain, but also the system_r role to the SELinux user itself
(otherwise this won't work)).
Wkr,
Sven Vermeulen