Fix a couple of denials I'm seeing during lightdm start up.
type=USER_AVC msg=audit(1511920285.050:57): pid=1068 uid=81 auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc: denied { send_msg } for msgtype=method_call interface=org.freedesktop.Accounts member=ListCachedUsers dest=org.freedesktop.Accounts spid=1084 tpid=1080 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:system_r:initrc_t:s0 tclass=dbus exe="/usr/bin/dbus-daemon" sauid=81 hostname=? addr=? terminal=?'
type=USER_AVC msg=audit(1511920285.053:59): pid=1068 uid=81 auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc: denied { send_msg } for msgtype=method_return dest=:1.4 spid=1080 tpid=1084 scontext=system_u:system_r:initrc_t:s0 tcontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tclass=dbus exe="/usr/bin/dbus-daemon" sauid=81 hostname=? addr=? terminal=?'
type=AVC msg=audit(1512047222.742:53): avc: denied { search } for pid=1174 comm="lightdm-gtk-gre" name="crypto" dev="proc" ino=6218 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:sysctl_crypto_t:s0 tclass=dir
type=AVC msg=audit(1512047222.742:53): avc: denied { read } for pid=1174 comm="lightdm-gtk-gre" name="fips_enabled" dev="proc" ino=6219 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:sysctl_crypto_t:s0 tclass=file
type=AVC msg=audit(1512047222.742:53): avc: denied { open } for pid=1174 comm="lightdm-gtk-gre" path="/proc/sys/crypto/fips_enabled" dev="proc" ino=6219 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:sysctl_crypto_t:s0 tclass=file
type=AVC msg=audit(1512047222.743:54): avc: denied { getattr } for pid=1174 comm="lightdm-gtk-gre" path="/proc/sys/crypto/fips_enabled" dev="proc" ino=6219 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:sysctl_crypto_t:s0 tclass=file
Signed-off-by: Dave Sugar <[email protected]>
---
policy/modules/services/xserver.te | 2 ++
1 file changed, 2 insertions(+)
diff --git a/policy/modules/services/xserver.te b/policy/modules/services/xserver.te
index 3cea9f64..0b59b83b 100644
--- a/policy/modules/services/xserver.te
+++ b/policy/modules/services/xserver.te
@@ -391,6 +391,7 @@ manage_files_pattern(xdm_t, xserver_log_t, xserver_log_t)
manage_fifo_files_pattern(xdm_t, xserver_log_t, xserver_log_t)
logging_log_filetrans(xdm_t, xserver_log_t, file)
+kernel_read_crypto_sysctls(xdm_t)
kernel_read_system_state(xdm_t)
kernel_read_kernel_sysctls(xdm_t)
kernel_read_net_sysctls(xdm_t)
@@ -475,6 +476,7 @@ auth_manage_pam_console_data(xdm_t)
auth_rw_faillog(xdm_t)
auth_write_login_records(xdm_t)
+init_dbus_chat_script(xdm_t)
# Run telinit->init to shutdown.
init_telinit(xdm_t)
--
2.13.6
On Mon, Dec 04, 2017 at 09:37:06PM +0000, David Sugar via refpolicy wrote:
> Fix a couple of denials I'm seeing during lightdm start up.
>
> type=USER_AVC msg=audit(1511920285.050:57): pid=1068 uid=81 auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc: denied { send_msg } for msgtype=method_call interface=org.freedesktop.Accounts member=ListCachedUsers dest=org.freedesktop.Accounts spid=1084 tpid=1080 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:system_r:initrc_t:s0 tclass=dbus exe="/usr/bin/dbus-daemon" sauid=81 hostname=? addr=? terminal=?'
> type=USER_AVC msg=audit(1511920285.053:59): pid=1068 uid=81 auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc: denied { send_msg } for msgtype=method_return dest=:1.4 spid=1080 tpid=1084 scontext=system_u:system_r:initrc_t:s0 tcontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tclass=dbus exe="/usr/bin/dbus-daemon" sauid=81 hostname=? addr=? terminal=?'
What is that processes assoc. with initrc_t? accountsd? Probably ideally shouldnt be assoc. with initrc_t in the first place?
>
> type=AVC msg=audit(1512047222.742:53): avc: denied { search } for pid=1174 comm="lightdm-gtk-gre" name="crypto" dev="proc" ino=6218 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:sysctl_crypto_t:s0 tclass=dir
> type=AVC msg=audit(1512047222.742:53): avc: denied { read } for pid=1174 comm="lightdm-gtk-gre" name="fips_enabled" dev="proc" ino=6219 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:sysctl_crypto_t:s0 tclass=file
> type=AVC msg=audit(1512047222.742:53): avc: denied { open } for pid=1174 comm="lightdm-gtk-gre" path="/proc/sys/crypto/fips_enabled" dev="proc" ino=6219 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:sysctl_crypto_t:s0 tclass=file
> type=AVC msg=audit(1512047222.743:54): avc: denied { getattr } for pid=1174 comm="lightdm-gtk-gre" path="/proc/sys/crypto/fips_enabled" dev="proc" ino=6219 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:sysctl_crypto_t:s0 tclass=file
>
> Signed-off-by: Dave Sugar <[email protected]>
> ---
> policy/modules/services/xserver.te | 2 ++
> 1 file changed, 2 insertions(+)
>
> diff --git a/policy/modules/services/xserver.te b/policy/modules/services/xserver.te
> index 3cea9f64..0b59b83b 100644
> --- a/policy/modules/services/xserver.te
> +++ b/policy/modules/services/xserver.te
> @@ -391,6 +391,7 @@ manage_files_pattern(xdm_t, xserver_log_t, xserver_log_t)
> manage_fifo_files_pattern(xdm_t, xserver_log_t, xserver_log_t)
> logging_log_filetrans(xdm_t, xserver_log_t, file)
>
> +kernel_read_crypto_sysctls(xdm_t)
> kernel_read_system_state(xdm_t)
> kernel_read_kernel_sysctls(xdm_t)
> kernel_read_net_sysctls(xdm_t)
> @@ -475,6 +476,7 @@ auth_manage_pam_console_data(xdm_t)
> auth_rw_faillog(xdm_t)
> auth_write_login_records(xdm_t)
>
> +init_dbus_chat_script(xdm_t)
> # Run telinit->init to shutdown.
> init_telinit(xdm_t)
>
> --
> 2.13.6
> _______________________________________________
> refpolicy mailing list
> refpolicy at oss.tresys.com
> http://oss.tresys.com/mailman/listinfo/refpolicy
--
Key fingerprint = 5F4D 3CDB D3F8 3652 FBD8 02D5 3B6C 5F1D 2C7B 6B02
https://sks-keyservers.net/pks/lookup?op=get&search=0x3B6C5F1D2C7B6B02
Dominick Grift
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 659 bytes
Desc: not available
Url : http://oss.tresys.com/pipermail/refpolicy/attachments/20171205/e56ba93b/attachment.bin
> -----Original Message-----
> From: refpolicy-bounces at oss.tresys.com [mailto:refpolicy-
> bounces at oss.tresys.com] On Behalf Of Dominick Grift via refpolicy
> Sent: Tuesday, December 05, 2017 3:05 AM
> To: refpolicy at oss.tresys.com
> Subject: Re: [refpolicy] Resolve some denials when lightdm is starting
> up
>
> On Mon, Dec 04, 2017 at 09:37:06PM +0000, David Sugar via refpolicy
> wrote:
> > Fix a couple of denials I'm seeing during lightdm start up.
> >
> > type=USER_AVC msg=audit(1511920285.050:57): pid=1068 uid=81
> auid=4294967295 ses=4294967295
> subj=system_u:system_r:system_dbusd_t:s0-
> s0:c0.c1023 msg='avc: denied { send_msg } for msgtype=method_call
> interface=org.freedesktop.Accounts member=ListCachedUsers
> dest=org.freedesktop.Accounts spid=1084 tpid=1080
> scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023
> tcontext=system_u:system_r:initrc_t:s0 tclass=dbus
> exe="/usr/bin/dbus- daemon" sauid=81 hostname=? addr=? terminal=?'
> > type=USER_AVC msg=audit(1511920285.053:59): pid=1068 uid=81
> auid=4294967295 ses=4294967295
> subj=system_u:system_r:system_dbusd_t:s0-
> s0:c0.c1023 msg='avc: denied { send_msg } for msgtype=method_return
> dest=:1.4 spid=1080 tpid=1084 scontext=system_u:system_r:initrc_t:s0
> tcontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tclass=dbus
> exe="/usr/bin/dbus-daemon" sauid=81 hostname=? addr=? terminal=?'
>
> What is that processes assoc. with initrc_t? accountsd? Probably
> ideally shouldnt be assoc. with initrc_t in the first place?
Dominick, good call on this one. Apparently I didn't notice exactly what is going on and your pointer has forced me look a bit deeper. In this case the communication over dbus is with the accounts-daemon service and it turns out I had the selinux module 'accountsd' turned off. Enabling this module appears to resolve this denial.
I will re-submit this patch based on the feedback though I do have a question.
The other denial I'm seeing here is for the reading sysctl_crypto_t (/proc/sys/crypto/fips_enabled). I'm seeing this in a few other places (accountsd_t, policykit_t). Should I submit patches allowing this to be read by these other processes? I don't think I'm seeing any problems with this failure and I don't think there is any harm in allowing this read. Just to note, I am on a machine with fips enabled.
> >
> > type=AVC msg=audit(1512047222.742:53): avc: denied { search } for
> > pid=1174 comm="lightdm-gtk-gre" name="crypto" dev="proc" ino=6218
> > scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023
> > tcontext=system_u:object_r:sysctl_crypto_t:s0 tclass=dir type=AVC
> > msg=audit(1512047222.742:53): avc: denied { read } for pid=1174
> > comm="lightdm-gtk-gre" name="fips_enabled" dev="proc" ino=6219
> > scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023
> > tcontext=system_u:object_r:sysctl_crypto_t:s0 tclass=file type=AVC
> > msg=audit(1512047222.742:53): avc: denied { open } for pid=1174
> > comm="lightdm-gtk-gre" path="/proc/sys/crypto/fips_enabled" dev="proc"
> > ino=6219 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023
> > tcontext=system_u:object_r:sysctl_crypto_t:s0 tclass=file type=AVC
> > msg=audit(1512047222.743:54): avc: denied { getattr } for pid=1174
> > comm="lightdm-gtk-gre" path="/proc/sys/crypto/fips_enabled" dev="proc"
> > ino=6219 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023
> > tcontext=system_u:object_r:sysctl_crypto_t:s0 tclass=file
> >
> > Signed-off-by: Dave Sugar <[email protected]>
> > ---
> > policy/modules/services/xserver.te | 2 ++
> > 1 file changed, 2 insertions(+)
> >
> > diff --git a/policy/modules/services/xserver.te
> > b/policy/modules/services/xserver.te
> > index 3cea9f64..0b59b83b 100644
> > --- a/policy/modules/services/xserver.te
> > +++ b/policy/modules/services/xserver.te
> > @@ -391,6 +391,7 @@ manage_files_pattern(xdm_t, xserver_log_t,
> > xserver_log_t) manage_fifo_files_pattern(xdm_t, xserver_log_t,
> > xserver_log_t) logging_log_filetrans(xdm_t, xserver_log_t, file)
> >
> > +kernel_read_crypto_sysctls(xdm_t)
> > kernel_read_system_state(xdm_t)
> > kernel_read_kernel_sysctls(xdm_t)
> > kernel_read_net_sysctls(xdm_t)
> > @@ -475,6 +476,7 @@ auth_manage_pam_console_data(xdm_t)
> > auth_rw_faillog(xdm_t)
> > auth_write_login_records(xdm_t)
> >
> > +init_dbus_chat_script(xdm_t)
> > # Run telinit->init to shutdown.
> > init_telinit(xdm_t)
> >
> > --
> > 2.13.6
> > _______________________________________________
> > refpolicy mailing list
> > refpolicy at oss.tresys.com
> > http://oss.tresys.com/mailman/listinfo/refpolicy
>
> --
> Key fingerprint = 5F4D 3CDB D3F8 3652 FBD8 02D5 3B6C 5F1D 2C7B 6B02
> https://sks-keyservers.net/pks/lookup?op=get&search=0x3B6C5F1D2C7B6B02
> Dominick Grift
On Tue, Dec 05, 2017 at 05:55:33PM +0000, David Sugar via refpolicy wrote:
>
>
> > -----Original Message-----
> > From: refpolicy-bounces at oss.tresys.com [mailto:refpolicy-
> > bounces at oss.tresys.com] On Behalf Of Dominick Grift via refpolicy
> > Sent: Tuesday, December 05, 2017 3:05 AM
> > To: refpolicy at oss.tresys.com
> > Subject: Re: [refpolicy] Resolve some denials when lightdm is starting
> > up
> >
> > On Mon, Dec 04, 2017 at 09:37:06PM +0000, David Sugar via refpolicy
> > wrote:
> > > Fix a couple of denials I'm seeing during lightdm start up.
> > >
> > > type=USER_AVC msg=audit(1511920285.050:57): pid=1068 uid=81
> > auid=4294967295 ses=4294967295
> > subj=system_u:system_r:system_dbusd_t:s0-
> > s0:c0.c1023 msg='avc: denied { send_msg } for msgtype=method_call
> > interface=org.freedesktop.Accounts member=ListCachedUsers
> > dest=org.freedesktop.Accounts spid=1084 tpid=1080
> > scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023
> > tcontext=system_u:system_r:initrc_t:s0 tclass=dbus
> > exe="/usr/bin/dbus- daemon" sauid=81 hostname=? addr=? terminal=?'
> > > type=USER_AVC msg=audit(1511920285.053:59): pid=1068 uid=81
> > auid=4294967295 ses=4294967295
> > subj=system_u:system_r:system_dbusd_t:s0-
> > s0:c0.c1023 msg='avc: denied { send_msg } for msgtype=method_return
> > dest=:1.4 spid=1080 tpid=1084 scontext=system_u:system_r:initrc_t:s0
> > tcontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tclass=dbus
> > exe="/usr/bin/dbus-daemon" sauid=81 hostname=? addr=? terminal=?'
> >
> > What is that processes assoc. with initrc_t? accountsd? Probably
> > ideally shouldnt be assoc. with initrc_t in the first place?
>
> Dominick, good call on this one. Apparently I didn't notice exactly what is going on and your pointer has forced me look a bit deeper. In this case the communication over dbus is with the accounts-daemon service and it turns out I had the selinux module 'accountsd' turned off. Enabling this module appears to resolve this denial.
>
>
> I will re-submit this patch based on the feedback though I do have a question.
>
> The other denial I'm seeing here is for the reading sysctl_crypto_t (/proc/sys/crypto/fips_enabled). I'm seeing this in a few other places (accountsd_t, policykit_t). Should I submit patches allowing this to be read by these other processes? I don't think I'm seeing any problems with this failure and I don't think there is any harm in allowing this read. Just to note, I am on a machine with fips enabled.
Sure
>
> > >
> > > type=AVC msg=audit(1512047222.742:53): avc: denied { search } for
> > > pid=1174 comm="lightdm-gtk-gre" name="crypto" dev="proc" ino=6218
> > > scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023
> > > tcontext=system_u:object_r:sysctl_crypto_t:s0 tclass=dir type=AVC
> > > msg=audit(1512047222.742:53): avc: denied { read } for pid=1174
> > > comm="lightdm-gtk-gre" name="fips_enabled" dev="proc" ino=6219
> > > scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023
> > > tcontext=system_u:object_r:sysctl_crypto_t:s0 tclass=file type=AVC
> > > msg=audit(1512047222.742:53): avc: denied { open } for pid=1174
> > > comm="lightdm-gtk-gre" path="/proc/sys/crypto/fips_enabled" dev="proc"
> > > ino=6219 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023
> > > tcontext=system_u:object_r:sysctl_crypto_t:s0 tclass=file type=AVC
> > > msg=audit(1512047222.743:54): avc: denied { getattr } for pid=1174
> > > comm="lightdm-gtk-gre" path="/proc/sys/crypto/fips_enabled" dev="proc"
> > > ino=6219 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023
> > > tcontext=system_u:object_r:sysctl_crypto_t:s0 tclass=file
> > >
> > > Signed-off-by: Dave Sugar <[email protected]>
> > > ---
> > > policy/modules/services/xserver.te | 2 ++
> > > 1 file changed, 2 insertions(+)
> > >
> > > diff --git a/policy/modules/services/xserver.te
> > > b/policy/modules/services/xserver.te
> > > index 3cea9f64..0b59b83b 100644
> > > --- a/policy/modules/services/xserver.te
> > > +++ b/policy/modules/services/xserver.te
> > > @@ -391,6 +391,7 @@ manage_files_pattern(xdm_t, xserver_log_t,
> > > xserver_log_t) manage_fifo_files_pattern(xdm_t, xserver_log_t,
> > > xserver_log_t) logging_log_filetrans(xdm_t, xserver_log_t, file)
> > >
> > > +kernel_read_crypto_sysctls(xdm_t)
> > > kernel_read_system_state(xdm_t)
> > > kernel_read_kernel_sysctls(xdm_t)
> > > kernel_read_net_sysctls(xdm_t)
> > > @@ -475,6 +476,7 @@ auth_manage_pam_console_data(xdm_t)
> > > auth_rw_faillog(xdm_t)
> > > auth_write_login_records(xdm_t)
> > >
> > > +init_dbus_chat_script(xdm_t)
> > > # Run telinit->init to shutdown.
> > > init_telinit(xdm_t)
> > >
> > > --
> > > 2.13.6
> > > _______________________________________________
> > > refpolicy mailing list
> > > refpolicy at oss.tresys.com
> > > http://oss.tresys.com/mailman/listinfo/refpolicy
> >
> > --
> > Key fingerprint = 5F4D 3CDB D3F8 3652 FBD8 02D5 3B6C 5F1D 2C7B 6B02
> > https://sks-keyservers.net/pks/lookup?op=get&search=0x3B6C5F1D2C7B6B02
> > Dominick Grift
> _______________________________________________
> refpolicy mailing list
> refpolicy at oss.tresys.com
> http://oss.tresys.com/mailman/listinfo/refpolicy
--
Key fingerprint = 5F4D 3CDB D3F8 3652 FBD8 02D5 3B6C 5F1D 2C7B 6B02
https://sks-keyservers.net/pks/lookup?op=get&search=0x3B6C5F1D2C7B6B02
Dominick Grift
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 659 bytes
Desc: not available
Url : http://oss.tresys.com/pipermail/refpolicy/attachments/20171205/9cffd135/attachment.bin