From: guido@trentalancia.com (Guido Trentalancia)
Date: Thu, 21 Jun 2012 19:38:04 +0200
Subject: [refpolicy] [PATCH]: missing file context for
 system-tools-backends (gnome)
In-Reply-To: <1340268079.9690.35.camel@x220.mydomain.internal>
References: <1340226181.23287.2.camel@vortex>
	<1340268079.9690.35.camel@x220.mydomain.internal>
Message-ID: <1340300284.2992.9.camel@vortex>
To: refpolicy@oss.tresys.com
List-Id: refpolicy.oss.tresys.com

Hello Dominick.

On Thu, 2012-06-21 at 10:41 +0200, Dominick Grift wrote:
> On Wed, 2012-06-20 at 23:03 +0200, Guido Trentalancia wrote:
> > I think the following file context is still missing in current reference
> > policy for an optional Gnome package (that shouldn't need its own
> > policy):
> > 
> > Add the generic binary executable label to the script from System Tools
> > Backends.
> > 
> > Signed-off-by: Guido Trentalancia <guido@trentalancia.com>
> > ---
> >  policy/modules/contrib/gnome.fc |    2 ++
> >  1 file changed, 2 insertions(+)
> > 
> > --- refpolicy-04062012/policy/modules/contrib/gnome.fc	2011-09-09 18:29:23.571610910 +0200
> > +++ refpolicy-04062012-system-tools-backends/policy/modules/contrib/gnome.fc	2012-06-20 22:41:01.448465819 +0200
> > @@ -7,3 +7,5 @@ HOME_DIR/\.gnome2(/.*)?		gen_context(sys
> >  /tmp/gconfd-USER/.*	--	gen_context(system_u:object_r:gconf_tmp_t,s0)
> >  
> >  /usr/libexec/gconfd-2 	--	gen_context(system_u:object_r:gconfd_exec_t,s0)
> > +
> > +/usr/share/system-tools-backends-2.0/scripts/SystemToolsBackends.pl	--	gen_context(system_u:object_r:bin_t,s0)
> > 
> 
> This specification only applies to "-2.0". Can you make it more generic?
> 
> Maybe something like:
> 
> /usr/share/system-tools-backends.*/scripts/SystemToolsBackends.pl
> 
> will work?

Yes, good point.

Also, it would better fit into the dbus module rather than the gnome
one.

And I think when it is actually getting used, for example by
gnome-system-tools, it needs at least some policy modifications to the
dbus module (e.g. corecmd_exec_shell+corecmd_exec_bin), so it's a bit
more complicated than just that.

Perhaps, this is a better starting point ?

--- refpolicy-04062012/policy/modules/contrib/dbus.fc	2011-09-09 18:29:23.566610878 +0200
+++ refpolicy-04062012-system-tools-backends/policy/modules/contrib/dbus.fc	2012-06-21 19:25:26.577167925 +0200
@@ -8,10 +8,14 @@
 /usr/bin/dbus-daemon(-1)? --	gen_context(system_u:object_r:dbusd_exec_t,s0)
 /usr/libexec/dbus-daemon-launch-helper -- gen_context(system_u:object_r:dbusd_exec_t,s0)
 
+/usr/share/system-tools-backends.*/scripts/SystemToolsBackends.pl	--	gen_context(system_u:object_r:bin_t,s0)
+
 /var/lib/dbus(/.*)?		gen_context(system_u:object_r:system_dbusd_var_lib_t,s0)
 
 /var/run/dbus(/.*)?		gen_context(system_u:object_r:system_dbusd_var_run_t,s0)
 
+/var/cache/system-tools-backends(/.*)?	gen_context(system_u:object_r:system_dbusd_var_run_t,s0)
+
 ifdef(`distro_redhat',`
 /var/named/chroot/var/run/dbus(/.*)?	gen_context(system_u:object_r:system_dbusd_var_run_t,s0)
 ')
--- refpolicy-04062012/policy/modules/contrib/dbus.te	2011-09-09 18:29:23.566610878 +0200
+++ refpolicy-04062012-system-tools-backends/policy/modules/contrib/dbus.te	2012-06-21 19:22:02.830368908 +0200
@@ -9,6 +9,13 @@ gen_require(`
 # Delcarations
 #
 
+## <desc>
+## <p>
+## Enable support for system-tools-backends.
+## </p>
+## </desc>
+gen_tunable(allow_system_tools_backends, false)
+
 attribute dbusd_unconfined;
 attribute session_bus_type;
 
@@ -112,6 +119,12 @@ corecmd_list_bin(system_dbusd_t)
 corecmd_read_bin_pipes(system_dbusd_t)
 corecmd_read_bin_sockets(system_dbusd_t)
 
+# needed for system-tools-backends
+tunable_policy(`allow_system_tools_backends',`
+	corecmd_exec_bin(system_dbusd_t)
+	corecmd_exec_shell(system_dbusd_t)
+')
+
 domain_use_interactive_fds(system_dbusd_t)
 domain_read_all_domains_state(system_dbusd_t)
 

Regards,

Guido