From: dsugar@tresys.com (David Sugar) Date: Mon, 4 Dec 2017 21:37:06 +0000 Subject: [refpolicy] Resolve some denials when lightdm is starting up Message-ID: To: refpolicy@oss.tresys.com List-Id: refpolicy.oss.tresys.com Fix a couple of denials I'm seeing during lightdm start up. type=USER_AVC msg=audit(1511920285.050:57): pid=1068 uid=81 auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc: denied { send_msg } for msgtype=method_call interface=org.freedesktop.Accounts member=ListCachedUsers dest=org.freedesktop.Accounts spid=1084 tpid=1080 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:system_r:initrc_t:s0 tclass=dbus exe="/usr/bin/dbus-daemon" sauid=81 hostname=? addr=? terminal=?' type=USER_AVC msg=audit(1511920285.053:59): pid=1068 uid=81 auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc: denied { send_msg } for msgtype=method_return dest=:1.4 spid=1080 tpid=1084 scontext=system_u:system_r:initrc_t:s0 tcontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tclass=dbus exe="/usr/bin/dbus-daemon" sauid=81 hostname=? addr=? terminal=?' type=AVC msg=audit(1512047222.742:53): avc: denied { search } for pid=1174 comm="lightdm-gtk-gre" name="crypto" dev="proc" ino=6218 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:sysctl_crypto_t:s0 tclass=dir type=AVC msg=audit(1512047222.742:53): avc: denied { read } for pid=1174 comm="lightdm-gtk-gre" name="fips_enabled" dev="proc" ino=6219 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:sysctl_crypto_t:s0 tclass=file type=AVC msg=audit(1512047222.742:53): avc: denied { open } for pid=1174 comm="lightdm-gtk-gre" path="/proc/sys/crypto/fips_enabled" dev="proc" ino=6219 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:sysctl_crypto_t:s0 tclass=file type=AVC msg=audit(1512047222.743:54): avc: denied { getattr } for pid=1174 comm="lightdm-gtk-gre" path="/proc/sys/crypto/fips_enabled" dev="proc" ino=6219 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:sysctl_crypto_t:s0 tclass=file Signed-off-by: Dave Sugar --- policy/modules/services/xserver.te | 2 ++ 1 file changed, 2 insertions(+) diff --git a/policy/modules/services/xserver.te b/policy/modules/services/xserver.te index 3cea9f64..0b59b83b 100644 --- a/policy/modules/services/xserver.te +++ b/policy/modules/services/xserver.te @@ -391,6 +391,7 @@ manage_files_pattern(xdm_t, xserver_log_t, xserver_log_t) manage_fifo_files_pattern(xdm_t, xserver_log_t, xserver_log_t) logging_log_filetrans(xdm_t, xserver_log_t, file) +kernel_read_crypto_sysctls(xdm_t) kernel_read_system_state(xdm_t) kernel_read_kernel_sysctls(xdm_t) kernel_read_net_sysctls(xdm_t) @@ -475,6 +476,7 @@ auth_manage_pam_console_data(xdm_t) auth_rw_faillog(xdm_t) auth_write_login_records(xdm_t) +init_dbus_chat_script(xdm_t) # Run telinit->init to shutdown. init_telinit(xdm_t) -- 2.13.6