From: dac.override@gmail.com (Dominick Grift) Date: Tue, 5 Dec 2017 09:05:22 +0100 Subject: [refpolicy] Resolve some denials when lightdm is starting up In-Reply-To: References: Message-ID: <20171205080522.GB19951@julius.enp8s0.d30> To: refpolicy@oss.tresys.com List-Id: refpolicy.oss.tresys.com On Mon, Dec 04, 2017 at 09:37:06PM +0000, David Sugar via refpolicy wrote: > Fix a couple of denials I'm seeing during lightdm start up. > > type=USER_AVC msg=audit(1511920285.050:57): pid=1068 uid=81 auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc: denied { send_msg } for msgtype=method_call interface=org.freedesktop.Accounts member=ListCachedUsers dest=org.freedesktop.Accounts spid=1084 tpid=1080 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:system_r:initrc_t:s0 tclass=dbus exe="/usr/bin/dbus-daemon" sauid=81 hostname=? addr=? terminal=?' > type=USER_AVC msg=audit(1511920285.053:59): pid=1068 uid=81 auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc: denied { send_msg } for msgtype=method_return dest=:1.4 spid=1080 tpid=1084 scontext=system_u:system_r:initrc_t:s0 tcontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tclass=dbus exe="/usr/bin/dbus-daemon" sauid=81 hostname=? addr=? terminal=?' What is that processes assoc. with initrc_t? accountsd? Probably ideally shouldnt be assoc. with initrc_t in the first place? > > type=AVC msg=audit(1512047222.742:53): avc: denied { search } for pid=1174 comm="lightdm-gtk-gre" name="crypto" dev="proc" ino=6218 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:sysctl_crypto_t:s0 tclass=dir > type=AVC msg=audit(1512047222.742:53): avc: denied { read } for pid=1174 comm="lightdm-gtk-gre" name="fips_enabled" dev="proc" ino=6219 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:sysctl_crypto_t:s0 tclass=file > type=AVC msg=audit(1512047222.742:53): avc: denied { open } for pid=1174 comm="lightdm-gtk-gre" path="/proc/sys/crypto/fips_enabled" dev="proc" ino=6219 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:sysctl_crypto_t:s0 tclass=file > type=AVC msg=audit(1512047222.743:54): avc: denied { getattr } for pid=1174 comm="lightdm-gtk-gre" path="/proc/sys/crypto/fips_enabled" dev="proc" ino=6219 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:sysctl_crypto_t:s0 tclass=file > > Signed-off-by: Dave Sugar > --- > policy/modules/services/xserver.te | 2 ++ > 1 file changed, 2 insertions(+) > > diff --git a/policy/modules/services/xserver.te b/policy/modules/services/xserver.te > index 3cea9f64..0b59b83b 100644 > --- a/policy/modules/services/xserver.te > +++ b/policy/modules/services/xserver.te > @@ -391,6 +391,7 @@ manage_files_pattern(xdm_t, xserver_log_t, xserver_log_t) > manage_fifo_files_pattern(xdm_t, xserver_log_t, xserver_log_t) > logging_log_filetrans(xdm_t, xserver_log_t, file) > > +kernel_read_crypto_sysctls(xdm_t) > kernel_read_system_state(xdm_t) > kernel_read_kernel_sysctls(xdm_t) > kernel_read_net_sysctls(xdm_t) > @@ -475,6 +476,7 @@ auth_manage_pam_console_data(xdm_t) > auth_rw_faillog(xdm_t) > auth_write_login_records(xdm_t) > > +init_dbus_chat_script(xdm_t) > # Run telinit->init to shutdown. > init_telinit(xdm_t) > > -- > 2.13.6 > _______________________________________________ > refpolicy mailing list > refpolicy at oss.tresys.com > http://oss.tresys.com/mailman/listinfo/refpolicy -- Key fingerprint = 5F4D 3CDB D3F8 3652 FBD8 02D5 3B6C 5F1D 2C7B 6B02 https://sks-keyservers.net/pks/lookup?op=get&search=0x3B6C5F1D2C7B6B02 Dominick Grift -------------- next part -------------- A non-text attachment was scrubbed... Name: not available Type: application/pgp-signature Size: 659 bytes Desc: not available Url : http://oss.tresys.com/pipermail/refpolicy/attachments/20171205/e56ba93b/attachment.bin