From: dsugar@tresys.com (David Sugar) Date: Tue, 5 Dec 2017 17:55:33 +0000 Subject: [refpolicy] Resolve some denials when lightdm is starting up In-Reply-To: <20171205080522.GB19951@julius.enp8s0.d30> References: <20171205080522.GB19951@julius.enp8s0.d30> Message-ID: To: refpolicy@oss.tresys.com List-Id: refpolicy.oss.tresys.com > -----Original Message----- > From: refpolicy-bounces at oss.tresys.com [mailto:refpolicy- > bounces at oss.tresys.com] On Behalf Of Dominick Grift via refpolicy > Sent: Tuesday, December 05, 2017 3:05 AM > To: refpolicy at oss.tresys.com > Subject: Re: [refpolicy] Resolve some denials when lightdm is starting > up > > On Mon, Dec 04, 2017 at 09:37:06PM +0000, David Sugar via refpolicy > wrote: > > Fix a couple of denials I'm seeing during lightdm start up. > > > > type=USER_AVC msg=audit(1511920285.050:57): pid=1068 uid=81 > auid=4294967295 ses=4294967295 > subj=system_u:system_r:system_dbusd_t:s0- > s0:c0.c1023 msg='avc: denied { send_msg } for msgtype=method_call > interface=org.freedesktop.Accounts member=ListCachedUsers > dest=org.freedesktop.Accounts spid=1084 tpid=1080 > scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 > tcontext=system_u:system_r:initrc_t:s0 tclass=dbus > exe="/usr/bin/dbus- daemon" sauid=81 hostname=? addr=? terminal=?' > > type=USER_AVC msg=audit(1511920285.053:59): pid=1068 uid=81 > auid=4294967295 ses=4294967295 > subj=system_u:system_r:system_dbusd_t:s0- > s0:c0.c1023 msg='avc: denied { send_msg } for msgtype=method_return > dest=:1.4 spid=1080 tpid=1084 scontext=system_u:system_r:initrc_t:s0 > tcontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tclass=dbus > exe="/usr/bin/dbus-daemon" sauid=81 hostname=? addr=? terminal=?' > > What is that processes assoc. with initrc_t? accountsd? Probably > ideally shouldnt be assoc. with initrc_t in the first place? Dominick, good call on this one. Apparently I didn't notice exactly what is going on and your pointer has forced me look a bit deeper. In this case the communication over dbus is with the accounts-daemon service and it turns out I had the selinux module 'accountsd' turned off. Enabling this module appears to resolve this denial. I will re-submit this patch based on the feedback though I do have a question. The other denial I'm seeing here is for the reading sysctl_crypto_t (/proc/sys/crypto/fips_enabled). I'm seeing this in a few other places (accountsd_t, policykit_t). Should I submit patches allowing this to be read by these other processes? I don't think I'm seeing any problems with this failure and I don't think there is any harm in allowing this read. Just to note, I am on a machine with fips enabled. > > > > type=AVC msg=audit(1512047222.742:53): avc: denied { search } for > > pid=1174 comm="lightdm-gtk-gre" name="crypto" dev="proc" ino=6218 > > scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 > > tcontext=system_u:object_r:sysctl_crypto_t:s0 tclass=dir type=AVC > > msg=audit(1512047222.742:53): avc: denied { read } for pid=1174 > > comm="lightdm-gtk-gre" name="fips_enabled" dev="proc" ino=6219 > > scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 > > tcontext=system_u:object_r:sysctl_crypto_t:s0 tclass=file type=AVC > > msg=audit(1512047222.742:53): avc: denied { open } for pid=1174 > > comm="lightdm-gtk-gre" path="/proc/sys/crypto/fips_enabled" dev="proc" > > ino=6219 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 > > tcontext=system_u:object_r:sysctl_crypto_t:s0 tclass=file type=AVC > > msg=audit(1512047222.743:54): avc: denied { getattr } for pid=1174 > > comm="lightdm-gtk-gre" path="/proc/sys/crypto/fips_enabled" dev="proc" > > ino=6219 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 > > tcontext=system_u:object_r:sysctl_crypto_t:s0 tclass=file > > > > Signed-off-by: Dave Sugar > > --- > > policy/modules/services/xserver.te | 2 ++ > > 1 file changed, 2 insertions(+) > > > > diff --git a/policy/modules/services/xserver.te > > b/policy/modules/services/xserver.te > > index 3cea9f64..0b59b83b 100644 > > --- a/policy/modules/services/xserver.te > > +++ b/policy/modules/services/xserver.te > > @@ -391,6 +391,7 @@ manage_files_pattern(xdm_t, xserver_log_t, > > xserver_log_t) manage_fifo_files_pattern(xdm_t, xserver_log_t, > > xserver_log_t) logging_log_filetrans(xdm_t, xserver_log_t, file) > > > > +kernel_read_crypto_sysctls(xdm_t) > > kernel_read_system_state(xdm_t) > > kernel_read_kernel_sysctls(xdm_t) > > kernel_read_net_sysctls(xdm_t) > > @@ -475,6 +476,7 @@ auth_manage_pam_console_data(xdm_t) > > auth_rw_faillog(xdm_t) > > auth_write_login_records(xdm_t) > > > > +init_dbus_chat_script(xdm_t) > > # Run telinit->init to shutdown. > > init_telinit(xdm_t) > > > > -- > > 2.13.6 > > _______________________________________________ > > refpolicy mailing list > > refpolicy at oss.tresys.com > > http://oss.tresys.com/mailman/listinfo/refpolicy > > -- > Key fingerprint = 5F4D 3CDB D3F8 3652 FBD8 02D5 3B6C 5F1D 2C7B 6B02 > https://sks-keyservers.net/pks/lookup?op=get&search=0x3B6C5F1D2C7B6B02 > Dominick Grift