From: dac.override@gmail.com (Dominick Grift) Date: Tue, 5 Dec 2017 20:06:15 +0100 Subject: [refpolicy] Resolve some denials when lightdm is starting up In-Reply-To: References: <20171205080522.GB19951@julius.enp8s0.d30> Message-ID: <20171205190615.GA28741@julius.enp8s0.d30> To: refpolicy@oss.tresys.com List-Id: refpolicy.oss.tresys.com On Tue, Dec 05, 2017 at 05:55:33PM +0000, David Sugar via refpolicy wrote: > > > > -----Original Message----- > > From: refpolicy-bounces at oss.tresys.com [mailto:refpolicy- > > bounces at oss.tresys.com] On Behalf Of Dominick Grift via refpolicy > > Sent: Tuesday, December 05, 2017 3:05 AM > > To: refpolicy at oss.tresys.com > > Subject: Re: [refpolicy] Resolve some denials when lightdm is starting > > up > > > > On Mon, Dec 04, 2017 at 09:37:06PM +0000, David Sugar via refpolicy > > wrote: > > > Fix a couple of denials I'm seeing during lightdm start up. > > > > > > type=USER_AVC msg=audit(1511920285.050:57): pid=1068 uid=81 > > auid=4294967295 ses=4294967295 > > subj=system_u:system_r:system_dbusd_t:s0- > > s0:c0.c1023 msg='avc: denied { send_msg } for msgtype=method_call > > interface=org.freedesktop.Accounts member=ListCachedUsers > > dest=org.freedesktop.Accounts spid=1084 tpid=1080 > > scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 > > tcontext=system_u:system_r:initrc_t:s0 tclass=dbus > > exe="/usr/bin/dbus- daemon" sauid=81 hostname=? addr=? terminal=?' > > > type=USER_AVC msg=audit(1511920285.053:59): pid=1068 uid=81 > > auid=4294967295 ses=4294967295 > > subj=system_u:system_r:system_dbusd_t:s0- > > s0:c0.c1023 msg='avc: denied { send_msg } for msgtype=method_return > > dest=:1.4 spid=1080 tpid=1084 scontext=system_u:system_r:initrc_t:s0 > > tcontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tclass=dbus > > exe="/usr/bin/dbus-daemon" sauid=81 hostname=? addr=? terminal=?' > > > > What is that processes assoc. with initrc_t? accountsd? Probably > > ideally shouldnt be assoc. with initrc_t in the first place? > > Dominick, good call on this one. Apparently I didn't notice exactly what is going on and your pointer has forced me look a bit deeper. In this case the communication over dbus is with the accounts-daemon service and it turns out I had the selinux module 'accountsd' turned off. Enabling this module appears to resolve this denial. > > > I will re-submit this patch based on the feedback though I do have a question. > > The other denial I'm seeing here is for the reading sysctl_crypto_t (/proc/sys/crypto/fips_enabled). I'm seeing this in a few other places (accountsd_t, policykit_t). Should I submit patches allowing this to be read by these other processes? I don't think I'm seeing any problems with this failure and I don't think there is any harm in allowing this read. Just to note, I am on a machine with fips enabled. Sure > > > > > > > type=AVC msg=audit(1512047222.742:53): avc: denied { search } for > > > pid=1174 comm="lightdm-gtk-gre" name="crypto" dev="proc" ino=6218 > > > scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 > > > tcontext=system_u:object_r:sysctl_crypto_t:s0 tclass=dir type=AVC > > > msg=audit(1512047222.742:53): avc: denied { read } for pid=1174 > > > comm="lightdm-gtk-gre" name="fips_enabled" dev="proc" ino=6219 > > > scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 > > > tcontext=system_u:object_r:sysctl_crypto_t:s0 tclass=file type=AVC > > > msg=audit(1512047222.742:53): avc: denied { open } for pid=1174 > > > comm="lightdm-gtk-gre" path="/proc/sys/crypto/fips_enabled" dev="proc" > > > ino=6219 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 > > > tcontext=system_u:object_r:sysctl_crypto_t:s0 tclass=file type=AVC > > > msg=audit(1512047222.743:54): avc: denied { getattr } for pid=1174 > > > comm="lightdm-gtk-gre" path="/proc/sys/crypto/fips_enabled" dev="proc" > > > ino=6219 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 > > > tcontext=system_u:object_r:sysctl_crypto_t:s0 tclass=file > > > > > > Signed-off-by: Dave Sugar > > > --- > > > policy/modules/services/xserver.te | 2 ++ > > > 1 file changed, 2 insertions(+) > > > > > > diff --git a/policy/modules/services/xserver.te > > > b/policy/modules/services/xserver.te > > > index 3cea9f64..0b59b83b 100644 > > > --- a/policy/modules/services/xserver.te > > > +++ b/policy/modules/services/xserver.te > > > @@ -391,6 +391,7 @@ manage_files_pattern(xdm_t, xserver_log_t, > > > xserver_log_t) manage_fifo_files_pattern(xdm_t, xserver_log_t, > > > xserver_log_t) logging_log_filetrans(xdm_t, xserver_log_t, file) > > > > > > +kernel_read_crypto_sysctls(xdm_t) > > > kernel_read_system_state(xdm_t) > > > kernel_read_kernel_sysctls(xdm_t) > > > kernel_read_net_sysctls(xdm_t) > > > @@ -475,6 +476,7 @@ auth_manage_pam_console_data(xdm_t) > > > auth_rw_faillog(xdm_t) > > > auth_write_login_records(xdm_t) > > > > > > +init_dbus_chat_script(xdm_t) > > > # Run telinit->init to shutdown. > > > init_telinit(xdm_t) > > > > > > -- > > > 2.13.6 > > > _______________________________________________ > > > refpolicy mailing list > > > refpolicy at oss.tresys.com > > > http://oss.tresys.com/mailman/listinfo/refpolicy > > > > -- > > Key fingerprint = 5F4D 3CDB D3F8 3652 FBD8 02D5 3B6C 5F1D 2C7B 6B02 > > https://sks-keyservers.net/pks/lookup?op=get&search=0x3B6C5F1D2C7B6B02 > > Dominick Grift > _______________________________________________ > refpolicy mailing list > refpolicy at oss.tresys.com > http://oss.tresys.com/mailman/listinfo/refpolicy -- Key fingerprint = 5F4D 3CDB D3F8 3652 FBD8 02D5 3B6C 5F1D 2C7B 6B02 https://sks-keyservers.net/pks/lookup?op=get&search=0x3B6C5F1D2C7B6B02 Dominick Grift -------------- next part -------------- A non-text attachment was scrubbed... Name: not available Type: application/pgp-signature Size: 659 bytes Desc: not available Url : http://oss.tresys.com/pipermail/refpolicy/attachments/20171205/9cffd135/attachment.bin