Currently .xsession-errors is labeled user_home_t when created by xdm_t. Switch to using existing interface xserver_user_home_dir_filetrans_user_xsession_log to create file with label xsession_log_t. This includes using the interface manage the type xsession_log_t.
type=AVC msg=audit(1511962175.985:77): avc: denied { create } for pid=1163 comm="lightdm" name=".xsession-errors" scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:xsession_log_t:s0 tclass=file
type=AVC msg=audit(1511962175.985:77): avc: denied { write open } for pid=1163 comm="lightdm" path="/home/user/.xsession-errors" dev="dm-0" ino=17153285 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:xsession_log_t:s0 tclass=file
type=AVC msg=audit(1511962941.991:268): avc: denied { rename } for pid=1721 comm="lightdm" name=".xsession-errors" dev="dm-0" ino=17153285 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:xsession_log_t:s0 tclass=file
type=AVC msg=audit(1511962977.779:419): avc: denied { unlink } for pid=1814 comm="lightdm" name=".xsession-errors.old" dev="dm-0" ino=17153285 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:xsession_log_t:s0 tclass=file
Signed-off-by: Dave Sugar <[email protected]>
---
policy/modules/services/xserver.te | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/policy/modules/services/xserver.te b/policy/modules/services/xserver.te
index f858da33..9cd153c4 100644
--- a/policy/modules/services/xserver.te
+++ b/policy/modules/services/xserver.te
@@ -274,7 +274,6 @@ files_tmp_filetrans(xauth_t, xauth_tmp_t, { file dir })
allow xdm_t xauth_home_t:file manage_file_perms;
userdom_user_home_dir_filetrans(xdm_t, xauth_home_t, file, ".Xauthority")
-userdom_user_home_dir_filetrans_user_home_content(xdm_t, file, ".xsession-errors")
allow xauth_t xdm_t:process sigchld;
allow xauth_t xdm_t:fd use;
@@ -500,8 +499,10 @@ userdom_signal_all_users(xdm_t)
# and it is now obsolete in Gnome3
xserver_read_user_dmrc(xdm_t)
+xserver_manage_xsession_log(xdm_t)
xserver_rw_session(xdm_t, xdm_tmpfs_t)
xserver_unconfined(xdm_t)
+xserver_user_home_dir_filetrans_user_xsession_log(xdm_t)
tunable_policy(`use_nfs_home_dirs',`
fs_manage_nfs_dirs(xdm_t)
--
2.13.6
On 11/30/2017 06:04 PM, David Sugar via refpolicy wrote:
> Currently .xsession-errors is labeled user_home_t when created by xdm_t. Switch to using existing interface xserver_user_home_dir_filetrans_user_xsession_log to create file with label xsession_log_t. This includes using the interface manage the type xsession_log_t.
>
> type=AVC msg=audit(1511962175.985:77): avc: denied { create } for pid=1163 comm="lightdm" name=".xsession-errors" scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:xsession_log_t:s0 tclass=file
> type=AVC msg=audit(1511962175.985:77): avc: denied { write open } for pid=1163 comm="lightdm" path="/home/user/.xsession-errors" dev="dm-0" ino=17153285 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:xsession_log_t:s0 tclass=file
> type=AVC msg=audit(1511962941.991:268): avc: denied { rename } for pid=1721 comm="lightdm" name=".xsession-errors" dev="dm-0" ino=17153285 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:xsession_log_t:s0 tclass=file
> type=AVC msg=audit(1511962977.779:419): avc: denied { unlink } for pid=1814 comm="lightdm" name=".xsession-errors.old" dev="dm-0" ino=17153285 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:xsession_log_t:s0 tclass=file
>
> Signed-off-by: Dave Sugar <[email protected]>
> ---
> policy/modules/services/xserver.te | 3 ++-
> 1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/policy/modules/services/xserver.te b/policy/modules/services/xserver.te
> index f858da33..9cd153c4 100644
> --- a/policy/modules/services/xserver.te
> +++ b/policy/modules/services/xserver.te
> @@ -274,7 +274,6 @@ files_tmp_filetrans(xauth_t, xauth_tmp_t, { file dir })
>
> allow xdm_t xauth_home_t:file manage_file_perms;
> userdom_user_home_dir_filetrans(xdm_t, xauth_home_t, file, ".Xauthority")
> -userdom_user_home_dir_filetrans_user_home_content(xdm_t, file, ".xsession-errors")
>
> allow xauth_t xdm_t:process sigchld;
> allow xauth_t xdm_t:fd use;
> @@ -500,8 +499,10 @@ userdom_signal_all_users(xdm_t)
> # and it is now obsolete in Gnome3
> xserver_read_user_dmrc(xdm_t)
>
> +xserver_manage_xsession_log(xdm_t)
> xserver_rw_session(xdm_t, xdm_tmpfs_t)
> xserver_unconfined(xdm_t)
> +xserver_user_home_dir_filetrans_user_xsession_log(xdm_t)
>
> tunable_policy(`use_nfs_home_dirs',`
> fs_manage_nfs_dirs(xdm_t)
Merged.
--
Chris PeBenito