From 13c9a34e3e717785cf37706a964294733f6c5b00 Mon Sep 17 00:00:00 2001 From: Zdenek Pytela Date: Thu, 13 Jan 2022 19:09:13 +0100 Subject: [PATCH] Allow systemd-logind delete session_dbusd tmp socket files Reference: https://gitbub.com/fedora-selinux/selinux-policy/commit/13c9a34e3e717785cf37706a964294733f6c5b00 Conflict: NA The dbus_delete_session_tmp_sock_files() interface was added. Addresses the following AVC denial: type=PROCTITLE msg=audit(13.1.2022 18:57:09.055:9086) : proctitle=/usr/lib/systemd/systemd-user-runtime-dir stop 100 1 type=PATH msg=audit(13.1.2022 18:57:09.055:9086) : item=1 name=bus inode=40 dev=00:3f mode=socket,666 ouid=staff ogi d=staff rdev=00:00 obj=staff_u:object_r:session_dbusd_tmp_t:s0 nametype=DELETE cap_fp=none cap_fi=none cap_fe=0 cap_ fver=0 cap_frootid=0 type=PATH msg=audit(13.1.2022 18:57:09.055:9086) : item=0 name=/ inode=1 dev=00:3f mode=dir,700 ouid=staff ogid=staf f rdev=00:00 obj=staff_u:object_r:user_tmp_t:s0 nametype=PARENT cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_froo tid=0 type=SYSCALL msg=audit(13.1.2022 18:57:09.055:9086) : arch=x86_64 syscall=unlinkat success=yes exit=0 a0=0x3 a1=0x56 0b86610d9b a2=0x0 a3=0x78 items=2 ppid=1 pid=26510 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid= root sgid=root fsgid=root tty=(none) ses=unset comm=systemd-user-ru exe=/usr/lib/systemd/systemd-user-runtime-dir su bj=system_u:system_r:systemd_logind_t:s0 key=(null) type=AVC msg=audit(13.1.2022 18:57:09.055:9086) : avc: denied { unlink } for pid=26510 comm=systemd-user-ru name= bus dev="tmpfs" ino=40 scontext=system_u:system_r:systemd_logind_t:s0 tcontext=staff_u:object_r:session_dbusd_tmp_t: s0 tclass=sock_file permissive=1 Resolves: rhbz#2039671 Signed-off-by: lujie54 --- policy/modules/contrib/dbus.if | 36 ++++++++++++++++++++++++++++++++++++ policy/modules/system/systemd.te | 1 + 2 files changed, 37 insertions(+) diff --git a/policy/modules/contrib/dbus.if b/policy/modules/contrib/dbus.if index 6f923ad..70e7bcd 100644 --- a/policy/modules/contrib/dbus.if +++ b/policy/modules/contrib/dbus.if @@ -863,6 +863,42 @@ interface(`dbus_manage_session_tmp_dirs',` manage_dirs_pattern($1, session_dbusd_tmp_t, session_dbusd_tmp_t) ') +###################################### +## +## Write to session_dbusd tmp socket files. +## +## +## +## Domain allowed access. +## +## +# +interface(`dbus_write_session_tmp_sock_files',` + gen_require(` + type session_dbusd_tmp_t; + ') + + write_sock_files_pattern($1, session_dbusd_tmp_t, session_dbusd_tmp_t) +') + +######################################## +## +## Delete session_dbusd tmp socket files. +## +## +## +## Domain allowed access. +## +## +# +interface(`dbus_delete_session_tmp_sock_files',` + gen_require(` + type session_dbusd_tmp_t; + ') + + delete_sock_files_pattern($1, session_dbusd_tmp_t, session_dbusd_tmp_t) +') + ######################################## ## ## Allow systemctl dbus services diff --git a/policy/modules/system/systemd.te b/policy/modules/system/systemd.te index a62f1fe..2b54d0b 100644 --- a/policy/modules/system/systemd.te +++ b/policy/modules/system/systemd.te @@ -363,6 +363,7 @@ optional_policy(` optional_policy(` dbus_connect_system_bus(systemd_logind_t) dbus_system_bus_client(systemd_logind_t) + dbus_delete_session_tmp_sock_files(systemd_logind_t) dbus_manage_session_tmp_dirs(systemd_logind_t) ') -- 1.8.3.1