73 lines
3.2 KiB
Diff
73 lines
3.2 KiB
Diff
From 7c18d0afc7f6b93319902dc1e5305fe66a060019 Mon Sep 17 00:00:00 2001
|
|
From: Zdenek Pytela <zpytela@redhat.com>
|
|
Date: Thu, 13 Jan 2022 19:17:31 +0100
|
|
Subject: [PATCH] Allow login_userdomain create session_dbusd tmp socket files
|
|
|
|
Reference: https://gitbub.com/fedora-selinux/selinux-policy/commit/7c18d0afc7f6b93319902dc1e5305fe66a060019
|
|
Conflict: NA
|
|
|
|
The dbus_create_session_tmp_sock_files() interface was added.
|
|
|
|
Addresses the following AVC denial:
|
|
|
|
type=PROCTITLE msg=audit(13.1.2022 18:56:38.180:8372) : proctitle=(systemd)
|
|
type=PATH msg=audit(13.1.2022 18:56:38.180:8372) : item=1 name=/run/user/1001/bus inode=40 dev=00:3f mode=socket,666 ouid=staff ogid=staff rdev=00:00 obj=staff_u:object_r:session_dbusd_tmp_t:s0 nametype=CREATE cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0
|
|
type=PATH msg=audit(13.1.2022 18:56:38.180:8372) : item=0 name=/run/user/1001/ inode=1 dev=00:3f mode=dir,700 ouid=staff ogid=staff rdev=00:00 obj=staff_u:object_r:user_tmp_t:s0 nametype=PARENT cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0
|
|
type=SOCKADDR msg=audit(13.1.2022 18:56:38.180:8372) : saddr={ saddr_fam=local path=/run/user/1001/bus }
|
|
type=SYSCALL msg=audit(13.1.2022 18:56:38.180:8372) : arch=x86_64 syscall=bind success=yes exit=0 a0=0xc a1=0x562410fef860 a2=0x15 a3=0x0 items=2 ppid=1 pid=24940 auid=staff uid=staff gid=staff euid=staff suid=staff fsuid=staff egid=staff sgid=staff fsgid=staff tty=(none) ses=23 comm=systemd exe=/usr/lib/systemd/systemd subj=staff_u:staff_r:staff_t:s0-s0:c0.c1023 key=(null)
|
|
type=AVC msg=audit(13.1.2022 18:56:38.180:8372) : avc: denied { create } for pid=24940 comm=systemd name=bus scontext=staff_u:staff_r:staff_t:s0-s0:c0.c1023 tcontext=staff_u:object_r:session_dbusd_tmp_t:s0 tclass=sock_file permissive=1
|
|
|
|
Signed-off-by: lujie54 <lujie54@huawei.com>
|
|
---
|
|
policy/modules/contrib/dbus.if | 18 ++++++++++++++++++
|
|
policy/modules/system/userdomain.te | 4 ++++
|
|
2 files changed, 22 insertions(+)
|
|
|
|
diff --git a/policy/modules/contrib/dbus.if b/policy/modules/contrib/dbus.if
|
|
index e04af61..deb6f10 100644
|
|
--- a/policy/modules/contrib/dbus.if
|
|
+++ b/policy/modules/contrib/dbus.if
|
|
@@ -901,6 +901,24 @@ interface(`dbus_delete_session_tmp_sock_files',`
|
|
|
|
########################################
|
|
## <summary>
|
|
+## Create session_dbusd tmp socket files.
|
|
+## </summary>
|
|
+## <param name="domain">
|
|
+## <summary>
|
|
+## Domain allowed access.
|
|
+## </summary>
|
|
+## </param>
|
|
+#
|
|
+interface(`dbus_create_session_tmp_sock_files',`
|
|
+ gen_require(`
|
|
+ type session_dbusd_tmp_t;
|
|
+ ')
|
|
+
|
|
+ create_sock_files_pattern($1, session_dbusd_tmp_t, session_dbusd_tmp_t)
|
|
+')
|
|
+
|
|
+########################################
|
|
+## <summary>
|
|
## Allow systemctl dbus services
|
|
## </summary>
|
|
## <param name="domain">
|
|
diff --git a/policy/modules/system/userdomain.te b/policy/modules/system/userdomain.te
|
|
index b936a81..9f778ee 100644
|
|
--- a/policy/modules/system/userdomain.te
|
|
+++ b/policy/modules/system/userdomain.te
|
|
@@ -404,6 +404,10 @@ optional_policy(`
|
|
')
|
|
|
|
optional_policy(`
|
|
+ dbus_create_session_tmp_sock_files(login_userdomain)
|
|
+')
|
|
+
|
|
+optional_policy(`
|
|
gnome_watch_generic_data_home_dirs(login_userdomain)
|
|
gnome_watch_home_config_dirs(login_userdomain)
|
|
gnome_watch_home_config_files(login_userdomain)
|
|
--
|
|
1.8.3.1
|
|
|