98 lines
3.6 KiB
Diff
98 lines
3.6 KiB
Diff
From 13c9a34e3e717785cf37706a964294733f6c5b00 Mon Sep 17 00:00:00 2001
|
|
From: Zdenek Pytela <zpytela@redhat.com>
|
|
Date: Thu, 13 Jan 2022 19:09:13 +0100
|
|
Subject: [PATCH] Allow systemd-logind delete session_dbusd tmp socket files
|
|
|
|
Reference: https://gitbub.com/fedora-selinux/selinux-policy/commit/13c9a34e3e717785cf37706a964294733f6c5b00
|
|
Conflict: NA
|
|
|
|
The dbus_delete_session_tmp_sock_files() interface was added.
|
|
|
|
Addresses the following AVC denial:
|
|
|
|
type=PROCTITLE msg=audit(13.1.2022 18:57:09.055:9086) : proctitle=/usr/lib/systemd/systemd-user-runtime-dir stop 100
|
|
1
|
|
type=PATH msg=audit(13.1.2022 18:57:09.055:9086) : item=1 name=bus inode=40 dev=00:3f mode=socket,666 ouid=staff ogi
|
|
d=staff rdev=00:00 obj=staff_u:object_r:session_dbusd_tmp_t:s0 nametype=DELETE cap_fp=none cap_fi=none cap_fe=0 cap_
|
|
fver=0 cap_frootid=0
|
|
type=PATH msg=audit(13.1.2022 18:57:09.055:9086) : item=0 name=/ inode=1 dev=00:3f mode=dir,700 ouid=staff ogid=staf
|
|
f rdev=00:00 obj=staff_u:object_r:user_tmp_t:s0 nametype=PARENT cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_froo
|
|
tid=0
|
|
type=SYSCALL msg=audit(13.1.2022 18:57:09.055:9086) : arch=x86_64 syscall=unlinkat success=yes exit=0 a0=0x3 a1=0x56
|
|
0b86610d9b a2=0x0 a3=0x78 items=2 ppid=1 pid=26510 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=
|
|
root sgid=root fsgid=root tty=(none) ses=unset comm=systemd-user-ru exe=/usr/lib/systemd/systemd-user-runtime-dir su
|
|
bj=system_u:system_r:systemd_logind_t:s0 key=(null)
|
|
type=AVC msg=audit(13.1.2022 18:57:09.055:9086) : avc: denied { unlink } for pid=26510 comm=systemd-user-ru name=
|
|
bus dev="tmpfs" ino=40 scontext=system_u:system_r:systemd_logind_t:s0 tcontext=staff_u:object_r:session_dbusd_tmp_t:
|
|
s0 tclass=sock_file permissive=1
|
|
|
|
Resolves: rhbz#2039671
|
|
Signed-off-by: lujie54 <lujie54@huawei.com>
|
|
---
|
|
policy/modules/contrib/dbus.if | 36 ++++++++++++++++++++++++++++++++++++
|
|
policy/modules/system/systemd.te | 1 +
|
|
2 files changed, 37 insertions(+)
|
|
|
|
diff --git a/policy/modules/contrib/dbus.if b/policy/modules/contrib/dbus.if
|
|
index 6f923ad..70e7bcd 100644
|
|
--- a/policy/modules/contrib/dbus.if
|
|
+++ b/policy/modules/contrib/dbus.if
|
|
@@ -863,6 +863,42 @@ interface(`dbus_manage_session_tmp_dirs',`
|
|
manage_dirs_pattern($1, session_dbusd_tmp_t, session_dbusd_tmp_t)
|
|
')
|
|
|
|
+######################################
|
|
+## <summary>
|
|
+## Write to session_dbusd tmp socket files.
|
|
+## </summary>
|
|
+## <param name="domain">
|
|
+## <summary>
|
|
+## Domain allowed access.
|
|
+## </summary>
|
|
+## </param>
|
|
+#
|
|
+interface(`dbus_write_session_tmp_sock_files',`
|
|
+ gen_require(`
|
|
+ type session_dbusd_tmp_t;
|
|
+ ')
|
|
+
|
|
+ write_sock_files_pattern($1, session_dbusd_tmp_t, session_dbusd_tmp_t)
|
|
+')
|
|
+
|
|
+########################################
|
|
+## <summary>
|
|
+## Delete session_dbusd tmp socket files.
|
|
+## </summary>
|
|
+## <param name="domain">
|
|
+## <summary>
|
|
+## Domain allowed access.
|
|
+## </summary>
|
|
+## </param>
|
|
+#
|
|
+interface(`dbus_delete_session_tmp_sock_files',`
|
|
+ gen_require(`
|
|
+ type session_dbusd_tmp_t;
|
|
+ ')
|
|
+
|
|
+ delete_sock_files_pattern($1, session_dbusd_tmp_t, session_dbusd_tmp_t)
|
|
+')
|
|
+
|
|
########################################
|
|
## <summary>
|
|
## Allow systemctl dbus services
|
|
diff --git a/policy/modules/system/systemd.te b/policy/modules/system/systemd.te
|
|
index a62f1fe..2b54d0b 100644
|
|
--- a/policy/modules/system/systemd.te
|
|
+++ b/policy/modules/system/systemd.te
|
|
@@ -363,6 +363,7 @@ optional_policy(`
|
|
optional_policy(`
|
|
dbus_connect_system_bus(systemd_logind_t)
|
|
dbus_system_bus_client(systemd_logind_t)
|
|
+ dbus_delete_session_tmp_sock_files(systemd_logind_t)
|
|
dbus_manage_session_tmp_dirs(systemd_logind_t)
|
|
')
|
|
|
|
--
|
|
1.8.3.1
|
|
|