mpv and kitty terminal emulator on Wayland

mpv and kitty terminal emulator on Wayland

[Russell Coker]

When a paste operation is triggered (middle click on video window) mpv is 
having it's file handle sent to kitty, presumably by the wayland system (KDE 
in this case).

Denying this access can cause the source of the paste data (kitty in this 
case) to crash.  Here's the logs for kitty:

type=AVC msg=audit(1784959694.829:20780): avc:  denied  { use } for  pid=4712 
comm="kitty" path="pipe:[150412]" dev="pipefs" ino=150412 
scontext=etbe:user_r:user_t:s0-s0:c0.c1023 tcontext=etbe:user_r:mplayer_t:s0-
s0:c0.c1023 tclass=fd permissive=0
type=AVC msg=audit(1784959694.861:20787): avc:  denied  { use } for  pid=4282 
comm="QThread" path="pipe:[149316]" dev="pipefs" ino=149316 
scontext=etbe:user_r:user_t:s0-s0:c0.c1023 tcontext=etbe:user_r:mplayer_t:s0-
s0:c0.c1023 tclass=fd permissive=0
type=AVC msg=audit(1784959851.794:22406): avc:  denied  { use } for  pid=17365 
comm="kitty" path="pipe:[166960]" dev="pipefs" ino=166960 
scontext=etbe:user_r:user_t:s0-s0:c0.c1023 tcontext=etbe:user_r:mplayer_t:s0-
s0:c0.c1023 tclass=fd permissive=0
type=AVC msg=audit(1784959851.822:22409): avc:  denied  { use } for  pid=16312 
comm="WaylandEventThr" path="pipe:[164719]" dev="pipefs" ino=164719 
scontext=etbe:user_r:user_t:s0-s0:c0.c1023 tcontext=etbe:user_r:mplayer_t:s0-
s0:c0.c1023 tclass=fd permissive=0
type=AVC msg=audit(1784959876.318:22422): avc:  denied  { use } for  pid=10585 
comm="kitty" path="pipe:[165833]" dev="pipefs" ino=165833 
scontext=etbe:user_r:user_t:s0-s0:c0.c1023 tcontext=etbe:user_r:mplayer_t:s0-
s0:c0.c1023 tclass=fd permissive=0

Here's the errors from Kitty:
file descriptor expected, object (52), message send(sh)
[7.945] [glfw error 65544]: Wayland: fatal display error: Invalid argument

Here's the errors from Konsole:
file descriptor expected, object (66), message send(sh)
The Wayland connection experienced a fatal error: Invalid argument

Here's the logs when the fd use is allowed:

type=AVC msg=audit(1784960913.928:24443): avc:  denied  { write } for  
pid=25743 comm="WaylandEventThr" path="pipe:[188207]" dev="pipefs" ino=188207 
scontext=etbe:user_r:user_t:s0-s0:c0.c1023 tcontext=etbe:user_r:mplayer_t:s0-
s0:c0.c1023 tclass=fifo_file permissive=0
type=AVC msg=audit(1784960913.964:24444): avc:  denied  { write } for  
pid=24950 comm="QThread" path="pipe:[190614]" dev="pipefs" ino=190614 
scontext=etbe:user_r:user_t:s0-s0:c0.c1023 tcontext=etbe:user_r:mplayer_t:s0-
s0:c0.c1023 tclass=fifo_file permissive=0

So it looks that for Wayland to work in the expected manner without programs 
crashing all the time we need to allow every Wayland client domain to use a fd 
from every other domain and to have fifo_file rw_inherited_fifo_file_perms 
access.

Would it be possible to have a SE Linux aware clipboard program to mediate 
this?

-- 
My Main Blog         http://etbe.coker.com.au/
My Documents Blog    http://doc.coker.com.au/

Re: mpv and kitty terminal emulator on Wayland

[Dominick Grift]

Russell Coker <russell@coker.com.au> writes:

> When a paste operation is triggered (middle click on video window) mpv is 
> having it's file handle sent to kitty, presumably by the wayland system (KDE 
> in this case).
>
> Denying this access can cause the source of the paste data (kitty in this 
> case) to crash.  Here's the logs for kitty:
>
> type=AVC msg=audit(1784959694.829:20780): avc:  denied  { use } for  pid=4712 
> comm="kitty" path="pipe:[150412]" dev="pipefs" ino=150412 
> scontext=etbe:user_r:user_t:s0-s0:c0.c1023 tcontext=etbe:user_r:mplayer_t:s0-
> s0:c0.c1023 tclass=fd permissive=0
> type=AVC msg=audit(1784959694.861:20787): avc:  denied  { use } for  pid=4282 
> comm="QThread" path="pipe:[149316]" dev="pipefs" ino=149316 
> scontext=etbe:user_r:user_t:s0-s0:c0.c1023 tcontext=etbe:user_r:mplayer_t:s0-
> s0:c0.c1023 tclass=fd permissive=0
> type=AVC msg=audit(1784959851.794:22406): avc:  denied  { use } for  pid=17365 
> comm="kitty" path="pipe:[166960]" dev="pipefs" ino=166960 
> scontext=etbe:user_r:user_t:s0-s0:c0.c1023 tcontext=etbe:user_r:mplayer_t:s0-
> s0:c0.c1023 tclass=fd permissive=0
> type=AVC msg=audit(1784959851.822:22409): avc:  denied  { use } for  pid=16312 
> comm="WaylandEventThr" path="pipe:[164719]" dev="pipefs" ino=164719 
> scontext=etbe:user_r:user_t:s0-s0:c0.c1023 tcontext=etbe:user_r:mplayer_t:s0-
> s0:c0.c1023 tclass=fd permissive=0
> type=AVC msg=audit(1784959876.318:22422): avc:  denied  { use } for  pid=10585 
> comm="kitty" path="pipe:[165833]" dev="pipefs" ino=165833 
> scontext=etbe:user_r:user_t:s0-s0:c0.c1023 tcontext=etbe:user_r:mplayer_t:s0-
> s0:c0.c1023 tclass=fd permissive=0
>
> Here's the errors from Kitty:
> file descriptor expected, object (52), message send(sh)
> [7.945] [glfw error 65544]: Wayland: fatal display error: Invalid argument
>
> Here's the errors from Konsole:
> file descriptor expected, object (66), message send(sh)
> The Wayland connection experienced a fatal error: Invalid argument
>
> Here's the logs when the fd use is allowed:
>
> type=AVC msg=audit(1784960913.928:24443): avc:  denied  { write } for  
> pid=25743 comm="WaylandEventThr" path="pipe:[188207]" dev="pipefs" ino=188207 
> scontext=etbe:user_r:user_t:s0-s0:c0.c1023 tcontext=etbe:user_r:mplayer_t:s0-
> s0:c0.c1023 tclass=fifo_file permissive=0
> type=AVC msg=audit(1784960913.964:24444): avc:  denied  { write } for  
> pid=24950 comm="QThread" path="pipe:[190614]" dev="pipefs" ino=190614 
> scontext=etbe:user_r:user_t:s0-s0:c0.c1023 tcontext=etbe:user_r:mplayer_t:s0-
> s0:c0.c1023 tclass=fifo_file permissive=0
>
> So it looks that for Wayland to work in the expected manner without programs 
> crashing all the time we need to allow every Wayland client domain to use a fd 
> from every other domain and to have fifo_file rw_inherited_fifo_file_perms 
> access.

According to what I have write_inherited_fifo_file_perms might be
enough:

# sesearch -A -s wlroots.client.typeattr -t wlroots.client.typeattr -ds
allow wlroots.client.typeattr wlroots.client.typeattr:fd use;
allow wlroots.client.typeattr wlroots.client.typeattr:fifo_file { append
getattr ioctl lock write };


>
> Would it be possible to have a SE Linux aware clipboard program to mediate 
> this?

-- 
gpg --auto-key-locate clear,nodefault,wkd --locate-external-keys dominick.grift@defensec.nl
Key fingerprint = FCD2 3660 5D6B 9D27 7FC6  E0FF DA7E 521F 10F6 4098
Dominick Grift
Mastodon: @kcinimod@defensec.nl