kde 3.3's kdm creating /var/run/xdmctl

kde 3.3's kdm creating /var/run/xdmctl

[Luke Kenneth Casson Leighton]

this is a bit of an issue.

if /var/run/xdmctl gets accidentally deleted, kde sessions will not be
able to do a shutdown or restart from the logout menu.

the reason is because xdm_t doesn't have permission to recreate
the /var/run/xdmctl directory.

the suggestion of doing touch /var/run/xdmctl/.keep will simply
stop kdm from rm'ing /var/run/xdmctl, but if the directory
ever happens to _successfully_ be deleted (permissive mode
for example) ...

also i find that on creation of this directory, its permission
is set to var_run_t not xdm_var_run_t.

i'm not entirely sure what to do.

at the moment as a preliminary measure i've added permissions
for xdm_t to create, access and delete sockets in both var_run_t
_and_ xdm_var_run_t in order to deal with the mess.

help? 

l.

-- 
--
Truth, honesty and respect are rare commodities that all spring from
the same well: Love.  If you love yourself and everyone and everything
around you, funnily and coincidentally enough, life gets a lot better.
--
<a href="http://lkcl.net">      lkcl.net      </a> <br />
<a href="mailto:lkcl@lkcl.net"> lkcl@lkcl.net </a> <br />


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: kde 3.3's kdm creating /var/run/xdmctl

[Stephen Smalley]

On Mon, 2004-08-23 at 16:54, Luke Kenneth Casson Leighton wrote:
> also i find that on creation of this directory, its permission
> is set to var_run_t not xdm_var_run_t.
> 
> i'm not entirely sure what to do.
> 
> at the moment as a preliminary measure i've added permissions
> for xdm_t to create, access and delete sockets in both var_run_t
> _and_ xdm_var_run_t in order to deal with the mess.

What creates the directory?  If it is kdm itself, then extend the
file_type_auto_trans(xdm_t, var_run_t, xdm_var_run_t, fifo_file) rule to
also cover dir (replace fifo_file with { dir fifo_file}).

-- 
Stephen Smalley <sds@epoch.ncsc.mil>
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: kde 3.3's kdm creating /var/run/xdmctl

[Luke Kenneth Casson Leighton]

On Tue, Aug 24, 2004 at 07:02:09AM -0400, Stephen Smalley wrote:
> On Mon, 2004-08-23 at 16:54, Luke Kenneth Casson Leighton wrote:
> > also i find that on creation of this directory, its permission
> > is set to var_run_t not xdm_var_run_t.
> > 
> > i'm not entirely sure what to do.
> > 
> > at the moment as a preliminary measure i've added permissions
> > for xdm_t to create, access and delete sockets in both var_run_t
> > _and_ xdm_var_run_t in order to deal with the mess.
> 
> What creates the directory?  

 i believe it's kdm.

> If it is kdm itself, then extend the
> file_type_auto_trans(xdm_t, var_run_t, xdm_var_run_t, fifo_file) rule to
> also cover dir (replace fifo_file with { dir fifo_file}).

 okay, great, i'll try that out.

 *whew*, there's a possible solution.

 l.

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: kde 3.3's kdm creating /var/run/xdmctl

[Luke Kenneth Casson Leighton]

On Tue, Aug 24, 2004 at 11:33:13PM +0100, Luke Kenneth Casson Leighton wrote:

> On Tue, Aug 24, 2004 at 07:02:09AM -0400, Stephen Smalley wrote:

> > On Mon, 2004-08-23 at 16:54, Luke Kenneth Casson Leighton wrote:
> > > also i find that on creation of this directory, its permission
> > > is set to var_run_t not xdm_var_run_t.
> > > 
> > > i'm not entirely sure what to do.
> > > 
> > > at the moment as a preliminary measure i've added permissions
> > > for xdm_t to create, access and delete sockets in both var_run_t
> > > _and_ xdm_var_run_t in order to deal with the mess.
> > 
> > What creates the directory?  
> 
>  i believe it's kdm.
> 
> > If it is kdm itself, then extend the
> > file_type_auto_trans(xdm_t, var_run_t, xdm_var_run_t, fifo_file) rule to
> > also cover dir (replace fifo_file with { dir fifo_file}).
> 
>  okay, great, i'll try that out.

 seems to have worked.  unlink permission isn't granted but the
 directory /var/run/xdmctl is deleted on logout only to be recreated
 at login anyway.
 
 thanks stephen.

 l.


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.