patches for xdm.te for kdm 3.3

patches for xdm.te for kdm 3.3

[Luke Kenneth Casson Leighton]

[-- Attachment #1: Type: text/plain, Size: 523 bytes --]

i'm running kdm 3.3, also i'm running an "immediate user login" with no
password.

added these to get it to work.

also as you can see i changed the type of /etc/qt3 to etc_runtime_t.

-- 
--
Truth, honesty and respect are rare commodities that all spring from
the same well: Love.  If you love yourself and everyone and everything
around you, funnily and coincidentally enough, life gets a lot better.
--
<a href="http://lkcl.net">      lkcl.net      </a> <br />
<a href="mailto:lkcl@lkcl.net"> lkcl@lkcl.net </a> <br />


[-- Attachment #2: xdm.patch --]
[-- Type: text/plain, Size: 2601 bytes --]

--- /usr/share/selinux/policy/default.1.14/domains/program/xdm.te	2004-08-02 08:28:37.000000000 +0100
+++ domains/program/xdm.te	2004-08-28 17:30:08.000000000 +0100
@@ -28,7 +28,7 @@
 # for xdmctl
 allow xdm_t xdm_var_run_t:fifo_file create_file_perms;
 allow initrc_t xdm_var_run_t:fifo_file unlink;
-file_type_auto_trans(xdm_t, var_run_t, xdm_var_run_t, fifo_file)
+file_type_auto_trans(xdm_t, var_run_t, xdm_var_run_t, { dir fifo_file} )
 
 tmp_domain(xdm)
 var_lib_domain(xdm)
@@ -183,7 +183,8 @@
 
 allow xdm_t self:process { setpgid setsched };
 allow xdm_t etc_t:lnk_file read;
-allow xdm_t etc_runtime_t:file { getattr read };
+allow xdm_t etc_runtime_t:file { getattr read lock };
+allow xdm_t etc_runtime_t:dir { getattr search };
 
 # wdm has its own config dir /etc/X11/wdm
 # this is ugly, daemons should not create files under /etc!
@@ -327,3 +328,55 @@
 allow xdm_t crack_db_t:file r_file_perms;
 ')
 r_dir_file(xdm_t, selinux_config_t)
+
+# ARGH. damn qt libraries.
+# had to change /etc/qt3 to etc_runtime_t too
+allow xdm_t etc_runtime_t:file { write };
+	#EXE=/usr/bin/kdm_greet  NAME=.qtrc.lock   :  write
+	#EXE=/usr/bin/kdm_greet  NAME=.qt_plugins_3.2rc.lock   :  write
+	#EXE=/usr/bin/krootimage  NAME=.qtrc.lock   :  write
+	#EXE=/usr/bin/krootimage  NAME=.qt_plugins_3.2rc.lock   :  write
+
+# ARGH.
+dontaudit xdm_t sbin_t:dir { getattr };
+	#EXE=/usr/bin/kdm_greet  PATH=/usr/local/sbin   :  getattr
+	#EXE=/usr/bin/kdm_greet  PATH=/usr/sbin   :  getattr
+	#EXE=/usr/bin/kdm_greet  PATH=/sbin   :  getattr
+
+allow xdm_xserver_t initrc_tmp_t:dir { search };
+	#EXE=/usr/X11R6/bin/XFree86  NAME=.font-unix   :  search
+
+# allow xdm to run halt
+
+allow xdm_t init_t:process { signal };
+	#EXE=/sbin/halt   :  signal
+
+allow xdm_t xdm_t:capability { sys_boot };
+	#EXE=/sbin/halt   :  sys_boot
+
+can_exec(xdm_t, init_exec_t)
+	#EXE=/sbin/shutdown  NAME=init   :  execute
+
+
+allow xdm_xserver_t var_run_t:file { getattr read };
+	#EXE=/usr/X11R6/bin/XFree86  PATH=/var/run/xauth/A:0-4iQaw9   :  getattr
+	#EXE=/bin/cat  NAME=A:0-4iQaw9   :  read
+
+can_exec(xdm_t, xsession_exec_t)
+	#EXE=/usr/bin/kdm  PATH=/etc/kde3/kdm/Xstartup   :  execute_no_trans
+
+
+allow xdm_t xdm_var_run_t:sock_file { create setattr unlink };
+	#EXE=/usr/bin/kdm  NAME=socket   :  create
+
+
+allow xdm_xserver_t zero_device_t:chr_file { read write };
+	#EXE=/usr/X11R6/bin/XFree86  NAME=zero   :  read write
+
+
+allow xdm_t xdm_var_run_t:dir { rmdir setattr create };
+	#EXE=/usr/bin/kdm  NAME=xdmctl   :  create
+
+# to access /var/run/utmp
+allow xdm_t initrc_var_run_t:file { getattr };
+

Re: patches for xdm.te for kdm 3.3

[Russell Coker]

[-- Attachment #1: Type: text/plain, Size: 1939 bytes --]

On Sun, 29 Aug 2004 02:45, Luke Kenneth Casson Leighton <lkcl@lkcl.net> wrote:
> i'm running kdm 3.3, also i'm running an "immediate user login" with no
> password.
>
> added these to get it to work.
>
> also as you can see i changed the type of /etc/qt3 to etc_runtime_t.

file_type_auto_trans(xdm_t, var_run_t, xdm_var_run_t, { dir fifo_file} )

This won't work properly due to a limitation of the file_type_trans() macro.  
You must have separate lines for "dir" and "fifo_file" (see the attached 
patch).

allow xdm_t etc_runtime_t:file { getattr read lock };

Does it work if you put in a dontaudit rule for lock access?  I don't think it 
should require lock access.

allow xdm_t etc_runtime_t:dir { getattr search };

This is wrong.  There should not be a etc_runtime_t:dir object.  If there is 
no file_contexts rule for assigning a type to an object and the type in 
question is not tmpfile then generally you should not include any rules 
permitting access to the objct.

# had to change /etc/qt3 to etc_runtime_t too

The type xdm_rw_etc_t seems appropriate for this.

allow xdm_t init_t:process { signal };
       #EXE=/sbin/halt   :  signal

allow xdm_t xdm_t:capability { sys_boot };

I think that we need a different domain for this.

can_exec(xdm_t, xsession_exec_t)

That looks like a bug.  xsession_exec_t scripts are supposed to execute in 
user context.  Looks like the kdm patch does not set the execute context 
everywhere that it should.


From the current state I expect that it'll be at least another two iterations 
and some bug reports getting filed before your xdm policy patch is ready to 
be included.

-- 
http://www.coker.com.au/selinux/   My NSA Security Enhanced Linux packages
http://www.coker.com.au/bonnie++/  Bonnie++ hard drive benchmark
http://www.coker.com.au/postal/    Postal SMTP/POP benchmark
http://www.coker.com.au/~russell/  My home page

[-- Attachment #2: x.diff --]
[-- Type: text/x-diff, Size: 447 bytes --]

--- /usr/src/se/policy/domains/program/unused/xdm.te	2004-08-28 12:05:08.000000000 +1000
+++ domains/program/unused/xdm.te	2004-08-29 17:11:18.000000000 +1000
@@ -29,6 +29,7 @@
 allow xdm_t xdm_var_run_t:fifo_file create_file_perms;
 allow initrc_t xdm_var_run_t:fifo_file unlink;
 file_type_auto_trans(xdm_t, var_run_t, xdm_var_run_t, fifo_file)
+file_type_auto_trans(xdm_t, var_run_t, xdm_var_run_t, dir)
 
 tmp_domain(xdm)
 var_lib_domain(xdm)

Re: patches for xdm.te for kdm 3.3

[Luke Kenneth Casson Leighton]

On Sun, Aug 29, 2004 at 05:21:55PM +1000, Russell Coker wrote:
> On Sun, 29 Aug 2004 02:45, Luke Kenneth Casson Leighton <lkcl@lkcl.net> wrote:
> > i'm running kdm 3.3, also i'm running an "immediate user login" with no
> > password.
> >
> > added these to get it to work.
> >
> > also as you can see i changed the type of /etc/qt3 to etc_runtime_t.
> 
> file_type_auto_trans(xdm_t, var_run_t, xdm_var_run_t, { dir fifo_file} )
> 
> This won't work properly due to a limitation of the file_type_trans() macro.  

 urrrr... are you sure?  have there been recent changes [in last month]
 that _stop_ this from working?

> You must have separate lines for "dir" and "fifo_file" (see the attached 
> patch).
> 
> allow xdm_t etc_runtime_t:file { getattr read lock };
> 
> Does it work if you put in a dontaudit rule for lock access?  I don't think it 
> should require lock access.

 i'll try it again: it's been several months.

> allow xdm_t etc_runtime_t:dir { getattr search };
> 
> This is wrong.  There should not be a etc_runtime_t:dir object.  

 it's because this is what i assigned the /etc/qt3 directory to...

> If there is 
> no file_contexts rule for assigning a type to an object and the type in 
> question is not tmpfile then generally you should not include any rules 
> permitting access to the objct.
> 
> # had to change /etc/qt3 to etc_runtime_t too
> 
> The type xdm_rw_etc_t seems appropriate for this

 ... but i'll try this instead.

> allow xdm_t init_t:process { signal };
>        #EXE=/sbin/halt   :  signal
> 
> allow xdm_t xdm_t:capability { sys_boot };
> 
> I think that we need a different domain for this.
 
 that'd be nice.

 oh - this is what i was referring to about "does anyone _use_ kde"
 because the without xdmctl thing (allowing /var/run/xdmctl/* to be
 xdm_var_run_t etc.) and without the above, you can't run "shutdown"
 from the "logout" menu.

> can_exec(xdm_t, xsession_exec_t)
> 
> That looks like a bug.  xsession_exec_t scripts are supposed to execute in 
> user context.  Looks like the kdm patch does not set the execute context 
> everywhere that it should.

 oh.  ah.... that patch.  um.... the one i haven't applied because i
 downloaded kde 3.3 and i thought i could get away with putting in
 pam_selinux.so into /etc/pam.d/kdm because i didn't want to go through
 _yet another_ kdebase-3.x download and build cycle.



> From the current state I expect that it'll be at least another two iterations 
> and some bug reports getting filed before your xdm policy patch is ready to 
> be included.

 oh, i wasn't expecting it to be included because i don't entirely
 know what i'm doing here, i would be happier with pointing out
 things and other people sorting them, but hey ...

 ... so if you're comfortable with doing iterations, like this,
 under such a proviso [me being semi-clueless], then sure.

 l.


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: patches for xdm.te for kdm 3.3

[Russell Coker]

On Sun, 29 Aug 2004 19:11, Luke Kenneth Casson Leighton <lkcl@lkcl.net> wrote:
> On Sun, Aug 29, 2004 at 05:21:55PM +1000, Russell Coker wrote:
> > On Sun, 29 Aug 2004 02:45, Luke Kenneth Casson Leighton <lkcl@lkcl.net> 
wrote:
> > > i'm running kdm 3.3, also i'm running an "immediate user login" with no
> > > password.
> > >
> > > added these to get it to work.
> > >
> > > also as you can see i changed the type of /etc/qt3 to etc_runtime_t.
> >
> > file_type_auto_trans(xdm_t, var_run_t, xdm_var_run_t, { dir fifo_file} )
> >
> > This won't work properly due to a limitation of the file_type_trans()
> > macro.
>
>  urrrr... are you sure?  have there been recent changes [in last month]
>  that _stop_ this from working?

ifelse(`$4', `dir', `
allow $1 $3:$4 create_dir_perms;
', `
ifelse(`$4', `lnk_file', `
allow $1 $3:$4 create_lnk_perms;
', `
allow $1 $3:$4 create_file_perms;
')dnl end ifelse lnk_file
')dnl end if dir

The above is in file_type_trans().  Specifying "dir" with something else means 
that create_file_perms will be granted instead of create_dir_perms.

It's been like that ever since I added a fourth parameter to file_type_trans() 
and file_type_auto_trans().

> > allow xdm_t init_t:process { signal };
> >        #EXE=/sbin/halt   :  signal
> >
> > allow xdm_t xdm_t:capability { sys_boot };
> >
> > I think that we need a different domain for this.
>
>  that'd be nice.
>
>  oh - this is what i was referring to about "does anyone _use_ kde"
>  because the without xdmctl thing (allowing /var/run/xdmctl/* to be
>  xdm_var_run_t etc.) and without the above, you can't run "shutdown"
>  from the "logout" menu.

I think that no-one but you uses kdm.  Lots of people use KDE including me.

> > can_exec(xdm_t, xsession_exec_t)
> >
> > That looks like a bug.  xsession_exec_t scripts are supposed to execute
> > in user context.  Looks like the kdm patch does not set the execute
> > context everywhere that it should.
>
>  oh.  ah.... that patch.  um.... the one i haven't applied because i
>  downloaded kde 3.3 and i thought i could get away with putting in
>  pam_selinux.so into /etc/pam.d/kdm because i didn't want to go through
>  _yet another_ kdebase-3.x download and build cycle.

pam_selinux.so never worked properly for xdm type programs.

-- 
http://www.coker.com.au/selinux/   My NSA Security Enhanced Linux packages
http://www.coker.com.au/bonnie++/  Bonnie++ hard drive benchmark
http://www.coker.com.au/postal/    Postal SMTP/POP benchmark
http://www.coker.com.au/~russell/  My home page

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: patches for xdm.te for kdm 3.3

[Luke Kenneth Casson Leighton]

On Sun, Aug 29, 2004 at 08:49:24PM +1000, Russell Coker wrote:

> On Sun, 29 Aug 2004 19:11, Luke Kenneth Casson Leighton <lkcl@lkcl.net> wrote:
> > On Sun, Aug 29, 2004 at 05:21:55PM +1000, Russell Coker wrote:
> > > On Sun, 29 Aug 2004 02:45, Luke Kenneth Casson Leighton <lkcl@lkcl.net> 
> wrote:
> > > > i'm running kdm 3.3, also i'm running an "immediate user login" with no
> > > > password.
> > > >
> > > > added these to get it to work.
> > > >
> > > > also as you can see i changed the type of /etc/qt3 to etc_runtime_t.
> > >
> > > file_type_auto_trans(xdm_t, var_run_t, xdm_var_run_t, { dir fifo_file} )
> > >
> > > This won't work properly due to a limitation of the file_type_trans()
> > > macro.
> >
> >  urrrr... are you sure?  have there been recent changes [in last month]
> >  that _stop_ this from working?
> 
> ifelse(`$4', `dir', `
> allow $1 $3:$4 create_dir_perms;
> ', `
> ifelse(`$4', `lnk_file', `
> allow $1 $3:$4 create_lnk_perms;
> ', `
> allow $1 $3:$4 create_file_perms;
> ')dnl end ifelse lnk_file
> ')dnl end if dir
> 
> The above is in file_type_trans().  Specifying "dir" with something else means 
> that create_file_perms will be granted instead of create_dir_perms.
> 
> It's been like that ever since I added a fourth parameter to file_type_trans() 
> and file_type_auto_trans().
> 
> > > allow xdm_t init_t:process { signal };
> > >        #EXE=/sbin/halt   :  signal
> > >
> > > allow xdm_t xdm_t:capability { sys_boot };
> > >
> > > I think that we need a different domain for this.
> >
> >  that'd be nice.
> >
> >  oh - this is what i was referring to about "does anyone _use_ kde"
> >  because the without xdmctl thing (allowing /var/run/xdmctl/* to be
> >  xdm_var_run_t etc.) and without the above, you can't run "shutdown"
> >  from the "logout" menu.
> 
> I think that no-one but you uses kdm.  

 ... *blnk*.  ah.

 right.

 okay.

 that explains it.

 l.

-- 
--
Truth, honesty and respect are rare commodities that all spring from
the same well: Love.  If you love yourself and everyone and everything
around you, funnily and coincidentally enough, life gets a lot better.
--
<a href="http://lkcl.net">      lkcl.net      </a> <br />
<a href="mailto:lkcl@lkcl.net"> lkcl@lkcl.net </a> <br />


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.