Re: patches for xdm.te for kdm 3.3

[Russell Coker <russell@coker.com.au>]

[-- Attachment #1: Type: text/plain, Size: 1939 bytes --]

On Sun, 29 Aug 2004 02:45, Luke Kenneth Casson Leighton <lkcl@lkcl.net> wrote:
> i'm running kdm 3.3, also i'm running an "immediate user login" with no
> password.
>
> added these to get it to work.
>
> also as you can see i changed the type of /etc/qt3 to etc_runtime_t.

file_type_auto_trans(xdm_t, var_run_t, xdm_var_run_t, { dir fifo_file} )

This won't work properly due to a limitation of the file_type_trans() macro.  
You must have separate lines for "dir" and "fifo_file" (see the attached 
patch).

allow xdm_t etc_runtime_t:file { getattr read lock };

Does it work if you put in a dontaudit rule for lock access?  I don't think it 
should require lock access.

allow xdm_t etc_runtime_t:dir { getattr search };

This is wrong.  There should not be a etc_runtime_t:dir object.  If there is 
no file_contexts rule for assigning a type to an object and the type in 
question is not tmpfile then generally you should not include any rules 
permitting access to the objct.

# had to change /etc/qt3 to etc_runtime_t too

The type xdm_rw_etc_t seems appropriate for this.

allow xdm_t init_t:process { signal };
       #EXE=/sbin/halt   :  signal

allow xdm_t xdm_t:capability { sys_boot };

I think that we need a different domain for this.

can_exec(xdm_t, xsession_exec_t)

That looks like a bug.  xsession_exec_t scripts are supposed to execute in 
user context.  Looks like the kdm patch does not set the execute context 
everywhere that it should.


From the current state I expect that it'll be at least another two iterations 
and some bug reports getting filed before your xdm policy patch is ready to 
be included.

-- 
http://www.coker.com.au/selinux/   My NSA Security Enhanced Linux packages
http://www.coker.com.au/bonnie++/  Bonnie++ hard drive benchmark
http://www.coker.com.au/postal/    Postal SMTP/POP benchmark
http://www.coker.com.au/~russell/  My home page

[-- Attachment #2: x.diff --]
[-- Type: text/x-diff, Size: 447 bytes --]

--- /usr/src/se/policy/domains/program/unused/xdm.te	2004-08-28 12:05:08.000000000 +1000
+++ domains/program/unused/xdm.te	2004-08-29 17:11:18.000000000 +1000
@@ -29,6 +29,7 @@
 allow xdm_t xdm_var_run_t:fifo_file create_file_perms;
 allow initrc_t xdm_var_run_t:fifo_file unlink;
 file_type_auto_trans(xdm_t, var_run_t, xdm_var_run_t, fifo_file)
+file_type_auto_trans(xdm_t, var_run_t, xdm_var_run_t, dir)
 
 tmp_domain(xdm)
 var_lib_domain(xdm)