[refpolicy] [PATCH 1/3] pulseaudio: filetrans for autospawn.lock

[jason@perfinion.com (Jason Zaman)]

On Mon, Apr 13, 2015 at 07:49:37PM +0200, Sven Vermeulen wrote:
>    Meh my mistake. The directory is written by pulseaudio client
>    applications and get the user_tmp_t type. Sorry for the noise.

for the record:
$ ls -alZ /tmp/pulse-PKdhtXMmr18n/
total 4
drwx------.  2 jason users staff_u:object_r:user_tmp_t        80 Apr 13 21:51 ./
drwxrwxrwt. 14 root  root  system_u:object_r:tmp_t           440 Apr 13 21:53 ../
srwxrwxrwx.  1 jason users staff_u:object_r:pulseaudio_tmp_t   0 Apr 13 21:51 native=
-rw-------.  1 jason users staff_u:object_r:pulseaudio_tmp_t   6 Apr 13 21:51 pid

autolock.spawn goes away right after the server is spawned, its only
there for a short time. Also, the dir does not *have* to be user_tmp_t.
The first program that wants sound will start up pulse (usually its
gsettings or equivalent tho). eg if you dont have pulse running and
start youtube you might get /tmp/pulse-* being mozilla_tmp_t.

-- Jason

>    Wkr,
>    ?  Sven?  Vermeulen
> 
>    On Apr 13, 2015 7:31 PM, "Sven Vermeulen" <[1]sven.vermeulen@siphos.be>
>    wrote:
> 
>      Doesn't the files_tmp_filetrans for the directory class already
>      ensure that the /tmp/pulse-* directory is of the right type?
> 
>    On Apr 13, 2015 6:01 PM, "Jason Zaman" <[2]jason@perfinion.com> wrote:
> 
>      Pulseaudio tries to acquire /tmp/pulse-*/autospawn.lock, this adds
>      the
>      filetrans rule.
>      $ start-pulseaudio-x11
>      W: [autospawn] core-util.c: Failed to create lock file
>      '/tmp/pulse-PKdhtXMmr18n/autospawn.lock': Permission denied
>      E: [pulseaudio] main.c: Failed to acquire autospawn lock
>      ---
>      ? pulseaudio.te | 1 +
>      ? 1 file changed, 1 insertion(+)
>      diff --git a/pulseaudio.te b/pulseaudio.te
>      index 4665af2..648de3a 100644
>      --- a/pulseaudio.te
>      +++ b/pulseaudio.te
>      @@ -56,6 +56,7 @@ manage_dirs_pattern(pulseaudio_t,
>      pulseaudio_tmp_t, pulseaudio_tmp_t)
>      ? manage_files_pattern(pulseaudio_t, pulseaudio_tmp_t,
>      pulseaudio_tmp_t)
>      ? manage_sock_files_pattern(pulseaudio_t, pulseaudio_tmp_t,
>      pulseaudio_tmp_t)
>      ? files_tmp_filetrans(pulseaudio_t, pulseaudio_tmp_t, dir)
>      +userdom_user_tmp_filetrans(pulseaudio_t, pulseaudio_tmp_t, file,
>      "autospawn.lock")
>      ? userdom_user_tmp_filetrans(pulseaudio_t, pulseaudio_tmp_t, file,
>      "pid")
>      ? userdom_user_tmp_filetrans(pulseaudio_t, pulseaudio_tmp_t,
>      sock_file, "dbus-socket")
>      ? userdom_user_tmp_filetrans(pulseaudio_t, pulseaudio_tmp_t,
>      sock_file, "native")
>      --
>      2.0.5
>      _______________________________________________
>      refpolicy mailing list
>      [3]refpolicy at oss.tresys.com
>      [4]http://oss.tresys.com/mailman/listinfo/refpolicy
> 
> References
> 
>    1. mailto:sven.vermeulen at siphos.be
>    2. mailto:jason at perfinion.com
>    3. mailto:refpolicy at oss.tresys.com
>    4. http://oss.tresys.com/mailman/listinfo/refpolicy