From: russell@coker.com.au (Russell Coker)
To: refpolicy@oss.tresys.com
Subject: [refpolicy] [PATCH] misc dbus patches
Date: Tue, 13 Feb 2018 11:36:49 +1100 [thread overview]
Message-ID: <20180213003649.GA17327@xev> (raw)
Here is a collection of dbus policy patches, all fairly simple.
Chris please merge the ones you like and we can discuss any you don't like
afterwards.
Index: refpolicy-2.20180211/policy/modules/contrib/apt.te
===================================================================
--- refpolicy-2.20180211.orig/policy/modules/contrib/apt.te
+++ refpolicy-2.20180211/policy/modules/contrib/apt.te
@@ -148,6 +148,11 @@ optional_policy(`
')
optional_policy(`
+ # for packagekitd
+ policykit_dbus_chat(apt_t)
+')
+
+optional_policy(`
# rkhunter trigger
rkhunter_domtrans(apt_t)
')
@@ -159,4 +164,5 @@ optional_policy(`
optional_policy(`
unconfined_domain(apt_t)
+ unconfined_dbus_send(apt_t)
')
Index: refpolicy-2.20180211/policy/modules/contrib/dbus.te
===================================================================
--- refpolicy-2.20180211.orig/policy/modules/contrib/dbus.te
+++ refpolicy-2.20180211/policy/modules/contrib/dbus.te
@@ -136,6 +136,9 @@ init_use_script_ptys(system_dbusd_t)
init_all_labeled_script_domtrans(system_dbusd_t)
init_start_system(system_dbusd_t) # needed by dbus-broker
+# for powerdevil /usr/lib/x86_64-linux-gnu/libexec/kauth/*
+libs_exec_lib_files(system_dbusd_t)
+
logging_send_audit_msgs(system_dbusd_t)
logging_send_syslog_msg(system_dbusd_t)
Index: refpolicy-2.20180211/policy/modules/contrib/devicekit.te
===================================================================
--- refpolicy-2.20180211.orig/policy/modules/contrib/devicekit.te
+++ refpolicy-2.20180211/policy/modules/contrib/devicekit.te
@@ -194,6 +194,11 @@ optional_policy(`
')
optional_policy(`
+ # gwenview triggers the need for this
+ xserver_dbus_chat_xdm(devicekit_disk_t)
+')
+
+optional_policy(`
virt_manage_images(devicekit_disk_t)
')
@@ -287,6 +292,7 @@ optional_policy(`
optional_policy(`
dbus_system_bus_client(devicekit_power_t)
+ init_dbus_chat(devicekit_power_t)
allow devicekit_power_t devicekit_t:dbus send_msg;
Index: refpolicy-2.20180211/policy/modules/system/init.te
===================================================================
--- refpolicy-2.20180211.orig/policy/modules/system/init.te
+++ refpolicy-2.20180211/policy/modules/system/init.te
@@ -509,6 +509,7 @@ optional_policy(`
optional_policy(`
unconfined_domain(init_t)
+ unconfined_dbus_send(init_t)
')
########################################
Index: refpolicy-2.20180211/policy/modules/system/systemd.te
===================================================================
--- refpolicy-2.20180211.orig/policy/modules/system/systemd.te
+++ refpolicy-2.20180211/policy/modules/system/systemd.te
@@ -308,6 +308,7 @@ systemd_log_parse_environment(systemd_ho
optional_policy(`
dbus_connect_system_bus(systemd_hostnamed_t)
dbus_system_bus_client(systemd_hostnamed_t)
+ init_dbus_chat(systemd_hostnamed_t)
')
optional_policy(`
@@ -450,6 +451,8 @@ userdom_delete_all_user_runtime_files(sy
userdom_delete_all_user_runtime_named_pipes(systemd_logind_t)
userdom_delete_all_user_runtime_named_sockets(systemd_logind_t)
userdom_delete_all_user_runtime_symlinks(systemd_logind_t)
+# user_tmp_t is for the dbus-1 directory
+userdom_list_user_tmp(systemd_logind_t)
userdom_manage_user_runtime_dirs(systemd_logind_t)
userdom_manage_user_runtime_root_dirs(systemd_logind_t)
userdom_mounton_user_runtime_dirs(systemd_logind_t)
@@ -482,6 +485,9 @@ optional_policy(`
optional_policy(`
networkmanager_dbus_chat(systemd_logind_t)
')
+optional_policy(`
+ modemmanager_dbus_chat(systemd_logind_t)
+')
optional_policy(`
policykit_dbus_chat(systemd_logind_t)
@@ -753,6 +759,10 @@ optional_policy(`
')
optional_policy(`
+ unconfined_dbus_send(systemd_machined_t)
+')
+
+optional_policy(`
virt_manage_virt_content(systemd_nspawn_t)
')
Index: refpolicy-2.20180211/policy/modules/contrib/networkmanager.te
===================================================================
--- refpolicy-2.20180211.orig/policy/modules/contrib/networkmanager.te
+++ refpolicy-2.20180211/policy/modules/contrib/networkmanager.te
@@ -222,6 +222,7 @@ optional_policy(`
optional_policy(`
dbus_system_domain(NetworkManager_t, NetworkManager_exec_t)
+ init_dbus_chat(NetworkManager_t)
optional_policy(`
avahi_dbus_chat(NetworkManager_t)
Index: refpolicy-2.20180211/policy/modules/system/locallogin.te
===================================================================
--- refpolicy-2.20180211.orig/policy/modules/system/locallogin.te
+++ refpolicy-2.20180211/policy/modules/system/locallogin.te
@@ -138,6 +138,7 @@ userdom_create_all_users_keys(local_logi
ifdef(`init_systemd',`
auth_manage_faillog(local_login_t)
+ init_dbus_chat(local_login_t)
systemd_dbus_chat_logind(local_login_t)
systemd_use_logind_fds(local_login_t)
systemd_manage_logind_pid_pipes(local_login_t)
Index: refpolicy-2.20180211/policy/modules/admin/usermanage.te
===================================================================
--- refpolicy-2.20180211.orig/policy/modules/admin/usermanage.te
+++ refpolicy-2.20180211/policy/modules/admin/usermanage.te
@@ -252,6 +252,10 @@ userdom_use_unpriv_users_fds(groupadd_t)
userdom_dontaudit_search_user_home_dirs(groupadd_t)
optional_policy(`
+ dbus_system_bus_client(groupadd_t)
+')
+
+optional_policy(`
dpkg_use_fds(groupadd_t)
dpkg_rw_pipes(groupadd_t)
')
@@ -538,6 +542,10 @@ optional_policy(`
')
optional_policy(`
+ dbus_system_bus_client(useradd_t)
+')
+
+optional_policy(`
dpkg_use_fds(useradd_t)
dpkg_rw_pipes(useradd_t)
')
Index: refpolicy-2.20180211/policy/modules/system/unconfined.te
===================================================================
--- refpolicy-2.20180211.orig/policy/modules/system/unconfined.te
+++ refpolicy-2.20180211/policy/modules/system/unconfined.te
@@ -116,6 +116,10 @@ optional_policy(`
')
optional_policy(`
+ modemmanager_dbus_chat(unconfined_t)
+')
+
+optional_policy(`
modutils_run(unconfined_t, unconfined_r)
')
next reply other threads:[~2018-02-13 0:36 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-02-13 0:36 Russell Coker [this message]
2018-02-15 21:57 ` [refpolicy] [PATCH] misc dbus patches Chris PeBenito
2018-02-16 6:04 ` Russell Coker
2018-02-23 4:53 ` Russell Coker
2018-02-23 7:25 ` Dominick Grift
2018-02-24 14:18 ` Chris PeBenito
2018-02-24 14:27 ` Dominick Grift
2018-02-24 15:35 ` Dominick Grift
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20180213003649.GA17327@xev \
--to=russell@coker.com.au \
--cc=refpolicy@oss.tresys.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.