From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 8E128C433EF for ; Sun, 27 Mar 2022 11:43:00 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230431AbiC0Loh (ORCPT ); Sun, 27 Mar 2022 07:44:37 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:53298 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229922AbiC0Loh (ORCPT ); Sun, 27 Mar 2022 07:44:37 -0400 Received: from smtp.sws.net.au (smtp.sws.net.au [IPv6:2a01:4f8:201:1e6::dada:cafe]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 6EB1148324 for ; Sun, 27 Mar 2022 04:42:58 -0700 (PDT) Received: from xev.coker.com.au (localhost [127.0.0.1]) by smtp.sws.net.au (Postfix) with ESMTP id 48732EBB8; Sun, 27 Mar 2022 22:42:55 +1100 (AEDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=coker.com.au; s=2008; t=1648381375; bh=GdL+EvQ4VLH3rmBy5aHX91qOvxV5aiacNMQrW9YYcUM=; l=1111; h=From:To:Reply-To:Subject:Date:In-Reply-To:References:From; b=pybZgMPvc0/GV3jZc3R/UKuIfols3y+b5Ru37fh+71lOvj2swTFh39fSGA0j28OR6 ik+gKhJhRMFopGaIF7o2frLVkC0BaOtFkedb0sVvRpLMDXaIK/a6BZuv4xO9X52r4S kGqZWggirN4NGpOQLseOlJJtwLt++fehmK8AOWzA= Received: by xev.coker.com.au (Postfix, from userid 1001) id C5867179CFBE; Sun, 27 Mar 2022 22:42:50 +1100 (AEDT) From: Russell Coker To: selinux-refpolicy@vger.kernel.org, Chris PeBenito Reply-To: russell@coker.com.au Subject: Re: [PATCH] new sddm pam patch Date: Sun, 27 Mar 2022 22:42:50 +1100 Message-ID: <3136581.m74T952WcD@xev> In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: 7Bit Content-Type: text/plain; charset="us-ascii" Precedence: bulk List-ID: X-Mailing-List: selinux-refpolicy@vger.kernel.org On Friday, 18 February 2022 00:48:44 AEDT Chris PeBenito wrote: > > +# for sddm to use pam for greeter, sddm greeter needs execmod > > +allow xdm_t xdm_tmpfs_t:file execmod; > > + > > # Run Xorg.wrap > > can_exec(xserver_t, xserver_exec_t) > > > > Index: refpolicy-2.20220217/config/appconfig-mcs/seusers > > =================================================================== > > --- refpolicy-2.20220217.orig/config/appconfig-mcs/seusers > > +++ refpolicy-2.20220217/config/appconfig-mcs/seusers > > @@ -1,2 +1,3 @@ > > root:unconfined_u:s0-mcs_systemhigh > > __default__:unconfined_u:s0-mcs_systemhigh > > +sddm:xdm:s0 > > Did sddm:system_u fail? Yes, there's several programs that end up in the wrong domains (or try to) if you do that. > If we must have a new seuser, please place it in > the xserver module. The build system supports declaring users in modules. OK, that's in the next version. > The changes for seusers changes for standard and mls are missing. OK, done that too. -- My Main Blog http://etbe.coker.com.au/ My Documents Blog http://doc.coker.com.au/