Re: selection labeling

Re: selection labeling

[Eamon Walsh]

Christopher J. PeBenito wrote:
> I ran into an interesting denial:
>
> avc:  denied  { setattr setattr } for request=X11:SetSelectionOwner
> comm=dbus-launch
> selection=_DBUS_SESSION_BUS_SELECTION_root_3c39a16f05862d57c3d6ef0047356754
> scontext=root:staff_r:staff_t
> tcontext=system_u:object_r:xselection_t
> tclass=x_selection
>
> Other than the double setattr in the permissions, trying to label this
> selection for anything but the default doesn't seem possible.  It seems
> that this should be type_transitioned, but it didn't seem to work.
>   

Whoops, I know why the double setattr is there.  I'll get that fixed, 
ignore that for now.

We probably need to have wildcarding in the X label support, like the 
way filenames work.  Do you agree?

But I don't have a clue why D-BUS is creating selections with those 
insane names.  It looks like abuse of the selection mechanism to me.  
Selections are used for IPC, hence they're supposed to have fixed, 
standard names.  Actually it doesn't make sense to me that D-BUS is 
using selections at all.

-- 
Eamon Walsh <ewalsh@tycho.nsa.gov>
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: selection labeling

[James Carter]

On Tue, 2008-03-18 at 15:45 -0400, Eamon Walsh wrote:
> Christopher J. PeBenito wrote:
> > I ran into an interesting denial:
> >
> > avc:  denied  { setattr setattr } for request=X11:SetSelectionOwner
> > comm=dbus-launch
> > selection=_DBUS_SESSION_BUS_SELECTION_root_3c39a16f05862d57c3d6ef0047356754
> > scontext=root:staff_r:staff_t
> > tcontext=system_u:object_r:xselection_t
> > tclass=x_selection
> >
> > Other than the double setattr in the permissions, trying to label this
> > selection for anything but the default doesn't seem possible.  It seems
> > that this should be type_transitioned, but it didn't seem to work.
> >   
> 
> Whoops, I know why the double setattr is there.  I'll get that fixed, 
> ignore that for now.
> 
> We probably need to have wildcarding in the X label support, like the 
> way filenames work.  Do you agree?
> 
> But I don't have a clue why D-BUS is creating selections with those 
> insane names.  It looks like abuse of the selection mechanism to me.  
> Selections are used for IPC, hence they're supposed to have fixed, 
> standard names.  Actually it doesn't make sense to me that D-BUS is 
> using selections at all.
> 
The last part is the session bus's unique id.  The id is also set in the
environment variable, DBUS_SESSION_BUS_ADDRESS.

-- 
James Carter <jwcart2@epoch.ncsc.mil>
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: selection labeling

[Christopher J. PeBenito]

On Tue, 2008-03-18 at 15:45 -0400, Eamon Walsh wrote:
> Christopher J. PeBenito wrote:
> > I ran into an interesting denial:
> >
> > avc:  denied  { setattr setattr } for request=X11:SetSelectionOwner
> > comm=dbus-launch
> > selection=_DBUS_SESSION_BUS_SELECTION_root_3c39a16f05862d57c3d6ef0047356754
> > scontext=root:staff_r:staff_t
> > tcontext=system_u:object_r:xselection_t
> > tclass=x_selection
> >
> > Other than the double setattr in the permissions, trying to label this
> > selection for anything but the default doesn't seem possible.  It seems
> > that this should be type_transitioned, but it didn't seem to work.
> >   
> 
> Whoops, I know why the double setattr is there.  I'll get that fixed, 
> ignore that for now.
> 
> We probably need to have wildcarding in the X label support, like the 
> way filenames work.  Do you agree?

This is the role's session bus, not the system bus, so the preference
would be to have a type_transition so the selection would be
staff_dbus_xselection_t.  I don't see how we could get this behavior in
x_contexts except by putting in entries for all of the users, which
would be suboptimal.  Especially since in this case where I logged in as
root/staff_r; I could also log in as root/sysadm_r and then in that case
we have a problem since the label would be wrong in one of those cases.

> But I don't have a clue why D-BUS is creating selections with those 
> insane names.  It looks like abuse of the selection mechanism to me.  
> Selections are used for IPC, hence they're supposed to have fixed, 
> standard names.  Actually it doesn't make sense to me that D-BUS is 
> using selections at all.

-- 
Chris PeBenito
Tresys Technology, LLC
(410) 290-1411 x150


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: selection labeling

[Eamon Walsh]

Christopher J. PeBenito wrote:
> On Tue, 2008-03-18 at 15:45 -0400, Eamon Walsh wrote:
>   
>> Christopher J. PeBenito wrote:
>>     
>>> I ran into an interesting denial:
>>>
>>> avc:  denied  { setattr setattr } for request=X11:SetSelectionOwner
>>> comm=dbus-launch
>>> selection=_DBUS_SESSION_BUS_SELECTION_root_3c39a16f05862d57c3d6ef0047356754
>>> scontext=root:staff_r:staff_t
>>> tcontext=system_u:object_r:xselection_t
>>> tclass=x_selection
>>>
>>> Other than the double setattr in the permissions, trying to label this
>>> selection for anything but the default doesn't seem possible.  It seems
>>> that this should be type_transitioned, but it didn't seem to work.
>>>   
>>>       
>> Whoops, I know why the double setattr is there.  I'll get that fixed, 
>> ignore that for now.
>>
>> We probably need to have wildcarding in the X label support, like the 
>> way filenames work.  Do you agree?
>>     
>
> This is the role's session bus, not the system bus, so the preference
> would be to have a type_transition so the selection would be
> staff_dbus_xselection_t.  I don't see how we could get this behavior in
> x_contexts except by putting in entries for all of the users, which
> would be suboptimal.  Especially since in this case where I logged in as
> root/staff_r; I could also log in as root/sysadm_r and then in that case
> we have a problem since the label would be wrong in one of those cases.
>
>   


Two thoughts:

1. Do this through D-BUS not X, by modifying the D-BUS daemon to set the 
selection create context when it creates these selections.

or better yet:

2. Fix D-BUS to provide some other way for people to find out the name 
of the session bus (if that's what in fact this is for, which I'm still 
unclear on).  Like maybe through a D-BUS service.


-- 
Eamon Walsh <ewalsh@tycho.nsa.gov>
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.