Re: gnome-screensav AVCs

[Daniel J Walsh <dwalsh@redhat.com>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Christopher J. PeBenito wrote:
> On Tue, 2008-06-17 at 13:28 -0500, Ted X Toth wrote:
>> Christopher J. PeBenito wrote:
>>> On Tue, 2008-06-17 at 10:55 -0500, Xavier Toth wrote:
>>>> On Tue, Jun 17, 2008 at 10:39 AM, Christopher J. PeBenito
>>>> <cpebenito@tresys.com> wrote:
>>>>     
>>>>> On Tue, 2008-06-17 at 09:46 -0500, Xavier Toth wrote:
>>>>>       
>>>>>> I'm seeing AVCs related to netlink_audit_socket when the screen saver
>>>>>> dialog is run. gnome-screensaver-dialog opens a pam session which uses
>>>>>> pam_unix which in turn runs the unix_chkpwd helper. I'm thinking that
>>>>>> gnome-screensaver-dialog is going to need some policy including
>>>>>> possibly authlogin_common_auth_domain_template.
>>>>>>         
>>>>> I'm not 100% clear, is the auditing happening from unix_chkpwd or the
>>>>> screensaver proper?
>>>>>
>>>>>       
>>>> I'm sure that it is unix_chkpwd that is auditing and not
>>>> gnome-screensaver-dialog.
>>>>     
>>> Is gnome-screensaver-dialog not running the user domain?
>> I believe this is true.
>>
>>>   I would have
>>> expected that it was, and that when unix_chkpwd is run, that it
>>> transitions to *_unix_chkpwd_t, which should be able to send audit
>>> messages.
>>>
>>>   
>> You know policy better than I, where is the policy for this?
> 
> In authlogin_per_role_template():
> 
> 	role $3 types $1_chkpwd_t;
> 
> 	# Transition from the user domain to this domain.
> 	domtrans_pattern($2,chkpwd_exec_t,$1_chkpwd_t)
> 
Gnome-clock and other policies are to cover

policykit/hal/dbus interaction where the system debus is doing things on
behalf of the logged in user.  In this case the latest gnome clock
allows a user to specify the timezone that he is in, as well as change
the time.  So we want policy on the script that is execed by dbus for
the user.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org

iEYEARECAAYFAkhtODQACgkQrlYvE4MpobPgoQCgtXmqEsGaexePJMro55Vb6/Db
oRMAnjRW/GTMEIiBTyGPW/74vB4ZRnvT
=JNQd
-----END PGP SIGNATURE-----

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.