From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9440CC433F5 for ; Mon, 25 Apr 2022 17:04:22 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230012AbiDYRHZ (ORCPT ); Mon, 25 Apr 2022 13:07:25 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:48916 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242850AbiDYRHZ (ORCPT ); Mon, 25 Apr 2022 13:07:25 -0400 X-Greylist: delayed 393 seconds by postgrey-1.37 at lindbergh.monkeyblade.net; Mon, 25 Apr 2022 10:04:19 PDT Received: from markus.defensec.nl (markus.defensec.nl [45.80.168.93]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id F15C93B001 for ; Mon, 25 Apr 2022 10:04:19 -0700 (PDT) Received: from brutus (brutus.lan [IPv6:2a10:3781:2099::438]) by markus.defensec.nl (Postfix) with ESMTPSA id D119AFC13B6 for ; Mon, 25 Apr 2022 18:57:43 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=defensec.nl; s=default; t=1650905864; bh=5Tocw9Gvo8bekRhhovgWQQWI2YiD1GmRBrjBNlujdTM=; h=From:To:Subject:Reply-To:Date:From; b=ZYX8k4hJwxj2WFzCZ5gG+XmvItBV1WzqE7RWL9yRO0wIRiO/86kNwCDHbd9GJlxei e/XRqQ5KQ1K3ADaQi/RYtG/x+z4hdTGqy8WwFVq6GVbLvaK5W2kpqY1IjYU6PEsLWu AwfqlsaL4YzoVMdnQYyVyA9CSz6DKjheIDZF2M/0= From: Dominick Grift To: selinux-refpolicy@vger.kernel.org Subject: Re: [PATCH] new sddm pam patch Reply-To: Date: Mon, 25 Apr 2022 18:57:42 +0200 Message-ID: <875ymx5ce1.fsf@defensec.nl> User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/27.1 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain Precedence: bulk List-ID: X-Mailing-List: selinux-refpolicy@vger.kernel.org These desktop managers have a pam stack and that includes /etc/pam.d/systemd-user which provides the user with a systemd --user instance If you do not add a seuser for these DM-users then their systemd --user instance ends up with system_u:system_r:init_t:s0 (the context of pid1 which creates these systemd --user instances) One possible solution would be if we could add clauses to pam config files like for example: if ! (user sddm) { session ... pam_selinux.so ... } But not sure if something like that is even possible, and even if it was possible, some parts of the DE need selinux in the pam stack (for logging in the user) But yes the main issue is the pam_selinux call in the pam_systemd stack. Ideally we maintain some kind of compatibility with systems that have pam_systemd and ones that do not The alternative way is indeed to create a seuser so that we can tell pam_selinux explicitly to stay is system_r:xdm_t:s0 (so the systemd --user instance for the DE user will run in xdm_t and so all the transitions will be the same whether the DE starts it via systemd --user or manually starts it. -- gpg --locate-keys dominick.grift@defensec.nl Key fingerprint = FCD2 3660 5D6B 9D27 7FC6 E0FF DA7E 521F 10F6 4098 Dominick Grift