From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-15.8 required=3.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER, INCLUDES_PATCH,MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7CF39C433DB for ; Tue, 12 Jan 2021 10:33:59 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 33F9A22D05 for ; Tue, 12 Jan 2021 10:33:59 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2390879AbhALKdn (ORCPT ); Tue, 12 Jan 2021 05:33:43 -0500 Received: from smtp.sws.net.au ([46.4.88.250]:44014 "EHLO smtp.sws.net.au" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2390497AbhALKdn (ORCPT ); Tue, 12 Jan 2021 05:33:43 -0500 Received: from xev.coker.com.au (localhost [127.0.0.1]) by smtp.sws.net.au (Postfix) with ESMTP id C47CE13AF3 for ; Tue, 12 Jan 2021 21:33:00 +1100 (AEDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=coker.com.au; s=2008; t=1610447581; bh=tWdX7TX3tFc6giaLIen3kXGTEHzfQnS3x684jOrERRM=; l=2077; h=Date:From:To:Subject:From; b=J7g6hNtSNJdWUkSERqn2lEG7jyXk27uwaWZIahBk0Q40KmyDYGPyzS7gMwYo+Vwyf RIMOvtnjqjsPKlKJhTiaYWBjJyNOkyjaseKPFQn/4OjqPxNnlTdIbG/90GN6b/QS8Y /+pG+zeKFC6OJnqit+xEAmoanGWHb0ttTjq5cjH4= Received: by xev.coker.com.au (Postfix, from userid 1001) id A866412ECFE7; Tue, 12 Jan 2021 21:32:56 +1100 (AEDT) Date: Tue, 12 Jan 2021 21:32:56 +1100 From: Russell Coker To: selinux-refpolicy@vger.kernel.org Subject: [PATCH] yet more strict patches Message-ID: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Precedence: bulk List-ID: X-Mailing-List: selinux-refpolicy@vger.kernel.org More little strict patches, much of which are needed for KDE. Signed-off-by: Russell Coker Index: refpolicy-2.20201210/policy/modules/system/userdomain.if =================================================================== --- refpolicy-2.20201210.orig/policy/modules/system/userdomain.if +++ refpolicy-2.20201210/policy/modules/system/userdomain.if @@ -115,12 +115,16 @@ template(`userdom_base_user_template',` libs_exec_ld_so($1_t) + logging_send_syslog_msg($1_t) + miscfiles_read_localization($1_t) miscfiles_read_generic_certs($1_t) miscfiles_watch_fonts_dirs($1_t) sysnet_read_config($1_t) + userdom_write_all_user_runtime_named_sockets($1_t) + # kdeinit wants systemd status init_get_system_status($1_t) @@ -880,6 +884,10 @@ template(`userdom_common_user_template', ') optional_policy(` + udev_read_runtime_files($1_t) + ') + + optional_policy(` usernetctl_run($1_t, $1_r) ') @@ -1231,6 +1239,15 @@ template(`userdom_unpriv_user_template', optional_policy(` systemd_dbus_chat_logind($1_t) + systemd_use_logind_fds($1_t) + systemd_dbus_chat_hostnamed($1_t) + systemd_write_inherited_logind_inhibit_pipes($1_t) + + # kwalletd5 inherits a socket from init + init_rw_inherited_stream_socket($1_t) + init_use_fds($1_t) + # for polkit-kde-auth + init_read_state($1_t) ') # Allow controlling usbguard @@ -3617,6 +3634,25 @@ interface(`userdom_delete_all_user_runti ') ######################################## +## +## write user runtime socket files +## +## +## +## Domain allowed access. +## +## +# +interface(`userdom_write_all_user_runtime_named_sockets',` + gen_require(` + attribute user_runtime_content_type; + ') + + allow $1 user_runtime_content_type:dir list_dir_perms; + allow $1 user_runtime_content_type:sock_file write; +') + +######################################## ## ## Create objects in the pid directory ## with an automatic type transition to