From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-15.8 required=3.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER, INCLUDES_PATCH,MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1933FC433E0 for ; Thu, 14 Jan 2021 23:38:17 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id DF96523107 for ; Thu, 14 Jan 2021 23:38:16 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1731036AbhANXiI (ORCPT ); Thu, 14 Jan 2021 18:38:08 -0500 Received: from smtp.sws.net.au ([46.4.88.250]:49342 "EHLO smtp.sws.net.au" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727838AbhANXiI (ORCPT ); Thu, 14 Jan 2021 18:38:08 -0500 Received: from xev.coker.com.au (localhost [127.0.0.1]) by smtp.sws.net.au (Postfix) with ESMTP id 1D71E160FD for ; Fri, 15 Jan 2021 10:37:26 +1100 (AEDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=coker.com.au; s=2008; t=1610667446; bh=VkdI+nbIQiM7dgi2Df5pCKaKShohoJQcc8K+a5Gx4O8=; l=1738; h=Date:From:To:Subject:From; b=P1AAq9IwATq8XQefBwcpv1BzyxlafOq1pumvmdusCVCe3HeDaXFo22f1gfGbZKC+D yLc2j+JLF816omOVU6WqhlvFCp6xddV7zQRK+28MEhOgvPnJ7TwjnuxhdFgOR0RjHs yyPZj2b1mkCEUvfUA6q0MDuH5szVjFEE6n/QHmy0= Received: by xev.coker.com.au (Postfix, from userid 1001) id A4DF012F979B; Fri, 15 Jan 2021 10:37:20 +1100 (AEDT) Date: Fri, 15 Jan 2021 10:37:20 +1100 From: Russell Coker To: selinux-refpolicy@vger.kernel.org Subject: [PATCH] yet more strict patches fixed Message-ID: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Precedence: bulk List-ID: X-Mailing-List: selinux-refpolicy@vger.kernel.org More little strict patches, much of which are needed for KDE. With the lines that Chris didn't like removed. Signed-off-by: Russell Coker Index: refpolicy-2.20210115/policy/modules/system/userdomain.if =================================================================== --- refpolicy-2.20210115.orig/policy/modules/system/userdomain.if +++ refpolicy-2.20210115/policy/modules/system/userdomain.if @@ -880,6 +880,10 @@ template(`userdom_common_user_template', ') optional_policy(` + udev_read_runtime_files($1_t) + ') + + optional_policy(` usernetctl_run($1_t, $1_r) ') @@ -1231,6 +1235,15 @@ template(`userdom_unpriv_user_template', optional_policy(` systemd_dbus_chat_logind($1_t) + systemd_use_logind_fds($1_t) + systemd_dbus_chat_hostnamed($1_t) + systemd_write_inherited_logind_inhibit_pipes($1_t) + + # kwalletd5 inherits a socket from init + init_rw_inherited_stream_socket($1_t) + init_use_fds($1_t) + # for polkit-kde-auth + init_read_state($1_t) ') # Allow controlling usbguard @@ -3617,6 +3630,25 @@ interface(`userdom_delete_all_user_runti ') ######################################## +## +## write user runtime socket files +## +## +## +## Domain allowed access. +## +## +# +interface(`userdom_write_all_user_runtime_named_sockets',` + gen_require(` + attribute user_runtime_content_type; + ') + + allow $1 user_runtime_content_type:dir list_dir_perms; + allow $1 user_runtime_content_type:sock_file write; +') + +######################################## ## ## Create objects in the pid directory ## with an automatic type transition to