From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-5.8 required=3.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI, SPF_HELO_NONE,SPF_PASS autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 00C32C433DB for ; Thu, 24 Dec 2020 08:49:14 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id AC9B7223E4 for ; Thu, 24 Dec 2020 08:49:14 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726347AbgLXItO (ORCPT ); Thu, 24 Dec 2020 03:49:14 -0500 Received: from agnus.defensec.nl ([80.100.19.56]:54592 "EHLO agnus.defensec.nl" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726266AbgLXItO (ORCPT ); Thu, 24 Dec 2020 03:49:14 -0500 X-Greylist: delayed 630 seconds by postgrey-1.27 at vger.kernel.org; Thu, 24 Dec 2020 03:49:14 EST Received: from brutus (brutus.defensec.nl [IPv6:2001:985:d55d::438]) by agnus.defensec.nl (Postfix) with ESMTPSA id DF4822A12DC; Thu, 24 Dec 2020 09:37:57 +0100 (CET) DKIM-Filter: OpenDKIM Filter v2.11.0 agnus.defensec.nl DF4822A12DC DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=defensec.nl; s=default; t=1608799082; bh=or3yDtyiFy911iE7Z03rNI7fPIB0q6Ro7zucw37alFQ=; h=From:To:Cc:Subject:References:Date:In-Reply-To:From; b=P0EaJk1km0L+HCD5KcCX1sRSOl/D0c24or4tYuxSWuz1X3j6ygVBENOVKt/MW34cL xIPLlK2l5MShykocLszVMy+ZXGkIQRgyF2O5LMYVlIDxFmq+gUuHIGf9qTGcL3xc5x fPiuv96ief+/TzPygyWK70e97NXvGfwxaRceG9m0= From: Dominick Grift To: Russell Coker Cc: selinux-refpolicy@vger.kernel.org Subject: Re: machinectl shell policy References: <8322849.62pqQp6Oog@liv> Date: Thu, 24 Dec 2020 09:37:50 +0100 In-Reply-To: <8322849.62pqQp6Oog@liv> (Russell Coker's message of "Thu, 24 Dec 2020 09:18:14 +1100") Message-ID: User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/27.1 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain Precedence: bulk List-ID: X-Mailing-List: selinux-refpolicy@vger.kernel.org Russell Coker writes: > allow sysadm_t systemd_machined_t:dbus send_msg; > systemd_manage_userdb_runtime_dirs(systemd_machined_t) > systemd_manage_userdb_runtime_sock_files(systemd_machined_t) > term_use_ptmx(systemd_machined_t) > dev_getattr_fs(systemd_machined_t) > term_getattr_pty_fs(systemd_machined_t) > > To enable "machinectl shell" on recent versions of systemd we need something > like the above policy (which is not complete or ideal, still doesn't work so > no point polishing it) and something for the below. What is the below about? this should be thoroughly addressed. machined creates a login pty that gets relabeled on login as per type_change rules. > > type=USER_AVC msg=audit(1608759091.934:1799): pid=324 uid=108 auid=4294967295 > ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc: > denied { 0x2 } for msgtype=error > error_name=org.freedesktop.DBus.Error.FileNotFound dest=:1.18 spid=2642 > tpid=2706 scontext=system_u:system_r:systemd_machined_t:s0 > tcontext=bofh:sysadm_r:sysadm_t:s0-s0:c0.c1023 tclass=(null) permissive=0 > exe="/usr/bin/dbus-daemon" sauid=108 hostname=? addr=? > terminal=?'UID="messagebus" AUID="unset" SAUID="messagebus" Yes i noticed the above as well on debian with dbus-daemon, i dont see any of these on fedora with dbus-broker By the way we probably shouldnt use the same dbus policy for both dbus-daemon and dbus-broker because theyre pretty different. * dbus-broker does not check method returns (dbus-daemon does) * dbus-broker is systemd specific (dbus activation works via systemd) -- gpg --locate-keys dominick.grift@defensec.nl Key fingerprint = FCD2 3660 5D6B 9D27 7FC6 E0FF DA7E 521F 10F6 4098 https://sks-keyservers.net/pks/lookup?op=get&search=0xDA7E521F10F64098 Dominick Grift