Re: mpv and kitty terminal emulator on Wayland

[Dominick Grift <dominick.grift@defensec.nl>]

Russell Coker <russell@coker.com.au> writes:

> When a paste operation is triggered (middle click on video window) mpv is 
> having it's file handle sent to kitty, presumably by the wayland system (KDE 
> in this case).
>
> Denying this access can cause the source of the paste data (kitty in this 
> case) to crash.  Here's the logs for kitty:
>
> type=AVC msg=audit(1784959694.829:20780): avc:  denied  { use } for  pid=4712 
> comm="kitty" path="pipe:[150412]" dev="pipefs" ino=150412 
> scontext=etbe:user_r:user_t:s0-s0:c0.c1023 tcontext=etbe:user_r:mplayer_t:s0-
> s0:c0.c1023 tclass=fd permissive=0
> type=AVC msg=audit(1784959694.861:20787): avc:  denied  { use } for  pid=4282 
> comm="QThread" path="pipe:[149316]" dev="pipefs" ino=149316 
> scontext=etbe:user_r:user_t:s0-s0:c0.c1023 tcontext=etbe:user_r:mplayer_t:s0-
> s0:c0.c1023 tclass=fd permissive=0
> type=AVC msg=audit(1784959851.794:22406): avc:  denied  { use } for  pid=17365 
> comm="kitty" path="pipe:[166960]" dev="pipefs" ino=166960 
> scontext=etbe:user_r:user_t:s0-s0:c0.c1023 tcontext=etbe:user_r:mplayer_t:s0-
> s0:c0.c1023 tclass=fd permissive=0
> type=AVC msg=audit(1784959851.822:22409): avc:  denied  { use } for  pid=16312 
> comm="WaylandEventThr" path="pipe:[164719]" dev="pipefs" ino=164719 
> scontext=etbe:user_r:user_t:s0-s0:c0.c1023 tcontext=etbe:user_r:mplayer_t:s0-
> s0:c0.c1023 tclass=fd permissive=0
> type=AVC msg=audit(1784959876.318:22422): avc:  denied  { use } for  pid=10585 
> comm="kitty" path="pipe:[165833]" dev="pipefs" ino=165833 
> scontext=etbe:user_r:user_t:s0-s0:c0.c1023 tcontext=etbe:user_r:mplayer_t:s0-
> s0:c0.c1023 tclass=fd permissive=0
>
> Here's the errors from Kitty:
> file descriptor expected, object (52), message send(sh)
> [7.945] [glfw error 65544]: Wayland: fatal display error: Invalid argument
>
> Here's the errors from Konsole:
> file descriptor expected, object (66), message send(sh)
> The Wayland connection experienced a fatal error: Invalid argument
>
> Here's the logs when the fd use is allowed:
>
> type=AVC msg=audit(1784960913.928:24443): avc:  denied  { write } for  
> pid=25743 comm="WaylandEventThr" path="pipe:[188207]" dev="pipefs" ino=188207 
> scontext=etbe:user_r:user_t:s0-s0:c0.c1023 tcontext=etbe:user_r:mplayer_t:s0-
> s0:c0.c1023 tclass=fifo_file permissive=0
> type=AVC msg=audit(1784960913.964:24444): avc:  denied  { write } for  
> pid=24950 comm="QThread" path="pipe:[190614]" dev="pipefs" ino=190614 
> scontext=etbe:user_r:user_t:s0-s0:c0.c1023 tcontext=etbe:user_r:mplayer_t:s0-
> s0:c0.c1023 tclass=fifo_file permissive=0
>
> So it looks that for Wayland to work in the expected manner without programs 
> crashing all the time we need to allow every Wayland client domain to use a fd 
> from every other domain and to have fifo_file rw_inherited_fifo_file_perms 
> access.

According to what I have write_inherited_fifo_file_perms might be
enough:

# sesearch -A -s wlroots.client.typeattr -t wlroots.client.typeattr -ds
allow wlroots.client.typeattr wlroots.client.typeattr:fd use;
allow wlroots.client.typeattr wlroots.client.typeattr:fifo_file { append
getattr ioctl lock write };


>
> Would it be possible to have a SE Linux aware clipboard program to mediate 
> this?

-- 
gpg --auto-key-locate clear,nodefault,wkd --locate-external-keys dominick.grift@defensec.nl
Key fingerprint = FCD2 3660 5D6B 9D27 7FC6  E0FF DA7E 521F 10F6 4098
Dominick Grift
Mastodon: @kcinimod@defensec.nl