Running strict/enforcing, latest Rawhide....
X fails to come up, etc.
Looks like allow XXXX udev_tdb_t:dir r_dir_perms; is needed pretty generally, especially for xdm_t, xdm_server_t, ptal_t, pam_console_t, lvm_t, hald_t, gpm_t, cupsd_t. Even user_t seems to want it for configuring esd.
Should this be added to macros somewhere?
tom
Tom London wrote:
Running strict/enforcing, latest Rawhide....
X fails to come up, etc.
Looks like allow XXXX udev_tdb_t:dir r_dir_perms; is needed pretty generally, especially for xdm_t, xdm_server_t, ptal_t, pam_console_t, lvm_t, hald_t, gpm_t, cupsd_t. Even user_t seems to want it for configuring esd.
Should this be added to macros somewhere?
tom
Does this solve the problem?
diff -u global_macros.te~ global_macros.te --- global_macros.te~ 2004-12-22 11:18:14.000000000 -0500 +++ global_macros.te 2004-12-22 12:56:43.883461279 -0500 @@ -242,7 +242,7 @@ allow $1_t { self proc_t }:dir r_dir_perms; allow $1_t { self proc_t }:lnk_file read;
-allow $1_t device_t:dir { getattr search }; +r_dir_file($1_t, device_t) allow $1_t null_device_t:chr_file rw_file_perms; dontaudit $1_t console_device_t:chr_file rw_file_perms; dontaudit $1_t unpriv_userdomain:fd use;
On Wed, 22 Dec 2004 12:58:23 -0500, Daniel J Walsh dwalsh@redhat.com wrote:
Tom London wrote:
Does this solve the problem?
diff -u global_macros.te~ global_macros.te --- global_macros.te~ 2004-12-22 11:18:14.000000000 -0500 +++ global_macros.te 2004-12-22 12:56:43.883461279 -0500 @@ -242,7 +242,7 @@ allow $1_t { self proc_t }:dir r_dir_perms; allow $1_t { self proc_t }:lnk_file read;
-allow $1_t device_t:dir { getattr search }; +r_dir_file($1_t, device_t) allow $1_t null_device_t:chr_file rw_file_perms; dontaudit $1_t console_device_t:chr_file rw_file_perms; dontaudit $1_t unpriv_userdomain:fd use;
Dan,
I'm at work, so I'll test this later.
Since the AVCs had read/getattr denials for udev_tdb_t (not device_t), I would think that we would need a fix like this:
+r_dir_file($1_t, { device_t udev_tdb_t })
Am I missing something obvious?
tom
Tom London wrote:
On Wed, 22 Dec 2004 12:58:23 -0500, Daniel J Walsh dwalsh@redhat.com wrote:
Tom London wrote:
Does this solve the problem?
diff -u global_macros.te~ global_macros.te --- global_macros.te~ 2004-12-22 11:18:14.000000000 -0500 +++ global_macros.te 2004-12-22 12:56:43.883461279 -0500 @@ -242,7 +242,7 @@ allow $1_t { self proc_t }:dir r_dir_perms; allow $1_t { self proc_t }:lnk_file read;
-allow $1_t device_t:dir { getattr search }; +r_dir_file($1_t, device_t) allow $1_t null_device_t:chr_file rw_file_perms; dontaudit $1_t console_device_t:chr_file rw_file_perms; dontaudit $1_t unpriv_userdomain:fd use;
Dan,
I'm at work, so I'll test this later.
Since the AVCs had read/getattr denials for udev_tdb_t (not device_t), I would think that we would need a fix like this:
+r_dir_file($1_t, { device_t udev_tdb_t })
Am I missing something obvious?
tom
No but I am :^) r_dir_file($1_t, udev_tdb_t) is probably sufficient
On Wed, 22 Dec 2004 13:52:36 -0500, Daniel J Walsh dwalsh@redhat.com wrote:
No but I am :^) r_dir_file($1_t, udev_tdb_t) is probably sufficient
Dan,
Sorry, but that didn't quite work.
Here's what seems to get rhgb and X running again:
global_macros.te: allow $1_t { self proc_t }:dir r_dir_perms; allow $1_t { self proc_t }:lnk_file read;
+allow $1_t { device_t udev_tdb_t }:dir { getattr search }; allow $1_t null_device_t:chr_file rw_file_perms; dontaudit $1_t console_device_t:chr_file rw_file_perms; dontaudit $1_t unpriv_userdomain:fd use;
udev.te: allow udev_t etc_t:file ioctl; ifdef(`xdm.te', ` allow udev_t xdm_var_run_t:file { getattr read }; +allow xdm_xserver_t udev_tdb_t:dir r_dir_perms; ')
However, still get lots of AVCs for udev_tdb_t for lvm_t, pam_console_t, ptal_t, xdm_t, and user_t
Does it make sense to add it base_user_domain()? full_user_role()? (they already has access to device_t). daemon_base_domain()?
[I'm sure I'm making this too complicated, but I'm trying to avoide adding an 'allow ... udev_tdb_t:dir' to each seperate .te file .....]
tom
On Thursday 23 December 2004 15:12, Tom London selinux@gmail.com wrote:
Here's what seems to get rhgb and X running again:
global_macros.te: allow $1_t { self proc_t }:dir r_dir_perms; allow $1_t { self proc_t }:lnk_file read;
+allow $1_t { device_t udev_tdb_t }:dir { getattr search };
The problem is that the directory should have type device_t not udev_tdb_t. The recent trend has been to label all directories under /dev as device_t.
-file_type_auto_trans(udev_t, device_t, udev_tdb_t, { file dir }) +file_type_auto_trans(udev_t, device_t, udev_tdb_t, file)
If the above change is made to udev.te and the below change is made to udev.fc then everything will work well. This is the easiest and simplest change that preserves expected functionality.
-/dev/.udev.tdb(/.*)? system_u:object_r:udev_tdb_t +/dev/.udev.tdb/.* -- system_u:object_r:udev_tdb_t
I assume that the file names in directory /dev/.udev.tdb don't give anything away - otherwise the directory surely wouldn't have mode 0755...
On Thu, 23 Dec 2004 21:36:42 +1100, Russell Coker russell@coker.com.au wrote:
On Thursday 23 December 2004 15:12, Tom London selinux@gmail.com wrote:
Here's what seems to get rhgb and X running again:
global_macros.te: allow $1_t { self proc_t }:dir r_dir_perms; allow $1_t { self proc_t }:lnk_file read;
+allow $1_t { device_t udev_tdb_t }:dir { getattr search };
The problem is that the directory should have type device_t not udev_tdb_t. The recent trend has been to label all directories under /dev as device_t.
-file_type_auto_trans(udev_t, device_t, udev_tdb_t, { file dir }) +file_type_auto_trans(udev_t, device_t, udev_tdb_t, file)
If the above change is made to udev.te and the below change is made to udev.fc then everything will work well. This is the easiest and simplest change that preserves expected functionality.
-/dev/.udev.tdb(/.*)? system_u:object_r:udev_tdb_t +/dev/.udev.tdb/.* -- system_u:object_r:udev_tdb_t
I assume that the file names in directory /dev/.udev.tdb don't give anything away - otherwise the directory surely wouldn't have mode 0755...
--
Russell, Dan,
Yes, this fixes it, even the user_t accesses.
Thanks!
tom
selinux@lists.fedoraproject.org