: patch to allow consolekit shutdown the system
PATCH 11/34 : patch to allow consolekit shutdown the system
This patch adds some permissions needed to shutdown the system using the graphical interface.
policy/modules/services/consolekit.te +4 -0
@@ -118,6 +118,10 @@ optional_policy(` ') optional_policy(` + shutdown_getattr_exec_files(consolekit_t) +') + +optional_policy(` udev_domtrans(consolekit_t) udev_read_db(consolekit_t) udev_signal(consolekit_t)
PATCH 11/34 : patch to allow consolekit shutdown the system
Quoted 7 lines · Guido Trentalancia
This patch adds some permissions needed to shutdown the system using the graphical interface.
diff -pruN -x booleans.conf -x corenetwork.if -x corenetwork.te -x modules.conf refpolicy-git-02022011/policy/modules/services/consolekit.te refpolicy-git-02022011-new/policy/modules/services/consolekit.te
policy/modules/services/consolekit.te optional_policy(` · line 127
Quoted 10 lines
policy/modules/services/consolekit.te +4
-0@@ -118,6 +118,10 @@ optional_policy(` ') optional_policy(` + shutdown_getattr_exec_files(consolekit_t) +') + +optional_policy(` udev_domtrans(consolekit_t) udev_read_db(consolekit_t) udev_signal(consolekit_t)
How does this allow shutdown of the system? It only allows a getattr on the shutdown command.
Signature · 3 lines
Chris PeBenito Tresys Technology, LLC www.tresys.com | oss.tresys.com
PATCH 11/34 : patch to allow consolekit shutdown the system
Quoted 10 lines · Christopher J. PeBenito
Quoted 9 lines · Guido Trentalancia
This patch adds some permissions needed to shutdown the system using the graphical interface.
diff -pruN -x booleans.conf -x corenetwork.if -x corenetwork.te -x modules.conf refpolicy-git-02022011/policy/modules/services/consolekit.te refpolicy-git-02022011-new/policy/modules/services/consolekit.te
policy/modules/services/consolekit.te +0
-0@@ -118,6 +118,10 @@ optional_policy(` ')
Quoted 11 lines
policy/modules/services/consolekit.te optional_policy(` · line 127
Quoted 8 lines
policy/modules/services/consolekit.te +4
-0optional_policy(` + shutdown_getattr_exec_files(consolekit_t) +') + +optional_policy(` udev_domtrans(consolekit_t) udev_read_db(consolekit_t) udev_signal(consolekit_t)How does this allow shutdown of the system? It only allows a getattr on the shutdown command.
Yes, in fact the system shutdown functionality (from Gnome) apparently is not working fine. It's not completing the job.
But there are no other AVC denials apart from that. So perhaps something is broken in Gnome or Consolekit, I didn't manage to investigate further so far (until I get further AVCs it's difficult to say that it's related to the policy).
Regards,
Guido
PATCH 11/34 : patch to allow consolekit shutdown the system
Quoted 23 lines · Guido Trentalancia
Quoted 10 lines · Christopher J. PeBenito
Quoted 9 lines · Guido Trentalancia
This patch adds some permissions needed to shutdown the system using the graphical interface.
diff -pruN -x booleans.conf -x corenetwork.if -x corenetwork.te -x modules.conf refpolicy-git-02022011/policy/modules/services/consolekit.te refpolicy-git-02022011-new/policy/modules/services/consolekit.te
policy/modules/services/consolekit.te +0
-0@@ -118,6 +118,10 @@ optional_policy(` ')Quoted 11 lines
policy/modules/services/consolekit.te optional_policy(` · line 127
Quoted 8 lines
policy/modules/services/consolekit.te +4
-0optional_policy(` + shutdown_getattr_exec_files(consolekit_t) +') + +optional_policy(` udev_domtrans(consolekit_t) udev_read_db(consolekit_t) udev_signal(consolekit_t)How does this allow shutdown of the system? It only allows a getattr on the shutdown command.
Quoted 7 lines
Yes, in fact the system shutdown functionality (from Gnome) apparently is not working fine. It's not completing the job.
But there are no other AVC denials apart from that. So perhaps something is broken in Gnome or Consolekit, I didn't manage to investigate further so far (until I get further AVCs it's difficult to say that it's related to the policy).
Some more insight on this. It's trying to shutdown through a script called ck-system-restart (it belongs to ConsoleKit). Such script is labeled bin_t (located at /usr/lib/ConsoleKit/scripts) and it is just calling /sbin/shutdown. All of this could be initiated for example by gnome-panel (the other possibility would be from gdm when nobody is logged in or the session is locked).
Shall I prepend an strace to shutdown in that script ?
Regards,
Guido
PATCH 11/34 : patch to allow consolekit shutdown the system
In reply to Guido TrentalanciaQuoted 23 lines · Guido Trentalancia
Quoted 10 lines · Christopher J. PeBenito
Quoted 9 lines · Guido Trentalancia
This patch adds some permissions needed to shutdown the system using the graphical interface.
diff -pruN -x booleans.conf -x corenetwork.if -x corenetwork.te -x modules.conf refpolicy-git-02022011/policy/modules/services/consolekit.te refpolicy-git-02022011-new/policy/modules/services/consolekit.te
policy/modules/services/consolekit.te +0
-0@@ -118,6 +118,10 @@ optional_policy(` ')Quoted 11 lines
policy/modules/services/consolekit.te optional_policy(` · line 127
Quoted 8 lines
policy/modules/services/consolekit.te +4
-0optional_policy(` + shutdown_getattr_exec_files(consolekit_t) +') + +optional_policy(` udev_domtrans(consolekit_t) udev_read_db(consolekit_t) udev_signal(consolekit_t)How does this allow shutdown of the system? It only allows a getattr on the shutdown command.
Quoted 7 lines
Yes, in fact the system shutdown functionality (from Gnome) apparently is not working fine. It's not completing the job.
But there are no other AVC denials apart from that. So perhaps something is broken in Gnome or Consolekit, I didn't manage to investigate further so far (until I get further AVCs it's difficult to say that it's related to the policy).
There may be things that are dontaudited that need to be allowed.
Signature · 3 lines
Chris PeBenito Tresys Technology, LLC www.tresys.com | oss.tresys.com
PATCH 11/34 : patch to allow consolekit shutdown the system
Quoted 27 lines · Christopher J. PeBenito
Quoted 26 lines · Guido Trentalancia
Quoted 10 lines · Christopher J. PeBenito
Quoted 9 lines · Guido Trentalancia
This patch adds some permissions needed to shutdown the system using the graphical interface.
diff -pruN -x booleans.conf -x corenetwork.if -x corenetwork.te -x modules.conf refpolicy-git-02022011/policy/modules/services/consolekit.te refpolicy-git-02022011-new/policy/modules/services/consolekit.te
policy/modules/services/consolekit.te +0
-0@@ -118,6 +118,10 @@ optional_policy(` ')Quoted 11 lines
policy/modules/services/consolekit.te optional_policy(` · line 127
Quoted 8 lines
policy/modules/services/consolekit.te +4
-0optional_policy(` + shutdown_getattr_exec_files(consolekit_t) +') + +optional_policy(` udev_domtrans(consolekit_t) udev_read_db(consolekit_t) udev_signal(consolekit_t)How does this allow shutdown of the system? It only allows a getattr on the shutdown command.
Yes, in fact the system shutdown functionality (from Gnome) apparently is not working fine. It's not completing the job.
Quoted 6 lines
Quoted 4 lines
But there are no other AVC denials apart from that. So perhaps something is broken in Gnome or Consolekit, I didn't manage to investigate further so far (until I get further AVCs it's difficult to say that it's related to the policy).
There may be things that are dontaudited that need to be allowed.
I bet so. But is there any way to disable the effect of dontaudit ? Something such as a boolean that will treat dontaudit as allow or otherwise just ignore it so that the AVCs show up ?
Regards,
Guido
PATCH 11/34 : patch to allow consolekit shutdown the system
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Quoted 39 lines · Guido Trentalancia
Quoted 27 lines · Christopher J. PeBenito
Quoted 26 lines · Guido Trentalancia
Quoted 10 lines · Christopher J. PeBenito
Quoted 9 lines · Guido Trentalancia
This patch adds some permissions needed to shutdown the system using the graphical interface.
diff -pruN -x booleans.conf -x corenetwork.if -x corenetwork.te -x modules.conf refpolicy-git-02022011/policy/modules/services/consolekit.te refpolicy-git-02022011-new/policy/modules/services/consolekit.te
policy/modules/services/consolekit.te +0
-0@@ -118,6 +118,10 @@ optional_policy(` ')Quoted 11 lines
policy/modules/services/consolekit.te optional_policy(` · line 127
Quoted 8 lines
policy/modules/services/consolekit.te +4
-0optional_policy(` + shutdown_getattr_exec_files(consolekit_t) +') + +optional_policy(` udev_domtrans(consolekit_t) udev_read_db(consolekit_t) udev_signal(consolekit_t)How does this allow shutdown of the system? It only allows a getattr on the shutdown command.
Yes, in fact the system shutdown functionality (from Gnome) apparently is not working fine. It's not completing the job.
Quoted 6 lines
Quoted 4 lines
But there are no other AVC denials apart from that. So perhaps something is broken in Gnome or Consolekit, I didn't manage to investigate further so far (until I get further AVCs it's difficult to say that it's related to the policy).
There may be things that are dontaudited that need to be allowed.
I bet so. But is there any way to disable the effect of dontaudit ? Something such as a boolean that will treat dontaudit as allow or otherwise just ignore it so that the AVCs show up ?
Quoted 8 lines
Regards,
Guido
_______________________________________________
refpolicy mailing list
refpolicy at oss.tresys.com
http://oss.tresys.com/mailman/listinfo/refpolicy
semodule -DB
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
iEYEARECAAYFAk1tTyoACgkQrlYvE4MpobPNeQCgqqNH3F46s3Scz66nVxS26Htp 0+kAnRXL9hHVTuGAJKvhAuDPv2TPDAws
=iJfy
-----END PGP SIGNATURE-----
PATCH 11/34 : patch to allow consolekit shutdown the system
Quoted 45 lines · Daniel J Walsh
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1Quoted 41 lines · Guido Trentalancia
Quoted 27 lines · Christopher J. PeBenito
Quoted 26 lines · Guido Trentalancia
Quoted 10 lines · Christopher J. PeBenito
Quoted 9 lines · Guido Trentalancia
This patch adds some permissions needed to shutdown the system using the graphical interface.
diff -pruN -x booleans.conf -x corenetwork.if -x corenetwork.te -x modules.conf refpolicy-git-02022011/policy/modules/services/consolekit.te refpolicy-git-02022011-new/policy/modules/services/consolekit.te
policy/modules/services/consolekit.te +0
-0@@ -118,6 +118,10 @@ optional_policy(` ')Quoted 11 lines
policy/modules/services/consolekit.te optional_policy(` · line 127
Quoted 8 lines
policy/modules/services/consolekit.te +4
-0optional_policy(` + shutdown_getattr_exec_files(consolekit_t) +') + +optional_policy(` udev_domtrans(consolekit_t) udev_read_db(consolekit_t) udev_signal(consolekit_t)How does this allow shutdown of the system? It only allows a getattr on the shutdown command.
Yes, in fact the system shutdown functionality (from Gnome) apparently is not working fine. It's not completing the job.
Quoted 6 lines
Quoted 4 lines
But there are no other AVC denials apart from that. So perhaps something is broken in Gnome or Consolekit, I didn't manage to investigate further so far (until I get further AVCs it's difficult to say that it's related to the policy).
There may be things that are dontaudited that need to be allowed.
I bet so. But is there any way to disable the effect of dontaudit ? Something such as a boolean that will treat dontaudit as allow or otherwise just ignore it so that the AVCs show up ?
Regards,
Quoted 8 lines
Quoted 6 lines
Guido
_______________________________________________
refpolicy mailing list
refpolicy at oss.tresys.com
http://oss.tresys.com/mailman/listinfo/refpolicysemodule -DB
Excellent Dan, thanks for the tip !
Regards,
Guido