: patch for the policykit module (labeling, start from dbus, read xdm files)

This patch adds a file context for the /var/lib/polkit-1 directory. It then allows policykit to be started from dbus. It also adds some other permissions needed to run policykit and a new interface which is used to read xdm files.

diff -pruN refpolicy-git-02022011-test-apply2/policy/modules/services/policykit.fc refpolicy-git-02022011-test-apply3/policy/modules/services/policykit.fc

policy/modules/services/policykit.fc +1 -0

@@ -11,5 +11,6 @@
 /var/lib/misc/PolicyKit.reload			gen_context(system_u:object_r:policykit_reload_t,s0)
 /var/lib/PolicyKit(/.*)?			gen_context(system_u:object_r:policykit_var_lib_t,s0)
 /var/lib/PolicyKit-public(/.*)?			gen_context(system_u:object_r:policykit_var_lib_t,s0)
+/var/lib/polkit-1(/.*)?				gen_context(system_u:object_r:policykit_var_lib_t,s0)
 /var/run/PolicyKit(/.*)?			gen_context(system_u:object_r:policykit_var_run_t,s0)
 

diff -pruN refpolicy-git-02022011-test-apply2/policy/modules/services/policykit.te refpolicy-git-02022011-test-apply3/policy/modules/services/policykit.te

policy/modules/services/policykit.te +10 -0

+allow policykit_t self:process { getattr getsched signal };
 allow policykit_t self:fifo_file rw_file_perms;
 allow policykit_t self:unix_dgram_socket create_socket_perms;
 allow policykit_t self:unix_stream_socket create_stream_socket_perms;

@@ -57,6 +57,7 @@ manage_files_pattern(policykit_t, policy
 files_pid_filetrans(policykit_t, policykit_var_run_t, { file dir })
 
 kernel_read_kernel_sysctls(policykit_t)
+kernel_read_system_state(policykit_t)
 
 files_read_etc_files(policykit_t)
 files_read_usr_files(policykit_t)

@@ -78,6 +79,14 @@ optional_policy(`
 	gnome_read_config(policykit_t)
 ')
 
+optional_policy(`
+	dbus_system_domain(policykit_t, policykit_exec_t)
+')
+
+optional_policy(`
+	xserver_read_xdm_files(policykit_t)
+')
+
 ########################################
 #
 # polkit_auth local policy

diff -pruN refpolicy-git-02022011-test-apply2/policy/modules/services/xserver.if refpolicy-git-02022011-test-apply3/policy/modules/services/xserver.if

policy/modules/services/xserver.if +19 -0

@@ -638,6 +638,25 @@ interface(`xserver_rw_console',`
 
 ########################################
 ## <summary>
+##      Read xdm files.
+## </summary>
+## <param name="domain">
+##      <summary>
+##      Domain allowed access.
+##      </summary>
+## </param>
+#
+interface(`xserver_read_xdm_files',`
+        gen_require(`
+		type xdm_t;
+	')
+
+	allow $1 xdm_t:dir list_dir_perms;
+	read_files_pattern($1, xdm_t, xdm_t)
+')
+
+########################################
+## <summary>
 ##	Use file descriptors for xdm.
 ## </summary>
 ## <param name="domain">

Quoted 22 lines · Guido Trentalancia

This patch adds a file context for the /var/lib/polkit-1 directory. It then allows policykit to be started from dbus. It also adds some other permissions needed to run policykit and a new interface which is used to read xdm files.

diff -pruN refpolicy-git-02022011-test-apply2/policy/modules/services/policykit.fc refpolicy-git-02022011-test-apply3/policy/modules/services/policykit.fc

policy/modules/services/policykit.fc +1 -0

@@ -11,5 +11,6 @@
 /var/lib/misc/PolicyKit.reload			gen_context(system_u:object_r:policykit_reload_t,s0)
 /var/lib/PolicyKit(/.*)?			gen_context(system_u:object_r:policykit_var_lib_t,s0)
 /var/lib/PolicyKit-public(/.*)?			gen_context(system_u:object_r:policykit_var_lib_t,s0)
+/var/lib/polkit-1(/.*)?				gen_context(system_u:object_r:policykit_var_lib_t,s0)
 /var/run/PolicyKit(/.*)?			gen_context(system_u:object_r:policykit_var_run_t,s0)
 

diff -pruN refpolicy-git-02022011-test-apply2/policy/modules/services/policykit.te refpolicy-git-02022011-test-apply3/policy/modules/services/policykit.te

policy/modules/services/policykit.te +0 -0

@@ -35,8 +35,8 @@ files_pid_file(policykit_var_run_t)
 # policykit local policy
 #
 

policy/modules/services/policykit.te files_pid_file(policykit_var_run_t) · line 38

Quoted 3 lines

policy/modules/services/policykit.te +1 -2

-allow policykit_t self:capability { setgid setuid };
-allow policykit_t self:process getattr;
+allow policykit_t self:capability { setgid setuid sys_ptrace };

This sys_ptrace is highly questionable.

Quoted 22 lines · Guido Trentalancia

This patch adds a file context for the /var/lib/polkit-1 directory. It then allows policykit to be started from dbus. It also adds some other permissions needed to run policykit and a new interface which is used to read xdm files.

diff -pruN refpolicy-git-02022011-test-apply2/policy/modules/services/policykit.fc refpolicy-git-02022011-test-apply3/policy/modules/services/policykit.fc

policy/modules/services/policykit.fc +1 -0

@@ -11,5 +11,6 @@
 /var/lib/misc/PolicyKit.reload			gen_context(system_u:object_r:policykit_reload_t,s0)
 /var/lib/PolicyKit(/.*)?			gen_context(system_u:object_r:policykit_var_lib_t,s0)
 /var/lib/PolicyKit-public(/.*)?			gen_context(system_u:object_r:policykit_var_lib_t,s0)
+/var/lib/polkit-1(/.*)?				gen_context(system_u:object_r:policykit_var_lib_t,s0)
 /var/run/PolicyKit(/.*)?			gen_context(system_u:object_r:policykit_var_run_t,s0)
 

diff -pruN refpolicy-git-02022011-test-apply2/policy/modules/services/policykit.te refpolicy-git-02022011-test-apply3/policy/modules/services/policykit.te

policy/modules/services/policykit.te +0 -0

@@ -35,8 +35,8 @@ files_pid_file(policykit_var_run_t)
 # policykit local policy
 #
 

policy/modules/services/policykit.te files_pid_file(policykit_var_run_t) · line 38

Quoted 3 lines

policy/modules/services/policykit.te +1 -2

-allow policykit_t self:capability { setgid setuid };
-allow policykit_t self:process getattr;
+allow policykit_t self:capability { setgid setuid sys_ptrace };

This sys_ptrace is highly questionable.

Quoted 56 lines

policy/modules/services/policykit.te +10 -0

+allow policykit_t self:process { getattr getsched signal };
 allow policykit_t self:fifo_file rw_file_perms;
 allow policykit_t self:unix_dgram_socket create_socket_perms;
 allow policykit_t self:unix_stream_socket create_stream_socket_perms;

@@ -57,6 +57,7 @@ manage_files_pattern(policykit_t, policy
 files_pid_filetrans(policykit_t, policykit_var_run_t, { file dir })
 
 kernel_read_kernel_sysctls(policykit_t)
+kernel_read_system_state(policykit_t)
 
 files_read_etc_files(policykit_t)
 files_read_usr_files(policykit_t)

@@ -78,6 +79,14 @@ optional_policy(`
 	gnome_read_config(policykit_t)
 ')
 
+optional_policy(`
+	dbus_system_domain(policykit_t, policykit_exec_t)
+')
+
+optional_policy(`
+	xserver_read_xdm_files(policykit_t)
+')
+
 ########################################
 #
 # polkit_auth local policy

diff -pruN refpolicy-git-02022011-test-apply2/policy/modules/services/xserver.if refpolicy-git-02022011-test-apply3/policy/modules/services/xserver.if

policy/modules/services/xserver.if +19 -0

@@ -638,6 +638,25 @@ interface(`xserver_rw_console',`
 
 ########################################
 ## <summary>
+##      Read xdm files.
+## </summary>
+## <param name="domain">
+##      <summary>
+##      Domain allowed access.
+##      </summary>
+## </param>
+#
+interface(`xserver_read_xdm_files',`
+        gen_require(`
+		type xdm_t;
+	')
+
+	allow $1 xdm_t:dir list_dir_perms;
+	read_files_pattern($1, xdm_t, xdm_t)
+')
+
+########################################
+## <summary>
 ##	Use file descriptors for xdm.
 ## </summary>
 ## <param name="domain">

Quoted 23 lines · Christopher J. PeBenito

Quoted 22 lines · Guido Trentalancia

This patch adds a file context for the /var/lib/polkit-1 directory. It then allows policykit to be started from dbus. It also adds some other permissions needed to run policykit and a new interface which is used to read xdm files.

diff -pruN refpolicy-git-02022011-test-apply2/policy/modules/services/policykit.fc refpolicy-git-02022011-test-apply3/policy/modules/services/policykit.fc

policy/modules/services/policykit.fc +1 -0

@@ -11,5 +11,6 @@
 /var/lib/misc/PolicyKit.reload			gen_context(system_u:object_r:policykit_reload_t,s0)
 /var/lib/PolicyKit(/.*)?			gen_context(system_u:object_r:policykit_var_lib_t,s0)
 /var/lib/PolicyKit-public(/.*)?			gen_context(system_u:object_r:policykit_var_lib_t,s0)
+/var/lib/polkit-1(/.*)?				gen_context(system_u:object_r:policykit_var_lib_t,s0)
 /var/run/PolicyKit(/.*)?			gen_context(system_u:object_r:policykit_var_run_t,s0)
 

diff -pruN refpolicy-git-02022011-test-apply2/policy/modules/services/policykit.te refpolicy-git-02022011-test-apply3/policy/modules/services/policykit.te

policy/modules/services/policykit.te +0 -0

@@ -35,8 +35,8 @@ files_pid_file(policykit_var_run_t)
 # policykit local policy
 #
 

Quoted 5 lines

policy/modules/services/policykit.te files_pid_file(policykit_var_run_t) · line 38

Quoted 3 lines

policy/modules/services/policykit.te +1 -2

-allow policykit_t self:capability { setgid setuid };
-allow policykit_t self:process getattr;
+allow policykit_t self:capability { setgid setuid sys_ptrace };

This sys_ptrace is highly questionable.

Could that be due to calls to the following functions:

sigemptyset()
sigaddset()
sigprocmask()

There are no calls to ptrace() and this is not due to reading /proc/PID/cmdline.

In truth I can only check if this is critical for policykit.

Quoted 36 lines · Guido Trentalancia

Quoted 23 lines · Christopher J. PeBenito

Quoted 22 lines · Guido Trentalancia

This patch adds a file context for the /var/lib/polkit-1 directory. It then allows policykit to be started from dbus. It also adds some other permissions needed to run policykit and a new interface which is used to read xdm files.

diff -pruN refpolicy-git-02022011-test-apply2/policy/modules/services/policykit.fc refpolicy-git-02022011-test-apply3/policy/modules/services/policykit.fc

policy/modules/services/policykit.fc +1 -0

@@ -11,5 +11,6 @@
 /var/lib/misc/PolicyKit.reload			gen_context(system_u:object_r:policykit_reload_t,s0)
 /var/lib/PolicyKit(/.*)?			gen_context(system_u:object_r:policykit_var_lib_t,s0)
 /var/lib/PolicyKit-public(/.*)?			gen_context(system_u:object_r:policykit_var_lib_t,s0)
+/var/lib/polkit-1(/.*)?				gen_context(system_u:object_r:policykit_var_lib_t,s0)
 /var/run/PolicyKit(/.*)?			gen_context(system_u:object_r:policykit_var_run_t,s0)
 

diff -pruN refpolicy-git-02022011-test-apply2/policy/modules/services/policykit.te refpolicy-git-02022011-test-apply3/policy/modules/services/policykit.te

policy/modules/services/policykit.te +0 -0

@@ -35,8 +35,8 @@ files_pid_file(policykit_var_run_t)
 # policykit local policy
 #
 

Quoted 5 lines

policy/modules/services/policykit.te files_pid_file(policykit_var_run_t) · line 38

Quoted 3 lines

policy/modules/services/policykit.te +1 -2

-allow policykit_t self:capability { setgid setuid };
-allow policykit_t self:process getattr;
+allow policykit_t self:capability { setgid setuid sys_ptrace };

This sys_ptrace is highly questionable.

Could that be due to calls to the following functions:

sigemptyset()
sigaddset()
sigprocmask()

Quoted 4 lines

There are no calls to ptrace() and this is not due to reading /proc/PID/cmdline.

In truth I can only check if this is critical for policykit.

dontauditing this doesn't work?

Quoted 37 lines · Christopher J. PeBenito

Quoted 36 lines · Guido Trentalancia

Quoted 23 lines · Christopher J. PeBenito

Quoted 22 lines · Guido Trentalancia

This patch adds a file context for the /var/lib/polkit-1 directory. It then allows policykit to be started from dbus. It also adds some other permissions needed to run policykit and a new interface which is used to read xdm files.

diff -pruN refpolicy-git-02022011-test-apply2/policy/modules/services/policykit.fc refpolicy-git-02022011-test-apply3/policy/modules/services/policykit.fc

policy/modules/services/policykit.fc +1 -0

@@ -11,5 +11,6 @@
 /var/lib/misc/PolicyKit.reload			gen_context(system_u:object_r:policykit_reload_t,s0)
 /var/lib/PolicyKit(/.*)?			gen_context(system_u:object_r:policykit_var_lib_t,s0)
 /var/lib/PolicyKit-public(/.*)?			gen_context(system_u:object_r:policykit_var_lib_t,s0)
+/var/lib/polkit-1(/.*)?				gen_context(system_u:object_r:policykit_var_lib_t,s0)
 /var/run/PolicyKit(/.*)?			gen_context(system_u:object_r:policykit_var_run_t,s0)
 

diff -pruN refpolicy-git-02022011-test-apply2/policy/modules/services/policykit.te refpolicy-git-02022011-test-apply3/policy/modules/services/policykit.te

policy/modules/services/policykit.te +0 -0

@@ -35,8 +35,8 @@ files_pid_file(policykit_var_run_t)
 # policykit local policy
 #
 

Quoted 5 lines

policy/modules/services/policykit.te files_pid_file(policykit_var_run_t) · line 38

Quoted 3 lines

policy/modules/services/policykit.te +1 -2

-allow policykit_t self:capability { setgid setuid };
-allow policykit_t self:process getattr;
+allow policykit_t self:capability { setgid setuid sys_ptrace };

This sys_ptrace is highly questionable.

Could that be due to calls to the following functions:

sigemptyset()
sigaddset()
sigprocmask()

Quoted 6 lines

Quoted 4 lines

There are no calls to ptrace() and this is not due to reading /proc/PID/cmdline.

In truth I can only check if this is critical for policykit.

dontauditing this doesn't work?

dontaudit will just shut it up. If it is not critical we could do that, but *what's the point of hiding stuff under the carpet* ?

Your reply "[PATCH 11/34]: patch to allow consolekit shutdown the system" timestamped Tue, 01 Mar 2011 14:18:01 -0500 gives a practical example of the fact that dontaudit can have side effects even for a maintainer.

If one works everyday with the policy such side effects probably have a minimal impact because, as soon as something goes wrong, he or she knows that if there are no AVCs then he or she has to track down the dontaudit rules.

But for somebody that barely knows his or her system has a security framework and a security policy, these "side-effects" could turn into real "blockers". For example, he or she manages to find out that the problem is due to SELinux, then manages to find out that he/she needs to check the audit logs, but at the end he/she doesn't find anything there and just gets confused.

For a distribution it's different. Everything is pre-packaged and tested. But here we are discussing the reference policy.

In the context of the reference policy it could make some sense only in the context of well known "leaks". But this doesn't appear to be the case...

In general, anything that is not required should be denied. We do not want to fill up the logs with extraneous denial messages, so we dontaudit them. If there is a question of denials being suppressed by dontaudits, thats why we have semodule -D.

Quoted 68 lines · Guido Trentalancia

Quoted 37 lines · Christopher J. PeBenito

Quoted 36 lines · Guido Trentalancia

Quoted 23 lines · Christopher J. PeBenito

Quoted 22 lines · Guido Trentalancia

This patch adds a file context for the /var/lib/polkit-1 directory. It then allows policykit to be started from dbus. It also adds some other permissions needed to run policykit and a new interface which is used to read xdm files.

diff -pruN refpolicy-git-02022011-test-apply2/policy/modules/services/policykit.fc refpolicy-git-02022011-test-apply3/policy/modules/services/policykit.fc

policy/modules/services/policykit.fc +1 -0

@@ -11,5 +11,6 @@
 /var/lib/misc/PolicyKit.reload			gen_context(system_u:object_r:policykit_reload_t,s0)
 /var/lib/PolicyKit(/.*)?			gen_context(system_u:object_r:policykit_var_lib_t,s0)
 /var/lib/PolicyKit-public(/.*)?			gen_context(system_u:object_r:policykit_var_lib_t,s0)
+/var/lib/polkit-1(/.*)?				gen_context(system_u:object_r:policykit_var_lib_t,s0)
 /var/run/PolicyKit(/.*)?			gen_context(system_u:object_r:policykit_var_run_t,s0)
 

diff -pruN refpolicy-git-02022011-test-apply2/policy/modules/services/policykit.te refpolicy-git-02022011-test-apply3/policy/modules/services/policykit.te

policy/modules/services/policykit.te +0 -0

@@ -35,8 +35,8 @@ files_pid_file(policykit_var_run_t)
 # policykit local policy
 #
 

Quoted 5 lines

policy/modules/services/policykit.te files_pid_file(policykit_var_run_t) · line 38

Quoted 3 lines

policy/modules/services/policykit.te +1 -2

-allow policykit_t self:capability { setgid setuid };
-allow policykit_t self:process getattr;
+allow policykit_t self:capability { setgid setuid sys_ptrace };

This sys_ptrace is highly questionable.

Could that be due to calls to the following functions:

sigemptyset()
sigaddset()
sigprocmask()

Quoted 6 lines

Quoted 4 lines

There are no calls to ptrace() and this is not due to reading /proc/PID/cmdline.

In truth I can only check if this is critical for policykit.

dontauditing this doesn't work?

dontaudit will just shut it up. If it is not critical we could do that, but *what's the point of hiding stuff under the carpet* ?

Your reply "[PATCH 11/34]: patch to allow consolekit shutdown the system" timestamped Tue, 01 Mar 2011 14:18:01 -0500 gives a practical example of the fact that dontaudit can have side effects even for a maintainer.

If one works everyday with the policy such side effects probably have a minimal impact because, as soon as something goes wrong, he or she knows that if there are no AVCs then he or she has to track down the dontaudit rules.

But for somebody that barely knows his or her system has a security framework and a security policy, these "side-effects" could turn into real "blockers". For example, he or she manages to find out that the problem is due to SELinux, then manages to find out that he/she needs to check the audit logs, but at the end he/she doesn't find anything there and just gets confused.

For a distribution it's different. Everything is pre-packaged and tested. But here we are discussing the reference policy.

Quoted 3 lines

In the context of the reference policy it could make some sense only in the context of well known "leaks". But this doesn't appear to be the case...

In general, anything that is not required should be denied. We do not want to fill up the logs with extraneous denial messages, so we dontaudit them. If there is a question of denials being suppressed by dontaudits, thats why we have semodule -D.

Quoted 73 lines · Christopher J. PeBenito

Quoted 71 lines · Guido Trentalancia

Quoted 37 lines · Christopher J. PeBenito

Quoted 36 lines · Guido Trentalancia

Quoted 23 lines · Christopher J. PeBenito

Quoted 22 lines · Guido Trentalancia

This patch adds a file context for the /var/lib/polkit-1 directory. It then allows policykit to be started from dbus. It also adds some other permissions needed to run policykit and a new interface which is used to read xdm files.

diff -pruN refpolicy-git-02022011-test-apply2/policy/modules/services/policykit.fc refpolicy-git-02022011-test-apply3/policy/modules/services/policykit.fc

policy/modules/services/policykit.fc +1 -0

@@ -11,5 +11,6 @@
  /var/lib/misc/PolicyKit.reload			gen_context(system_u:object_r:policykit_reload_t,s0)
  /var/lib/PolicyKit(/.*)?			gen_context(system_u:object_r:policykit_var_lib_t,s0)
  /var/lib/PolicyKit-public(/.*)?			gen_context(system_u:object_r:policykit_var_lib_t,s0)
+/var/lib/polkit-1(/.*)?				gen_context(system_u:object_r:policykit_var_lib_t,s0)
  /var/run/PolicyKit(/.*)?			gen_context(system_u:object_r:policykit_var_run_t,s0)
 

diff -pruN refpolicy-git-02022011-test-apply2/policy/modules/services/policykit.te refpolicy-git-02022011-test-apply3/policy/modules/services/policykit.te

policy/modules/services/policykit.te +0 -0

@@ -35,8 +35,8 @@ files_pid_file(policykit_var_run_t)
  # policykit local policy
  #
 

Quoted 5 lines

policy/modules/services/policykit.te files_pid_file(policykit_var_run_t) · line 38

Quoted 3 lines

policy/modules/services/policykit.te +1 -2

-allow policykit_t self:capability { setgid setuid };
-allow policykit_t self:process getattr;
+allow policykit_t self:capability { setgid setuid sys_ptrace };

This sys_ptrace is highly questionable.

Could that be due to calls to the following functions:

sigemptyset()
sigaddset()
sigprocmask()

Quoted 6 lines

Quoted 4 lines

There are no calls to ptrace() and this is not due to reading /proc/PID/cmdline.

In truth I can only check if this is critical for policykit.

dontauditing this doesn't work?

dontaudit will just shut it up. If it is not critical we could do that, but *what's the point of hiding stuff under the carpet* ?

Your reply "[PATCH 11/34]: patch to allow consolekit shutdown the system" timestamped Tue, 01 Mar 2011 14:18:01 -0500 gives a practical example of the fact that dontaudit can have side effects even for a maintainer.

If one works everyday with the policy such side effects probably have a minimal impact because, as soon as something goes wrong, he or she knows that if there are no AVCs then he or she has to track down the dontaudit rules.

But for somebody that barely knows his or her system has a security framework and a security policy, these "side-effects" could turn into real "blockers". For example, he or she manages to find out that the problem is due to SELinux, then manages to find out that he/she needs to check the audit logs, but at the end he/she doesn't find anything there and just gets confused.

For a distribution it's different. Everything is pre-packaged and tested. But here we are discussing the reference policy.

In the context of the reference policy it could make some sense only in the context of well known "leaks". But this doesn't appear to be the case...

Quoted 4 lines

In general, anything that is not required should be denied. We do not want to fill up the logs with extraneous denial messages, so we dontaudit them. If there is a question of denials being suppressed by dontaudits, thats why we have semodule -D.

I forgot to add that it's not flooding logs. It logs that only once upon starting up.