Allow xfce (and most likely other DEs) to properly work with the authorization information
PATCH 1/1 Allow xfce (and most likely other DEs) to properly work with the authorization information
On my system, I use XFCE and start X from the commandline (using "startx") rather than through a graphical DM. During the start-up, XFCE4 creates temporary ICE files in /tmp (like /tmp/.xfsm-ICE-ABCDEF) which are later read in by iceauth and at some point X.
I'm not that good at the entire ICE stuff, but without this, I was unable to shut down my session ("log off").
--- policy/modules/services/xserver.te | 3 +++ 1 files changed, 3 insertions(+), 0 deletions(-)
policy/modules/services/xserver.te +3 -0
@@ -234,9 +234,11 @@ userdom_user_home_dir_filetrans(iceauth_t, iceauth_home_t, file) allow xdm_t iceauth_home_t:file read_file_perms; +files_search_tmp(iceauth_t) fs_search_auto_mountpoints(iceauth_t) userdom_use_user_terminals(iceauth_t) +userdom_read_user_tmp_files(iceauth_t) tunable_policy(`use_nfs_home_dirs',` fs_manage_nfs_files(iceauth_t)
@@ -726,6 +728,7 @@ seutil_read_default_contexts(xserver_t) userdom_search_user_home_dirs(xserver_t) userdom_use_user_ttys(xserver_t) userdom_setattr_user_ttys(xserver_t) +userdom_read_user_tmp_files(xserver_t) userdom_rw_user_tmpfs_files(xserver_t) xserver_use_user_fonts(xserver_t)
Signature · 1 line
1.7.3.4
PATCH 1/1 Allow xfce (and most likely other DEs) to properly work with the authorization information
Quoted 7 lines · Sven Vermeulen
On my system, I use XFCE and start X from the commandline (using "startx") rather than through a graphical DM. During the start-up, XFCE4 creates temporary ICE files in /tmp (like
/tmp/.xfsm-ICE-ABCDEF) which are later read in by iceauth and at some point X.I'm not that good at the entire ICE stuff, but without this, I was unable to shut down my session ("log off").
What specific process was creating the files? Do you still have the logs? I'm interested in seeing them, as user processes creating ICE files seems wrong.
Quoted 29 lines
Signed-off-by Sven Vermeulen<[email protected]>--- policy/modules/services/xserver.te | 3 +++ 1 files changed, 3 insertions(+), 0 deletions(-)policy/modules/services/xserver.te +3
-0@@ -234,9 +234,11 @@ userdom_user_home_dir_filetrans(iceauth_t, iceauth_home_t, file) allow xdm_t iceauth_home_t:file read_file_perms; +files_search_tmp(iceauth_t) fs_search_auto_mountpoints(iceauth_t) userdom_use_user_terminals(iceauth_t) +userdom_read_user_tmp_files(iceauth_t) tunable_policy(`use_nfs_home_dirs',` fs_manage_nfs_files(iceauth_t)@@ -726,6 +728,7 @@ seutil_read_default_contexts(xserver_t) userdom_search_user_home_dirs(xserver_t) userdom_use_user_ttys(xserver_t) userdom_setattr_user_ttys(xserver_t) +userdom_read_user_tmp_files(xserver_t) userdom_rw_user_tmpfs_files(xserver_t) xserver_use_user_fonts(xserver_t)
Signature · 3 lines
Chris PeBenito Tresys Technology, LLC www.tresys.com | oss.tresys.com
PATCH 1/1 Allow xfce (and most likely other DEs) to properly work with the authorization information
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Quoted 6 lines · Christopher J. PeBenito
Quoted 5 lines · Sven Vermeulen
On my system, I use XFCE and start X from the commandline (using "startx") rather than through a graphical DM. During the start-up, XFCE4 creates temporary ICE files in /tmp (like
/tmp/.xfsm-ICE-ABCDEF) which are later read in by iceauth and at some point X.
Quoted 6 lines
Quoted 2 lines
I'm not that good at the entire ICE stuff, but without this, I was unable to shut down my session ("log off").
What specific process was creating the files? Do you still have the logs? I'm interested in seeing them, as user processes creating ICE files seems wrong.
You'd be surprised who all maintained these:
manage_dirs_pattern($1_gsession_t, gsession_ice_tmp_t, gsession_ice_tmp_t) manage_sock_files_pattern($1_gsession_t, gsession_ice_tmp_t,gsession_ice_tmp_t)
files_tmp_filetrans($1_gsession_t, gsession_ice_tmp_t, dir)
# for when /tmp/.ICE is created with initrc_tmp_t init_script_tmp_filetrans($1_gsession_t, gsession_ice_tmp_t, sock_file) # for when /tmp/.ICE is created with xdm_tmp_t xserver_xdm_tmp_filetrans($1_gsession_t, gsession_ice_tmp_t, sock_file)
Quoted 28 lines
Quoted 28 lines
Signed-off-by Sven Vermeulen<[email protected]>--- policy/modules/services/xserver.te | 3 +++ 1 files changed, 3 insertions(+), 0 deletions(-)policy/modules/services/xserver.te +3
-0@@ -234,9 +234,11 @@ userdom_user_home_dir_filetrans(iceauth_t, iceauth_home_t, file) allow xdm_t iceauth_home_t:file read_file_perms; +files_search_tmp(iceauth_t) fs_search_auto_mountpoints(iceauth_t) userdom_use_user_terminals(iceauth_t) +userdom_read_user_tmp_files(iceauth_t) tunable_policy(`use_nfs_home_dirs',` fs_manage_nfs_files(iceauth_t)@@ -726,6 +728,7 @@ seutil_read_default_contexts(xserver_t) userdom_search_user_home_dirs(xserver_t) userdom_use_user_ttys(xserver_t) userdom_setattr_user_ttys(xserver_t) +userdom_read_user_tmp_files(xserver_t) userdom_rw_user_tmpfs_files(xserver_t)
Quoted 3 lines
policy/modules/services/xserver.te seutil_read_default_contexts(xserver_t) · line 734
Quoted 1 line
policy/modules/services/xserver.te +0
-0xserver_use_user_fonts(xserver_t)
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.16 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
iEYEARECAAYFAk1ZS7wACgkQMlxVo39jgT+2CwCfQInjHtvGMJ1mfitDGTqoWd14 dOMAn00xGceE12MhrM1V6mDjXMTvxn6O
=j9VA
-----END PGP SIGNATURE-----
PATCH 1/1 Allow xfce (and most likely other DEs) to properly work with the authorization information
In reply to Christopher J. PeBenitoQuoted 6 lines · Christopher J. PeBenito
Quoted 5 lines · Sven Vermeulen
On my system, I use XFCE and start X from the commandline (using "startx") rather than through a graphical DM. During the start-up, XFCE4 creates temporary ICE files in /tmp (like
/tmp/.xfsm-ICE-ABCDEF) which are later read in by iceauth and at some point X.
Quoted 6 lines
Quoted 2 lines
I'm not that good at the entire ICE stuff, but without this, I was unable to shut down my session ("log off").
What specific process was creating the files? Do you still have the logs? I'm interested in seeing them, as user processes creating ICE files seems wrong.
Sure, easily reconstructed, it's xfce4-session (as per the following auditallow granted log lines):
Feb 14 19:40:29 hpl kernel: [ 7182.399817] type=1400 audit(1297708829.027:209): avc: granted { create } for pid=13133 comm="xfce4-session" name=".xfsm-ICE-IU6VQV" scontext=staff_u:staff_r:staff_t tcontext=staff_u:object_r:user_tmp_t tclass=file
Feb 14 19:40:29 hpl kernel: [ 7182.399848] type=1400 audit(1297708829.027:210): avc: granted { create } for pid=13133 comm="xfce4-session" name=".xfsm-ICE-4U6VQV" scontext=staff_u:staff_r:staff_t tcontext=staff_u:object_r:user_tmp_t tclass=fileWkr,
Sven Vermeulen
PATCH 1/1 Allow xfce (and most likely other DEs) to properly work with the authorization information
In reply to Sven VermeulenQuoted 9 lines · Sven Vermeulen
On my system, I use XFCE and start X from the commandline (using "startx") rather than through a graphical DM. During the start-up, XFCE4 creates temporary ICE files in /tmp (like
/tmp/.xfsm-ICE-ABCDEF) which are later read in by iceauth and at some point X.I'm not that good at the entire ICE stuff, but without this, I was unable to shut down my session ("log off").
Signed-off-by Sven Vermeulen <[email protected]>
Merged.
Quoted 28 lines
--- policy/modules/services/xserver.te | 3 +++ 1 files changed, 3 insertions(+), 0 deletions(-)policy/modules/services/xserver.te +3
-0@@ -234,9 +234,11 @@ userdom_user_home_dir_filetrans(iceauth_t, iceauth_home_t, file) allow xdm_t iceauth_home_t:file read_file_perms; +files_search_tmp(iceauth_t) fs_search_auto_mountpoints(iceauth_t) userdom_use_user_terminals(iceauth_t) +userdom_read_user_tmp_files(iceauth_t) tunable_policy(`use_nfs_home_dirs',` fs_manage_nfs_files(iceauth_t)@@ -726,6 +728,7 @@ seutil_read_default_contexts(xserver_t) userdom_search_user_home_dirs(xserver_t) userdom_use_user_ttys(xserver_t) userdom_setattr_user_ttys(xserver_t) +userdom_read_user_tmp_files(xserver_t) userdom_rw_user_tmpfs_files(xserver_t) xserver_use_user_fonts(xserver_t)
Signature · 3 lines
Chris PeBenito Tresys Technology, LLC www.tresys.com | oss.tresys.com