: patch to label XDG config files and allow policykit to use them

PATCH New Guido Trentalancia 3 participants 4 messages Feb 16, 2011

lore

Share & tools

lore

Guido Trentalancia

author

2011-02-16 06:00 UTC #0 lore raw

PATCH 5/34 : patch to label XDG config files and allow policykit to use them

This patch labels HOME_DIR/\.config as gnome_home_t and then allows policykit to read such kind of files.

policy/modules/apps/gnome.fc +1 -1

diff -pruN refpolicy-git-02022011-test-apply/policy/modules/apps/gnome.fc refpolicy-git-02022011-test-apply2/policy/modules/apps/gnome.fc
@@ -1,4 +1,4 @@
-HOME_DIR/\.config/gtk-.*	gen_context(system_u:object_r:gnome_home_t,s0)
+HOME_DIR/\.config(/.*)?		gen_context(system_u:object_r:gnome_home_t,s0)
 HOME_DIR/\.gconf(d)?(/.*)?	gen_context(system_u:object_r:gconf_home_t,s0)
 HOME_DIR/\.gnome2(/.*)?		gen_context(system_u:object_r:gnome_home_t,s0)

policy/modules/services/policykit.te +4 -0

diff -pruN refpolicy-git-02022011-test-apply/policy/modules/services/policykit.te refpolicy-git-02022011-test-apply2/policy/modules/services/policykit.te
@@ -69,6 +69,10 @@ miscfiles_read_localization(policykit_t)
 
 userdom_read_all_users_state(policykit_t)
 
+optional_policy(`
+	gnome_read_config(policykit_t)
+')
+
 ########################################
 #
 # polkit_auth local policy

Sven Vermeulen

2011-02-16 20:51 UTC #1 lore raw

PATCH 5/34 : patch to label XDG config files and allow policykit to use them

Quoted 2 lines · Guido Trentalancia

This patch labels HOME_DIR/\.config as gnome_home_t and then allows policykit to read such kind of files.

Afaik, this location is used by much more than gnome applications. I don't have GNOME installed but it is still there for things like XFCE4, epdfview, zathura etc.

The .config location seems to be part of the XDG Base Directory Specification (I believe dgrift once referred me to this), independent of GNOME.

Perhaps it is more wise to call it user_config_t or user_xdg_config_t (and xdg_config_t for /etc/xdg etc.)? That way, the necessary privileges can be offered in an XDG-specific set of interfaces for all applications adhering to this specification (rather than using gnome_* interfaces even though they are not GNOME related).

Wkr,
Sven Vermeulen

Daniel J Walsh

2011-02-16 20:56 UTC #2 lore raw

PATCH 5/34 : patch to label XDG config files and allow policykit to use them

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Quoted 18 lines · Sven Vermeulen

Quoted 2 lines · Guido Trentalancia
This patch labels HOME_DIR/\.config as gnome_home_t and then allows policykit to read such kind of files.
Afaik, this location is used by much more than gnome applications. I don't have GNOME installed but it is still there for things like XFCE4, epdfview, zathura etc.
The .config location seems to be part of the XDG Base Directory Specification (I believe dgrift once referred me to this), independent of GNOME.
Perhaps it is more wise to call it user_config_t or user_xdg_config_t (and xdg_config_t for /etc/xdg etc.)? That way, the necessary privileges can be offered in an XDG-specific set of interfaces for all applications adhering to this specification (rather than using gnome_* interfaces even though they are not GNOME related).

Quoted 6 lines

Wkr,
Sven Vermeulen
_______________________________________________
refpolicy mailing list
refpolicy at oss.tresys.com
http://oss.tresys.com/mailman/listinfo/refpolicy

In Fedora is it labeled config_home_t
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/

iEYEARECAAYFAk1cOgsACgkQrlYvE4MpobPJPwCeOw8BhykJy/zAfl3Q78ouTGpS 62IAoLG5KXmV3KCQEdNMdmKAB/m3aQaO
=Szh7
-----END PGP SIGNATURE-----

Guido Trentalancia

author

2011-02-16 21:28 UTC #3 lore raw

PATCH 5/34 : patch to label XDG config files and allow policykit to use them

In reply to Sven Vermeulen

Hello Sven,

thanks for your comments.

Yes, in practice, anything other than generic user_home_t is fine.

So, for example, user_xdg_config_t could be used and perhaps the naming is more appropriate (as formally it's XDG shared with Gnome), but there is a lack of interfaces for that (i.e. the equivalent of gnome_read_config()).

Feel free to provide an alternative patch in place of [5/34] that I proposed.

The important is that .config is not labeled generically and that policykit can read its content (I believe it only needs to read .config/user-dirs.*) !

Regards,

Guido

Quoted 25 lines · Sven Vermeulen

Quoted 2 lines · Guido Trentalancia
This patch labels HOME_DIR/\.config as gnome_home_t and then allows policykit to read such kind of files.
Afaik, this location is used by much more than gnome applications. I don't have GNOME installed but it is still there for things like XFCE4, epdfview, zathura etc.
The .config location seems to be part of the XDG Base Directory Specification (I believe dgrift once referred me to this), independent of GNOME.
Perhaps it is more wise to call it user_config_t or user_xdg_config_t (and xdg_config_t for /etc/xdg etc.)? That way, the necessary privileges can be offered in an XDG-specific set of interfaces for all applications adhering to this specification (rather than using gnome_* interfaces even though they are not GNOME related).
Wkr,
Sven Vermeulen
_______________________________________________
refpolicy mailing list
refpolicy at oss.tresys.com
http://oss.tresys.com/mailman/listinfo/refpolicy