Add system_r role to unconfined_u and staff_u users
PATCH 1/1 Add system_r role to unconfined_u and staff_u users
From: Laurent Bigonville <[email protected]>
This is necessary for at least pulseaudio and libvirtd running in the user session.
--- policy/users | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
policy/users +2 -2
@@ -25,11 +25,11 @@ gen_user(system_u,, system_r, s0, s0 - mls_systemhigh, mcs_allcats) # permit any access to such users, then remove this entry. # gen_user(user_u, user, user_r, s0, s0) -gen_user(staff_u, staff, staff_r sysadm_r ifdef(`enable_mls',`secadm_r auditadm_r'), s0, s0 - mls_systemhigh, mcs_allcats) +gen_user(staff_u, staff, staff_r sysadm_r system_r ifdef(`enable_mls',`secadm_r auditadm_r'), s0, s0 - mls_systemhigh, mcs_allcats) gen_user(sysadm_u, sysadm, sysadm_r, s0, s0 - mls_systemhigh, mcs_allcats) # Until order dependence is fixed for users: -gen_user(unconfined_u, unconfined, unconfined_r, s0, s0 - mls_systemhigh, mcs_allcats) +gen_user(unconfined_u, unconfined, unconfined_r system_r, s0, s0 - mls_systemhigh, mcs_allcats) # # The following users correspond to Unix identities.
Signature · 1 line
1.7.10.4
PATCH 1/1 Add system_r role to unconfined_u and staff_u users
Le Sat, 22 Sep 2012 15:21:32 +0200,
Laurent Bigonville <[email protected]> a ?crit :
Quoted 18 lines
From: Laurent Bigonville <[email protected]>
This is necessary for at least pulseaudio and libvirtd running in the user session.
--- policy/users | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)policy/users +0
-0@@ -25,11 +25,11 @@ gen_user(system_u,, system_r, s0, s0 -
mls_systemhigh,mcs_allcats) # permit any access to such users, then remove this entry. #
gen_user(user_u, user, user_r, s0, s0)
-gen_user(staff_u, staff,staff_rsysadm_rifdef(enable_mls',secadm_rauditadm_r'), s0, s0 -mls_systemhigh,
Quoted 8 lines
mcs_allcats) +gen_user(staff_u, staff,staff_rsysadm_rsystem_rifdef(enable_mls',secadm_rauditadm_r'), s0, s0 -mls_systemhigh,mcs_allcats)gen_user(sysadm_u, sysadm, sysadm_r, s0, s0 - mls_systemhigh, mcs_allcats)# Until order dependence is fixed for
users: -gen_user(unconfined_u, unconfined,unconfined_r, s0, s0 -mls_systemhigh,mcs_allcats) +gen_user(unconfined_u, unconfined,unconfined_rsystem_r, s0, s0 -mls_systemhigh,mcs_allcats) #
# The following users correspond to Unix identities.
Any thoughts on that patch?
Cheers
Laurent Bigonville
PATCH 1/1 Add system_r role to unconfined_u and staff_u users
Quoted 23 lines · Laurent Bigonville
Le Sat, 22 Sep 2012 15:21:32 +0200,
Laurent Bigonville <[email protected]> a ??crit :Quoted 20 lines
From: Laurent Bigonville <[email protected]>
This is necessary for at least pulseaudio and libvirtd running in the user session.
--- policy/users | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)policy/users +0
-0@@ -25,11 +25,11 @@ gen_user(system_u,, system_r, s0, s0 -
mls_systemhigh,mcs_allcats) # permit any access to such users, then remove this entry. #
gen_user(user_u, user, user_r, s0, s0)
-gen_user(staff_u, staff,staff_rsysadm_rifdef(enable_mls',secadm_rauditadm_r'), s0, s0 -mls_systemhigh,mcs_allcats) +gen_user(staff_u, staff,staff_rsysadm_rsystem_rifdef(enable_mls',secadm_rauditadm_r'), s0, s0 -mls_systemhigh,
Quoted 8 lines
Quoted 6 lines
mcs_allcats)gen_user(sysadm_u, sysadm, sysadm_r, s0, s0 - mls_systemhigh, mcs_allcats)# Until order dependence is fixed for
users: -gen_user(unconfined_u, unconfined,unconfined_r, s0, s0 -mls_systemhigh,mcs_allcats) +gen_user(unconfined_u, unconfined,unconfined_rsystem_r, s0, s0 -mls_systemhigh,mcs_allcats) #
# The following users correspond to Unix identities.Any thoughts on that patch?
The patch would need to be updated to be controlled by the direct_sysadm_daemon build option, as it is with the root seuser.
Signature · 3 lines
Chris PeBenito Tresys Technology, LLC www.tresys.com | oss.tresys.com
PATCH 1/1 Add system_r role to unconfined_u and staff_u users
Le Tue, 9 Oct 2012 10:00:21 -0400,
"Christopher J. PeBenito" <[email protected]> a ?crit :
Quoted 7 lines · Laurent Bigonville
Quoted 2 lines
Any thoughts on that patch?
The patch would need to be updated to be controlled by the
direct_sysadm_daemonbuild option, as it is with the root seuser.
My initial issue was that when dbus was starting pulseaudio and libvirt, logged-in using my unconfined user, it was trying to transition the process to unconfined_u:system_r:{pulseaudio_t,virtd_t} and it was exploding as the label was invalid.
So if the policy is compiled without direct_sysadm_daemon I guess that this issue will persist.
Also I've added the system_r role to the staff_u to be consistant (and because it's also done in the Fedora policy)
Laurent Bigonville
PATCH 1/1 Add system_r role to unconfined_u and staff_u users
Quoted 2 lines · Laurent Bigonville
Also I've added the
system_rrole to thestaff_uto be consistant (and because it's also done in the Fedora policy)
It also makes sense the moment you use init scripts that are "named" for a specific service, like nscd_initrc_exec_t. For a user to be able to use this, he needs to be granted the *_admin() towards his user domain, but also the system_r role to the SELinux user itself (otherwise this won't work)).
Wkr,
Sven Vermeulen