On Mon, Jun 9, 2008 at 4:49 PM, Chad Hanson <chanson@xxxxxxxxxxxxx> wrote:
>
> mls_trusted_object(xdm_xserver_t) won't help this problem, but something
> like mls_file_read_up and mls_file_write_down would be more approriate
> for xdm_xserver_t.
>
> -Chad
>
>>
>> type=AVC msg=audit(1213041678.053:8): avc: denied { read } for
>> pid=2649 comm="Xorg" name="mem" dev=tmpfs ino=3893
>> scontext=system_u:system_r:xdm_xserver_t:s0-s15:c0.c1023
>> tcontext=system_u:object_r:memory_device_t:s15:c0.c1023
>> tclass=chr_file
>> type=AVC msg=audit(1213041678.432:10): avc: denied { write } for
>> pid=2649 comm="Xorg" name="mem" dev=tmpfs ino=3893
>> scontext=system_u:system_r:xdm_xserver_t:s0-s15:c0.c1023
>> tcontext=system_u:object_r:memory_device_t:s15:c0.c1023
>> tclass=chr_file
>>
>> The xserver_common_domain_template seems to have the necessary allow
>> rules (dev_read_raw_memory and dev_wx_raw_memory) for the types so I
>> create a local module and added:
>> mls_trusted_object(xdm_xserver_t)
>> to deal with the MLS constraint violation but I'm still getting these
>> AVC.What else can it be?
>>
>> Ted
>>
>
Indeed that would only work if the target (the chr_file) were an
mls_trusted_object. So for now I'm using
mls_file_(read/write)_all_levels and those AVCs are handled.
Now I looking at the USER_AVCs and trying to figure out how to
translate those into policy. Will audit2allow be updated to help with
generating rules for the X USER_AVCs?
For those who haven't seen the X user space object manager AVCs here
are some examples:
type=USER_AVC msg=audit(1213049927.142:132): user pid=2636 uid=0
auid=4294967295 ses=4294967295
subj=system_u:system_r:xdm_xserver_t:s0-s15:c0.c1023 msg='avc: denied
{ blend } for request=X11:CreateWindow comm=dbus-launch resid=800001
restype=WINDOW scontext=user_u:user_r:user_t:s0
tcontext=user_u:object_r:user_t:s0 tclass=x_drawable :
exe="/usr/bin/Xorg" (sauid=0, hostname=?, addr=?, terminal=?)'
type=USER_AVC msg=audit(1213049927.144:133): user pid=2636 uid=0
auid=4294967295 ses=4294967295
subj=system_u:system_r:xdm_xserver_t:s0-s15:c0.c1023 msg='avc: denied
{ setattr } for request=X11:SetSelectionOwner comm=dbus-launch
selection=_DBUS_SESSION_BUS_SELECTION_tedx_caa2282936b539cb3e36c2ae4845ed0b
scontext=user_u:user_r:user_t:s0
tcontext=system_u:object_r:xselection_t:s0 tclass=x_selection :
exe="/usr/bin/Xorg" (sauid=0, hostname=?, addr=?, terminal=?)'
type=USER_AVC msg=audit(1213049927.227:134): user pid=2636 uid=0
auid=4294967295 ses=4294967295
subj=system_u:system_r:xdm_xserver_t:s0-s15:c0.c1023 msg='avc: denied
{ manage } for request=X11:ChangeHosts comm=xhost
scontext=user_u:user_r:user_t:s0
tcontext=system_u:system_r:xdm_xserver_t:s0-s15:c0.c1023
tclass=x_server : exe="/usr/bin/Xorg" (sauid=0, hostname=?, addr=?,
terminal=?)'
type=USER_AVC msg=audit(1213049927.653:135): user pid=2636 uid=0
auid=4294967295 ses=4294967295
subj=system_u:system_r:xdm_xserver_t:s0-s15:c0.c1023 msg='avc: denied
{ blend } for request=X11:CreateWindow comm=gnome-session
resid=800001 restype=WINDOW scontext=user_u:user_r:user_t:s0
tcontext=user_u:object_r:user_t:s0 tclass=x_drawable :
exe="/usr/bin/Xorg" (sauid=0, hostname=?, addr=?, terminal=?)'
type=USER_AVC msg=audit(1213049927.656:136): user pid=2636 uid=0
auid=4294967295 ses=4294967295
subj=system_u:system_r:xdm_xserver_t:s0-s15:c0.c1023 msg='avc: denied
{ blend } for request=X11:CreateWindow comm=gnome-session
resid=800002 restype=WINDOW scontext=user_u:user_r:user_t:s0
tcontext=user_u:object_r:user_t:s0 tclass=x_drawable :
exe="/usr/bin/Xorg" (sauid=0, hostname=?, addr=?, terminal=?)'
type=USER_AVC msg=audit(1213049927.659:137): user pid=2636 uid=0
auid=4294967295 ses=4294967295
subj=system_u:system_r:xdm_xserver_t:s0-s15:c0.c1023 msg='avc: denied
{ getattr } for request=X11:QueryPointer comm=gnome-session
xdevice="Virtual core pointer" scontext=user_u:user_r:user_t:s0
tcontext=system_u:system_r:xdm_xserver_t:s0-s15:c0.c1023
tclass=x_device : exe="/usr/bin/Xorg" (sauid=0, hostname=?, addr=?,
terminal=?)'
type=USER_AVC msg=audit(1213049927.661:138): user pid=2636 uid=0
auid=4294967295 ses=4294967295
subj=system_u:system_r:xdm_xserver_t:s0-s15:c0.c1023 msg='avc: denied
{ use } for request=XKEYBOARD:SelectEvents comm=gnome-session
xdevice="Virtual core keyboard" scontext=user_u:user_r:user_t:s0
tcontext=system_u:system_r:xdm_xserver_t:s0-s15:c0.c1023
tclass=x_device : exe="/usr/bin/Xorg" (sauid=0, hostname=?, addr=?,
terminal=?)'
type=USER_AVC msg=audit(1213049927.661:139): user pid=2636 uid=0
auid=4294967295 ses=4294967295
subj=system_u:system_r:xdm_xserver_t:s0-s15:c0.c1023 msg='avc: denied
{ use } for request=XKEYBOARD:SelectEvents comm=gnome-session
xdevice="Virtual core keyboard" scontext=user_u:user_r:user_t:s0
tcontext=system_u:system_r:xdm_xserver_t:s0-s15:c0.c1023
tclass=x_device : exe="/usr/bin/Xorg" (sauid=0, hostname=?, addr=?,
terminal=?)'
type=USER_AVC msg=audit(1213049927.661:140): user pid=2636 uid=0
auid=4294967295 ses=4294967295
subj=system_u:system_r:xdm_xserver_t:s0-s15:c0.c1023 msg='avc: denied
{ getattr setattr } for request=XKEYBOARD:PerClientFlags
comm=gnome-session xdevice="Virtual core keyboard"
scontext=user_u:user_r:user_t:s0
tcontext=system_u:system_r:xdm_xserver_t:s0-s15:c0.c1023
tclass=x_device : exe="/usr/bin/Xorg" (sauid=0, hostname=?, addr=?,
terminal=?)'
type=ANOM_ABEND msg=audit(1213049927.662:141): auid=500 uid=500
gid=500 ses=4 subj=user_u:user_r:user_t:s0 pid=3280
comm="gnome-session" sig=5
type=CRED_DISP msg=audit(1213049927.674:142): user pid=2720 uid=0
auid=500 ses=4 subj=system_u:system_r:xdm_t:s0-s15:c0.c1023
msg='op=PAM:setcred acct="tedx" exe="/usr/libexec/gdm-session-worker"
(hostname=?, addr=?, terminal=:0 res=success)'
type=USER_END msg=audit(1213049927.697:143): user pid=2720 uid=0
auid=500 ses=4 subj=system_u:system_r:xdm_t:s0-s15:c0.c1023
msg='op=PAM:session_close acct="tedx"
exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0
res=success)'
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@xxxxxxxxxxxxx with
the words "unsubscribe selinux" without quotes as the message.
