Bug 2071215

There are also reports of missing 'map' access:

type=AVC msg=audit(16.04.2022 13:29:45.311:223) : avc:  denied  { map } for  pid=1038 comm=gnome-session-b path=/var/lib/flatpak/exports/share/mime/mime.cache dev="nvme0n1p3" ino=34290936 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:var_lib_t:s0 tclass=file
----
type=AVC msg=audit(16.04.2022 13:29:46.748:232) : avc:  denied  { map } for  pid=1049 comm=gnome-shell path=/var/lib/flatpak/exports/share/icons/hicolor/icon-theme.cache dev="nvme0n1p3" ino=34290938 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:var_lib_t:s0 tclass=file

Are files_getattr_var_lib_dirs and files_map_var_lib_files the appropriate interfaces to allow 'getattr' and 'map' inside /var/lib/flatpak?

It'd be better to add one permission and retest, or switch the system to SELinux permissive as I suppose getattr is not enough, so I'd go with files_read_var_lib_symlinks() for the denial reported in #c0.

The #c1 denials are addressed in selinux-policy.

After following your pointers in:
  https://bugzilla.redhat.com/show_bug.cgi?id=2072274#c2

... I see that 'files_read_var_lib_files' evaluates to:

interface(`files_read_var_lib_files',`
        gen_require(`
                type var_t, var_lib_t;
        ')

        allow $1 var_lib_t:dir { getattr search open read lock ioctl };

        // read_files_pattern
        allow $1 { var_t var_lib_t }:dir { getattr search open };
        allow $1 var_lib_t:file { open getattr read ioctl lock };
')

... and 'files_read_var_lib_symlinks' evaluates to:

interface(`files_read_var_lib_symlinks',`
        gen_require(`
                type var_t, var_lib_t;
        ')

        // read_lnk_files_pattern
        allow $1 { var_t var_lib_t }:dir { getattr search open };
        allow $1 var_lib_t:lnk_file { getattr read };
')

This makes me wonder if permissions granted to file:s automatically cover lnk_file:s, or if they have to be mentioned separately.  I ended up looking at:
  https://selinuxproject.org/page/ObjectClassesPerms

... but it doesn't clearly specify that (and the page looks old because it doesn't mention the 'map' and 'watch' permissions).

(What's a good URL or reference to read up on SELinux?  I get a bit lost searching around on the Internet - it's possible that I am not using the right keywords.  Sometimes I end up reading:
  https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/using_selinux/index

Is there anything else you would recommend?)

> This makes me wonder if permissions granted to file:s automatically
> cover lnk_file:s, or if they have to be mentioned separately.

I see that we had added files_read_var_lib_files() in bug 2070741 in response to 'read' accesses to a 'lnk_file' being denied, and that seems to have worked.  This makes me think that files_read_var_lib_files() will also allow 'getattr' accesses to lnk_file:s and we don't need to do anything here.

(In reply to Debarshi Ray from comment #4)
> This makes me wonder if permissions granted to file:s automatically cover
> lnk_file:s, or if they have to be mentioned separately.  I ended up looking
> at:
>   https://selinuxproject.org/page/ObjectClassesPerms
> 
> ... but it doesn't clearly specify that (and the page looks old because it
> doesn't mention the 'map' and 'watch' permissions).

The file and lnk_file are distinct classes so different rules apply. Some interfaces allow also symlinks rules.
Updated information, though still very brief, can be found here:
https://github.com/fedora-selinux/selinux-policy/blob/rawhide/policy/flask/flask_documentation.md

> 
> (What's a good URL or reference to read up on SELinux?  I get a bit lost
> searching around on the Internet - it's possible that I am not using the
> right keywords.  Sometimes I end up reading:
>  
> https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/
> html/using_selinux/index
> 
> Is there anything else you would recommend?)

RHEL documentation is good and continuously being worked on, but there are different resources serving different purposes.
https://docs.fedoraproject.org/en-US/quick-docs/getting-started-with-selinux/
https://selinuxproject.org/page/Category:Notebook

(In reply to Zdenek Pytela from comment #6)
> (In reply to Debarshi Ray from comment #4)
> > This makes me wonder if permissions granted to file:s automatically cover
> > lnk_file:s, or if they have to be mentioned separately.  I ended up looking
> > at:
> >   https://selinuxproject.org/page/ObjectClassesPerms
> > 
> > ... but it doesn't clearly specify that (and the page looks old because it
> > doesn't mention the 'map' and 'watch' permissions).
> 
> The file and lnk_file are distinct classes so different rules apply. Some
> interfaces allow also symlinks rules.
> Updated information, though still very brief, can be found here:
> https://github.com/fedora-selinux/selinux-policy/blob/rawhide/policy/flask/
> flask_documentation.md

Umm... ok, but I am still confused.  :)

Do we need files_read_var_lib_symlinks() for this denial?  Or is files_read_var_lib_files() enough?

> > (What's a good URL or reference to read up on SELinux?  I get a bit lost
> > searching around on the Internet - it's possible that I am not using the
> > right keywords.  Sometimes I end up reading:
> >  
> > https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/
> > html/using_selinux/index
> > 
> > Is there anything else you would recommend?)
> 
> RHEL documentation is good and continuously being worked on, but there are
> different resources serving different purposes.
> https://docs.fedoraproject.org/en-US/quick-docs/getting-started-with-selinux/
> https://selinuxproject.org/page/Category:Notebook

Thanks for the pointers!

(In reply to Debarshi Ray from comment #7)
> (In reply to Zdenek Pytela from comment #6)
> > (In reply to Debarshi Ray from comment #4)
> > > This makes me wonder if permissions granted to file:s automatically cover
> > > lnk_file:s, or if they have to be mentioned separately.  I ended up looking
> > > at:
> > >   https://selinuxproject.org/page/ObjectClassesPerms
> > > 
> > > ... but it doesn't clearly specify that (and the page looks old because it
> > > doesn't mention the 'map' and 'watch' permissions).
> > 
> > The file and lnk_file are distinct classes so different rules apply. Some
> > interfaces allow also symlinks rules.
> > Updated information, though still very brief, can be found here:
> > https://github.com/fedora-selinux/selinux-policy/blob/rawhide/policy/flask/
> > flask_documentation.md
> 
> Umm... ok, but I am still confused.  :)
> 
> Do we need files_read_var_lib_symlinks() for this denial?  Or is
> files_read_var_lib_files() enough?

files_read_var_lib_files() does not contain any rule for the lnk_file class, so files_read_var_lib_symlinks() is needed, too.

Does this look good to you:
https://github.com/flatpak/flatpak/pull/4992 ?

FEDORA-2022-44170a0443 has been submitted as an update to Fedora 36. https://bodhi.fedoraproject.org/updates/FEDORA-2022-44170a0443

FEDORA-2022-44170a0443 has been pushed to the Fedora 36 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2022-44170a0443`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2022-44170a0443

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

FEDORA-2022-44170a0443 has been pushed to the Fedora 36 stable repository.
If problem still persists, please make note of it in this bug report.