Bug 442893

These AVC's indicate that kdm_greet is trying to write to two files in the /usr
directory?  

/usr/share/kde4/apps/color-schemes/ObsidianCoast.colors
/usr/share/locale/l10n/*/entry.desktop

I don't believe needs to do this and would be blocked by a read only /usr
partition, I do not want to dontaudit this, since this would block me from
seeing a real attack.

It is also trying to stat the  /root/.kde/tmp-david.lydgate.lan lnk_file, which
is I guess a link created in the homedir of kde applications?  Not sure what it
is trying to do.  But I think kdm_greet should at least fix the writing of the
two files above.

.colors and .desktop files are all read using KConfig, so this is almost 
certainly the same issue you already added a dontaudit for in the home 
directory case: KConfig will always try to open a config file for writing 
first, and if permission is denied, retry as read-only.

My idea would be to link KStandardDirs with libselinux and use something like 
this (which probably has bugs and which doesn't check the return values of 
getcon, getfilecon and security_compute_av, don't use as is):

bool KStandardDirs::checkAccess(const QString& pathname, int mode)
{
    // if we want to write to the file, first query SELinux to avoid AVCs
    if ((mode & W_OK) && is_selinux_enabled()) {
        security_context_t scon, tcon;
        struct av_decision decision;
        getcon(&scon);
        getfilecon(QFile::encodeName(pathname), &tcon);
        security_compute_av(scon, tcon, SECCLASS_FILE, FILE__WRITE, &decision);
        freecon(scon);
        freecon(tcon);
        if (!(decision.allowed & FILE__WRITE))
            return false;
    }
    // the code below is original KDE code

    int accessOK = access( QFile::encodeName(pathname), mode );
    if ( accessOK == 0 )
        return true;  // OK, I can really access the file

    // else
    // if we want to write the file would be created. Check, if the
    // user may write to the directory to create the file.
    if ( (mode & W_OK) == 0 )
        return false;   // Check for write access is not part of mode => bail 
out


    if (!access( QFile::encodeName(pathname), F_OK)) // if it already exists
        return false;

    //strip the filename (everything until '/' from the end
    QString dirName(pathname);
    int pos = dirName.lastIndexOf('/');
    if ( pos == -1 )
        return false;   // No path in argument. This is evil, we won't allow 
this
    else if ( pos == 0 ) // don't turn e.g. /root into an empty string
        pos = 1;

    dirName.truncate(pos); // strip everything starting from the last '/'

    accessOK = access( QFile::encodeName(dirName), W_OK );
    // -?- Can I write to the accessed diretory
    if ( accessOK == 0 )
        return true;  // Yes
    else
        return false; // No
}

Would this work?

(If this works, it would also make the dontaudit you added for bug 421951 
unnecessary.)

Well the problem with this is you are giving a lot more access to be able to
check versus just dontaudit the effort to write the file.

I guess we can just dontaudit the access.

Of course if kdm_greet did not run as root, like gdm does, DAC permissions would
prevent these checks.

dontaudits added in selinux-policy-3.3.1-37.fc9.src.rpm