Bug 1007553 - user_wine_t and staff_wine_t don't handle wine_home_t
user_wine_t and staff_wine_t don't handle wine_home_t
Product: Fedora
Classification: Fedora
Component: selinux-policy-targeted (Show other bugs)
Unspecified Unspecified
unspecified Severity unspecified
: ---
: ---
Assigned To: Miroslav Grepl
Ben Levenson
Depends On:
  Show dependency treegraph
Reported: 2013-09-12 14:22 EDT by Alphonse Steiner
Modified: 2013-09-25 15:04 EDT (History)
1 user (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2013-09-25 15:04:02 EDT
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

  None (edit)
Description Alphonse Steiner 2013-09-12 14:22:08 EDT
When a seuser user_u starts wine, the application is run with the context user_wine_t, but this context does not handle wine_home_t, which is the label of the wine home directory. Using the tool sesearch, we can see that the rules are defined for wine_t.

I have used the command in permissive mode to get all the denials. Here a summary:

First problem: when wine is started for the first time, it creates its home directory .wine, but with the wrong label user_home_dir_t. Restorecon fixes this label and set it to wine_home_t.

Second problem: wine cannot access its configuration directory. Audit2allow reports:

allow user_wine_t data_home_t:file { write create unlink };
allow user_wine_t wine_home_t:dir { write remove_name add_name };
allow user_wine_t wine_home_t:file { write rename create unlink setattr };
allow user_wine_t wine_home_t:lnk_file read;

The data_home_t is for the .desktop files and icons in .local/share.

The same problems exist for seuser staff_u.
Comment 1 Daniel Walsh 2013-09-23 14:05:51 EDT
28d07eee671b8c4d79b46adba5e426b4cd905c82 fixes this in git.

Note You need to log in before you can comment on or make changes to this bug.