Bug 1715897 - SELinux prevents sysadm_u from D-bus talking to rtkit-daemon
Summary: SELinux prevents sysadm_u from D-bus talking to rtkit-daemon
Keywords:
Status: CLOSED EOL
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy
Version: 30
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Zdenek Pytela
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks: 1767779
TreeView+ depends on / blocked
 
Reported: 2019-05-31 14:48 UTC by Zdenek Pytela
Modified: 2020-05-26 17:52 UTC (History)
7 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2020-05-26 17:52:11 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)

Description Zdenek Pytela 2019-05-31 14:48:29 UTC
This bug was initially created as a copy of Bug #1703241

Description of problem:
Logging of confined users in graphical environment triggers AVC denials

Version-Release number of selected component (if applicable):
selinux-policy-3.14.3-37.fc30.noarch

How reproducible:
 * always

Steps to Reproduce:
1. start a F30 machine
2. switch to permissive mode
3. log in as a confined user

Actual results:
 * multiple AVC denials

Expected results:
 * no AVC denials

Additional info:

Comment 1 Zdenek Pytela 2019-05-31 14:51:15 UTC
These permissions were requested and denied:

  * sysadm_u
allow avahi_t xdm_t:dbus send_msg;
allow pulseaudio_t user_home_dir_t:dir create;
allow rtkit_daemon_t sysadm_t:process setsched;
allow sysadm_dbusd_t self:unix_stream_socket connectto;
allow sysadm_dbusd_t sysadm_t:unix_dgram_socket sendto;
allow sysadm_dbusd_t user_tmp_t:sock_file write;
allow sysadm_t rtkit_daemon_t:dbus send_msg;
allow xdm_t audio_home_t:dir create;
allow xdm_t avahi_t:dbus send_msg;
allow xdm_t fwupd_t:dbus send_msg;
allow xdm_t getty_var_run_t:file getattr;
allow xdm_t iceauth_home_t:file { create link unlink write };
allow xdm_t sysadm_t:process getattr;
allow xdm_t sysctl_fs_t:file { getattr open read };
allow xdm_t user_home_t:dir create;
allow xdm_t user_home_t:file map;
allow xdm_t user_home_t:file { execute write };
allow xdm_t var_lib_t:file map;
allow xdm_t vmtools_exec_t:file map;
allow xdm_t vmtools_exec_t:file { execute execute_no_trans open read }

  * staff_u
allow pulseaudio_t staff_t:unix_dgram_socket sendto;
allow pulseaudio_t user_home_dir_t:dir create;
allow pulseaudio_t user_home_dir_t:file map;
allow pulseaudio_t user_home_dir_t:file { create getattr lock open read write };
allow staff_dbusd_t self:unix_stream_socket connectto;
allow staff_dbusd_t staff_t:unix_dgram_socket sendto;
allow staff_dbusd_t user_tmp_t:sock_file write;
allow staff_t user_home_dir_t:file { lock open read };
allow staff_t var_lib_t:file map;

  * user_u
allow pulseaudio_t user_home_dir_t:dir create;
allow pulseaudio_t user_home_dir_t:file map;
allow pulseaudio_t user_home_dir_t:file { create getattr lock open read write };
allow pulseaudio_t user_t:unix_dgram_socket sendto;
allow user_dbusd_t self:unix_stream_socket connectto;
allow user_dbusd_t user_t:unix_dgram_socket sendto;
allow user_dbusd_t user_tmp_t:sock_file write;
allow user_t cert_t:file map;
allow user_t fwupd_t:dbus send_msg;
allow user_t user_home_dir_t:file { lock open read };
allow user_t var_lib_t:file map;

Comment 2 Milos Malik 2019-05-31 15:10:15 UTC
If the fwupd service is running, here is a simple reproducer of SELinux denials related to fwupd_t:

$ id -Z
user_u:user_r:user_t:s0
$ gdbus introspect -y -o / -d org.freedesktop.fwupd
Error: GDBus.Error:org.freedesktop.DBus.Error.AccessDenied: An SELinux policy prevents this sender from sending this message to this recipient, 0 matched rules; type="method_call", sender=":1.394" (uid=1000 pid=11721 comm="gdbus introspect -y -o / -d org.freedesktop.fwupd " label="user_u:user_r:user_t:s0") interface="org.freedesktop.DBus.Introspectable" member="Introspect" error name="(unset)" requested_reply="0" destination="org.freedesktop.fwupd" (uid=0 pid=11641 comm="/usr/libexec/fwupd/fwupd " label="system_u:system_r:fwupd_t:s0")
$

The same reproducer works as expected for staff_u user:

$ id -Z
staff_u:staff_r:staff_t:s0-s0:c0.c1023
$ gdbus introspect -y -o / -d org.freedesktop.fwupd
node / {
  interface org.freedesktop.DBus.Properties {
    methods:
      Get(in  s interface_name,
          in  s property_name,
          out v value);
      GetAll(in  s interface_name,
             out a{sv} properties);
      Set(in  s interface_name,
          in  s property_name,
          in  v value);
    signals:
      PropertiesChanged(s interface_name,
                        a{sv} changed_properties,
                        as invalidated_properties);
    properties:
  };
  interface org.freedesktop.DBus.Introspectable {
    methods:
      Introspect(out s xml_data);
    signals:
    properties:
  };
  interface org.freedesktop.DBus.Peer {
    methods:
      Ping();
      GetMachineId(out s machine_uuid);
    signals:
    properties:
  };
  interface org.freedesktop.fwupd {
    methods:
      GetDevices(out aa{sv} devices);
      GetReleases(in  s device_id,
                  out aa{sv} releases);
      GetDowngrades(in  s device_id,
                    out aa{sv} releases);
      GetUpgrades(in  s device_id,
                  out aa{sv} releases);
      GetDetails(in  h handle,
                 out aa{sv} results);
      GetHistory(out aa{sv} devices);
      Install(in  s id,
              in  h handle,
              in  a{sv} options);
      Verify(in  s id);
      VerifyUpdate(in  s id);
      Unlock(in  s id);
      GetResults(in  s id,
                 out a{sv} results);
      GetRemotes(out aa{sv} results);
      ClearResults(in  s id);
      ModifyDevice(in  s device_id,
                   in  s key,
                   in  s value);
      UpdateMetadata(in  s remote_id,
                     in  h data,
                     in  h signature);
      ModifyRemote(in  s remote_id,
                   in  s key,
                   in  s value);
    signals:
      Changed();
      DeviceAdded(a{sv} device);
      DeviceRemoved(a{sv} device);
      DeviceChanged(a{sv} device);
    properties:
      readonly s DaemonVersion = '1.1.4';
      readonly u Status = 1;
      readonly u Percentage;
  };
};
$

Comment 3 Ben Cotton 2020-04-30 20:43:03 UTC
This message is a reminder that Fedora 30 is nearing its end of life.
Fedora will stop maintaining and issuing updates for Fedora 30 on 2020-05-26.
It is Fedora's policy to close all bug reports from releases that are no longer
maintained. At that time this bug will be closed as EOL if it remains open with a
Fedora 'version' of '30'.

Package Maintainer: If you wish for this bug to remain open because you
plan to fix it in a currently maintained version, simply change the 'version' 
to a later Fedora version.

Thank you for reporting this issue and we are sorry that we were not 
able to fix it before Fedora 30 is end of life. If you would still like 
to see this bug fixed and are able to reproduce it against a later version 
of Fedora, you are encouraged  change the 'version' to a later Fedora 
version prior this bug is closed as described in the policy above.

Although we aim to fix as many bugs as possible during every release's 
lifetime, sometimes those efforts are overtaken by events. Often a 
more recent Fedora release includes newer upstream software that fixes 
bugs or makes them obsolete.

Comment 4 Ben Cotton 2020-05-26 17:52:11 UTC
Fedora 30 changed to end-of-life (EOL) status on 2020-05-26. Fedora 30 is
no longer maintained, which means that it will not receive any further
security or bug fix updates. As a result we are closing this bug.

If you can reproduce this bug against a currently maintained version of
Fedora please feel free to reopen this bug against that version. If you
are unable to reopen this bug, please file a new report against the
current release. If you experience problems, please add a comment to this
bug.

Thank you for reporting this bug and we are sorry it could not be fixed.


Note You need to log in before you can comment on or make changes to this bug.