Fedora Account System
Red Hat Associate
Red Hat Customer
This bug was initially created as a copy of Bug #1703241 Description of problem: Logging of confined users in graphical environment triggers AVC denials Version-Release number of selected component (if applicable): selinux-policy-3.14.3-37.fc30.noarch How reproducible: * always Steps to Reproduce: 1. start a F30 machine 2. switch to permissive mode 3. log in as a confined user Actual results: * multiple AVC denials Expected results: * no AVC denials Additional info:
These permissions were requested and denied: * sysadm_u allow avahi_t xdm_t:dbus send_msg; allow pulseaudio_t user_home_dir_t:dir create; allow rtkit_daemon_t sysadm_t:process setsched; allow sysadm_dbusd_t self:unix_stream_socket connectto; allow sysadm_dbusd_t sysadm_t:unix_dgram_socket sendto; allow sysadm_dbusd_t user_tmp_t:sock_file write; allow sysadm_t rtkit_daemon_t:dbus send_msg; allow xdm_t audio_home_t:dir create; allow xdm_t avahi_t:dbus send_msg; allow xdm_t fwupd_t:dbus send_msg; allow xdm_t getty_var_run_t:file getattr; allow xdm_t iceauth_home_t:file { create link unlink write }; allow xdm_t sysadm_t:process getattr; allow xdm_t sysctl_fs_t:file { getattr open read }; allow xdm_t user_home_t:dir create; allow xdm_t user_home_t:file map; allow xdm_t user_home_t:file { execute write }; allow xdm_t var_lib_t:file map; allow xdm_t vmtools_exec_t:file map; allow xdm_t vmtools_exec_t:file { execute execute_no_trans open read } * staff_u allow pulseaudio_t staff_t:unix_dgram_socket sendto; allow pulseaudio_t user_home_dir_t:dir create; allow pulseaudio_t user_home_dir_t:file map; allow pulseaudio_t user_home_dir_t:file { create getattr lock open read write }; allow staff_dbusd_t self:unix_stream_socket connectto; allow staff_dbusd_t staff_t:unix_dgram_socket sendto; allow staff_dbusd_t user_tmp_t:sock_file write; allow staff_t user_home_dir_t:file { lock open read }; allow staff_t var_lib_t:file map; * user_u allow pulseaudio_t user_home_dir_t:dir create; allow pulseaudio_t user_home_dir_t:file map; allow pulseaudio_t user_home_dir_t:file { create getattr lock open read write }; allow pulseaudio_t user_t:unix_dgram_socket sendto; allow user_dbusd_t self:unix_stream_socket connectto; allow user_dbusd_t user_t:unix_dgram_socket sendto; allow user_dbusd_t user_tmp_t:sock_file write; allow user_t cert_t:file map; allow user_t fwupd_t:dbus send_msg; allow user_t user_home_dir_t:file { lock open read }; allow user_t var_lib_t:file map;
If the fwupd service is running, here is a simple reproducer of SELinux denials related to fwupd_t: $ id -Z user_u:user_r:user_t:s0 $ gdbus introspect -y -o / -d org.freedesktop.fwupd Error: GDBus.Error:org.freedesktop.DBus.Error.AccessDenied: An SELinux policy prevents this sender from sending this message to this recipient, 0 matched rules; type="method_call", sender=":1.394" (uid=1000 pid=11721 comm="gdbus introspect -y -o / -d org.freedesktop.fwupd " label="user_u:user_r:user_t:s0") interface="org.freedesktop.DBus.Introspectable" member="Introspect" error name="(unset)" requested_reply="0" destination="org.freedesktop.fwupd" (uid=0 pid=11641 comm="/usr/libexec/fwupd/fwupd " label="system_u:system_r:fwupd_t:s0") $ The same reproducer works as expected for staff_u user: $ id -Z staff_u:staff_r:staff_t:s0-s0:c0.c1023 $ gdbus introspect -y -o / -d org.freedesktop.fwupd node / { interface org.freedesktop.DBus.Properties { methods: Get(in s interface_name, in s property_name, out v value); GetAll(in s interface_name, out a{sv} properties); Set(in s interface_name, in s property_name, in v value); signals: PropertiesChanged(s interface_name, a{sv} changed_properties, as invalidated_properties); properties: }; interface org.freedesktop.DBus.Introspectable { methods: Introspect(out s xml_data); signals: properties: }; interface org.freedesktop.DBus.Peer { methods: Ping(); GetMachineId(out s machine_uuid); signals: properties: }; interface org.freedesktop.fwupd { methods: GetDevices(out aa{sv} devices); GetReleases(in s device_id, out aa{sv} releases); GetDowngrades(in s device_id, out aa{sv} releases); GetUpgrades(in s device_id, out aa{sv} releases); GetDetails(in h handle, out aa{sv} results); GetHistory(out aa{sv} devices); Install(in s id, in h handle, in a{sv} options); Verify(in s id); VerifyUpdate(in s id); Unlock(in s id); GetResults(in s id, out a{sv} results); GetRemotes(out aa{sv} results); ClearResults(in s id); ModifyDevice(in s device_id, in s key, in s value); UpdateMetadata(in s remote_id, in h data, in h signature); ModifyRemote(in s remote_id, in s key, in s value); signals: Changed(); DeviceAdded(a{sv} device); DeviceRemoved(a{sv} device); DeviceChanged(a{sv} device); properties: readonly s DaemonVersion = '1.1.4'; readonly u Status = 1; readonly u Percentage; }; }; $
This message is a reminder that Fedora 30 is nearing its end of life. Fedora will stop maintaining and issuing updates for Fedora 30 on 2020-05-26. It is Fedora's policy to close all bug reports from releases that are no longer maintained. At that time this bug will be closed as EOL if it remains open with a Fedora 'version' of '30'. Package Maintainer: If you wish for this bug to remain open because you plan to fix it in a currently maintained version, simply change the 'version' to a later Fedora version. Thank you for reporting this issue and we are sorry that we were not able to fix it before Fedora 30 is end of life. If you would still like to see this bug fixed and are able to reproduce it against a later version of Fedora, you are encouraged change the 'version' to a later Fedora version prior this bug is closed as described in the policy above. Although we aim to fix as many bugs as possible during every release's lifetime, sometimes those efforts are overtaken by events. Often a more recent Fedora release includes newer upstream software that fixes bugs or makes them obsolete.
Fedora 30 changed to end-of-life (EOL) status on 2020-05-26. Fedora 30 is no longer maintained, which means that it will not receive any further security or bug fix updates. As a result we are closing this bug. If you can reproduce this bug against a currently maintained version of Fedora please feel free to reopen this bug against that version. If you are unable to reopen this bug, please file a new report against the current release. If you experience problems, please add a comment to this bug. Thank you for reporting this bug and we are sorry it could not be fixed.