Bug 2248488 - Missing rules for `sandbox -t sandbox_web_t -X firefox`
Summary: Missing rules for `sandbox -t sandbox_web_t -X firefox`
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy
Version: 39
Hardware: Unspecified
OS: Linux
medium
high
Target Milestone: ---
Assignee: Zdenek Pytela
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2023-11-07 10:21 UTC by Petr Lautrbach
Modified: 2024-03-21 04:25 UTC (History)
8 users (show)

Fixed In Version: selinux-policy-39.2-1.fc39
Clone Of:
Environment:
Last Closed: 2023-11-21 02:49:03 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Github fedora-selinux selinux-policy pull 1930 0 None open Allow graphical applications work in Wayland 2023-11-08 12:51:28 UTC

Description Petr Lautrbach 2023-11-07 10:21:14 UTC
The following command fails in enforcing

[user@P1 ~]$ sandbox -t sandbox_web_t -X firefox


It works with the following module

[root@P1 ~]# cat sandbox-wayland.cil 
(allow sandbox_xserver_t xserver_tmpfs_t (file (map write)))
(allow sandbox_web_client_t self (user_namespace (create)))

[root@P1 ~]# semodule -r sandbox-wayland


audit events generated in permissive and analyzed by audit2why:

[root@P1 ~]# ausearch -m avc -ts 11:15:36 | audit2why
type=AVC msg=audit(1699352139.469:3242): avc:  denied  { write } for  pid=481494 comm="Xephyr" path=2F6D656D66643A786F7267202864656C6574656429 dev="tmpfs" ino=93765 scontext=unconfined_u:unconfined_r:sandbox_xserver_t:s0:c10,c580 tcontext=unconfined_u:object_r:xserver_tmpfs_t:s0 tclass=file permissive=1

        Was caused by:
        The boolean xserver_clients_write_xshm was set incorrectly. 
        Description:
        Allows clients to write to the X server shared memory segments.

        Allow access by executing:
        # setsebool -P xserver_clients_write_xshm 1
type=AVC msg=audit(1699352139.469:3243): avc:  denied  { map } for  pid=481494 comm="Xephyr" path=2F6D656D66643A786F7267202864656C6574656429 dev="tmpfs" ino=93765 scontext=unconfined_u:unconfined_r:sandbox_xserver_t:s0:c10,c580 tcontext=unconfined_u:object_r:xserver_tmpfs_t:s0 tclass=file permissive=1

        Was caused by:
        The boolean domain_can_mmap_files was set incorrectly. 
        Description:
        Allow any process to mmap any file on system with attribute file_type.

        Allow access by executing:
        # setsebool -P domain_can_mmap_files 1
type=AVC msg=audit(1699352139.561:3244): avc:  denied  { watch } for  pid=481505 comm="dbus-daemon" path="/etc/dbus-1/session.d" dev="dm-1" ino=17110157 scontext=unconfined_u:unconfined_r:sandbox_web_client_t:s0:c10,c580 tcontext=system_u:object_r:dbusd_etc_t:s0 tclass=dir permissive=1

        Was caused by:
                Missing type enforcement (TE) allow rule.

                You can use audit2allow to generate a loadable module to allow this access.

type=AVC msg=audit(1699352139.591:3245): avc:  denied  { create } for  pid=481506 comm="firefox" scontext=unconfined_u:unconfined_r:sandbox_web_client_t:s0:c10,c580 tcontext=unconfined_u:unconfined_r:sandbox_web_client_t:s0:c10,c580 tclass=user_namespace permissive=1

        Was caused by:
                Missing type enforcement (TE) allow rule.

                You can use audit2allow to generate a loadable module to allow this access.

type=AVC msg=audit(1699352140.404:3253): avc:  denied  { create } for  pid=481506 comm=495043204C61756E6368 scontext=unconfined_u:unconfined_r:sandbox_web_client_t:s0:c10,c580 tcontext=unconfined_u:unconfined_r:sandbox_web_client_t:s0:c10,c580 tclass=user_namespace permissive=1

        Was caused by:
                Missing type enforcement (TE) allow rule.

                You can use audit2allow to generate a loadable module to allow this access.

type=AVC msg=audit(1699352146.594:3255): avc:  denied  { write } for  pid=481494 comm="Xephyr" path=2F6D656D66643A786F7267202864656C6574656429 dev="tmpfs" ino=92915 scontext=unconfined_u:unconfined_r:sandbox_xserver_t:s0:c10,c580 tcontext=unconfined_u:object_r:xserver_tmpfs_t:s0 tclass=file permissive=1

        Was caused by:
        The boolean xserver_clients_write_xshm was set incorrectly. 
        Description:
        Allows clients to write to the X server shared memory segments.

        Allow access by executing:
        # setsebool -P xserver_clients_write_xshm 1
type=AVC msg=audit(1699352146.594:3256): avc:  denied  { map } for  pid=481494 comm="Xephyr" path=2F6D656D66643A786F7267202864656C6574656429 dev="tmpfs" ino=92915 scontext=unconfined_u:unconfined_r:sandbox_xserver_t:s0:c10,c580 tcontext=unconfined_u:object_r:xserver_tmpfs_t:s0 tclass=file permissive=1

        Was caused by:
        The boolean domain_can_mmap_files was set incorrectly. 
        Description:
        Allow any process to mmap any file on system with attribute file_type.

        Allow access by executing:
        # setsebool -P domain_can_mmap_files 1


Reproducible: Always

Steps to Reproduce:
1. sandbox -t sandbox_web_t -X firefox
2.
3.

Comment 1 Zdenek Pytela 2023-11-08 12:51:29 UTC
@plautrba Can you show me all denials? One of the permission groups should already be allowed:

f39# rpm -q selinux-policy
selinux-policy-39.1-1.fc39.noarch

f39# sesearch -A -s sandbox_xserver_t -t xserver_tmpfs_t -c file -p map,write
allow domain file_type:file map; [ domain_can_mmap_files ]:True
allow sandbox_xserver_t xserver_tmpfs_t:file { map open write };

Comment 2 Zdenek Pytela 2023-11-13 14:49:54 UTC
I've update the PR. Note the map permission is allowed only when xserver_clients_write_xshm boolean is on.
You can try the builds in the PR, but I will create a new rawhide build soon if there are no objections.

Comment 3 Fedora Update System 2023-11-15 09:19:12 UTC
FEDORA-2023-a2dacfbdcb has been submitted as an update to Fedora 39. https://bodhi.fedoraproject.org/updates/FEDORA-2023-a2dacfbdcb

Comment 4 Fedora Update System 2023-11-16 04:13:31 UTC
FEDORA-2023-a2dacfbdcb has been pushed to the Fedora 39 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2023-a2dacfbdcb`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2023-a2dacfbdcb

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 5 Fedora Update System 2023-11-21 02:49:03 UTC
FEDORA-2023-a2dacfbdcb has been pushed to the Fedora 39 stable repository.
If problem still persists, please make note of it in this bug report.

Comment 6 Red Hat Bugzilla 2024-03-21 04:25:05 UTC
The needinfo request[s] on this closed bug have been removed as they have been unresolved for 120 days


Note You need to log in before you can comment on or make changes to this bug.