Bug 2321236 - gnome-remote-desktop-daemon triggers SELinux denial when enabling system VNC and RDP via grdctl
Summary: gnome-remote-desktop-daemon triggers SELinux denial when enabling system VNC ...
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy
Version: rawhide
Hardware: x86_64
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Zdenek Pytela
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2024-10-23 07:01 UTC by Milos Malik
Modified: 2024-11-18 17:17 UTC (History)
7 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2024-11-18 17:17:35 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Github fedora-selinux selinux-policy pull 2407 0 None open Allow gnome-remote-desktop watch /etc directory 2024-10-24 10:23:09 UTC

Description Milos Malik 2024-10-23 07:01:38 UTC
The gnome_remote_desktop_t is defined as permissive, which means that no actions are really blocked.

Reproducible: Always

Steps to Reproduce:
1. get a Fedora rawhide machine (targeted policy is active)
2. install both gdm and gnome-remote-desktop packages
3. start the gnome-remote-desktop service (possible failure can be ignored)
4. grdctl --system vnc enable
5. grdctl --system rdp enable
6. search for SELinux denials
Actual Results:  
----
type=PROCTITLE msg=audit(10/23/2024 02:51:35.701:987) : proctitle=/usr/libexec/gnome-remote-desktop-daemon --system 
type=PATH msg=audit(10/23/2024 02:51:35.701:987) : item=0 name=/etc/gnome-remote-desktop inode=276729 dev=fc:02 mode=dir,755 ouid=gnome-remote-desktop ogid=gnome-remote-desktop rdev=00:00 obj=system_u:object_r:etc_t:s0 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 
type=CWD msg=audit(10/23/2024 02:51:35.701:987) : cwd=/ 
type=SYSCALL msg=audit(10/23/2024 02:51:35.701:987) : arch=x86_64 syscall=inotify_add_watch success=yes exit=2 a0=0x3 a1=0x5620c104b9d0 a2=0x1002fce a3=0x5620c1003010 items=1 ppid=1 pid=3596 auid=unset uid=gnome-remote-desktop gid=gnome-remote-desktop euid=gnome-remote-desktop suid=gnome-remote-desktop fsuid=gnome-remote-desktop egid=gnome-remote-desktop sgid=gnome-remote-desktop fsgid=gnome-remote-desktop tty=(none) ses=unset comm=gnome-remote-de exe=/usr/libexec/gnome-remote-desktop-daemon subj=system_u:system_r:gnome_remote_desktop_t:s0 key=(null) 
type=AVC msg=audit(10/23/2024 02:51:35.701:987) : avc:  denied  { watch } for  pid=3596 comm=gnome-remote-de path=/etc/gnome-remote-desktop dev="vda2" ino=276729 scontext=system_u:system_r:gnome_remote_desktop_t:s0 tcontext=system_u:object_r:etc_t:s0 tclass=dir permissive=1 
----

Expected Results:  
no SELinux denials

Found by the following automated test:
 * https://src.fedoraproject.org/tests/selinux/pull-request/562


Note You need to log in before you can comment on or make changes to this bug.