Summary: SELinux is preventing /usr/libexec/telepathy-haze "search" access on 1. Detailed Description: SELinux denied access requested by telepathy-haze. It is not expected that this access is required by telepathy-haze and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. Allowing Access: You can generate a local policy module to allow this access - see FAQ (http://docs.fedoraproject.org/selinux-faq-fc5/#id2961385) Please file a bug report. Additional Information: Source Context unconfined_u:unconfined_r:telepathy_msn_t:s0-s0:c0 .c1023 Target Context system_u:system_r:init_t:s0 Target Objects 1 [ dir ] Source telepathy-haze Source Path /usr/libexec/telepathy-haze Port <Unknown> Host (removed) Source RPM Packages telepathy-haze-0.4.0-1.fc14 Target RPM Packages Policy RPM selinux-policy-3.9.0-2.fc14 Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Plugin Name catchall Host Name (removed) Platform Linux (removed) 2.6.35.4-12.fc14.x86_64 #1 SMP Fri Aug 27 07:45:05 UTC 2010 x86_64 x86_64 Alert Count 2 First Seen Fri 03 Sep 2010 02:00:44 PM EDT Last Seen Fri 03 Sep 2010 02:00:56 PM EDT Local ID 578c509b-3adc-413e-8aa1-19fa2f8f96e0 Line Numbers Raw Audit Messages node=(removed) type=AVC msg=audit(1283536856.857:453): avc: denied { search } for pid=22975 comm="telepathy-haze" name="1" dev=proc ino=8562 scontext=unconfined_u:unconfined_r:telepathy_msn_t:s0-s0:c0.c1023 tcontext=system_u:system_r:init_t:s0 tclass=dir node=(removed) type=SYSCALL msg=audit(1283536856.857:453): arch=c000003e syscall=89 success=no exit=-13 a0=7fff863f52b0 a1=7fff863f50b0 a2=200 a3=0 items=0 ppid=1 pid=22975 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=(none) ses=1 comm="telepathy-haze" exe="/usr/libexec/telepathy-haze" subj=unconfined_u:unconfined_r:telepathy_msn_t:s0-s0:c0.c1023 key=(null) Hash String generated from catchall,telepathy-haze,telepathy_msn_t,init_t,dir,search audit2allow suggests: #============= telepathy_msn_t ============== allow telepathy_msn_t init_t:dir search;
You can add these rules for now using # grep avc /var/log/audit/audit.log | audit2allow -M mypol # semodule -i mypol.pp Fixed in selinux-policy-3.9.2-2.fc14
selinux-policy-3.9.3-1.fc14 has been submitted as an update for Fedora 14. https://admin.fedoraproject.org/updates/selinux-policy-3.9.3-1.fc14
selinux-policy-3.9.3-1.fc14 has been pushed to the Fedora 14 testing repository. If problems still persist, please make note of it in this bug report. If you want to test the update, you can install it with su -c 'yum --enablerepo=updates-testing update selinux-policy'. You can provide feedback for this update here: https://admin.fedoraproject.org/updates/selinux-policy-3.9.3-1.fc14
selinux-policy-3.9.3-1.fc14 has been pushed to the Fedora 14 stable repository. If problems still persist, please make note of it in this bug report.
I have selinux-policy-3.9.5-5.fc14.noarch installed, and I'm still seeing this.
Reopening bug. Ditto. I have: selinux-policy-3.9.5-7.fc14.noarch ...and am still getting this.
Fixed in selinux-policy-3.9.5-9.fc14
selinux-policy-3.9.5-10.fc14 has been submitted as an update for Fedora 14. https://admin.fedoraproject.org/updates/selinux-policy-3.9.5-10.fc14
I have SELinux policy -10 and I'm still getting this error: [root@localhost ~]# rpm -qa | grep selinux-policy selinux-policy-targeted-3.9.5-10.fc14.noarch selinux-policy-3.9.5-10.fc14.noarch [root@localhost ~]# rpm -qa empathy empathy-2.32.0.1-1.fc14.x86_64 [root@localhost ~]# rpm -qa telepathy-haze telepathy-haze-0.4.0-1.fc14.x86_64
THis is because I have pulled telepathy.pp out of F14. If you remove the package it should work.
Chris and Dominick I want to make this policy optional for unconfined_t domains, but since we have a transition form dbus_session_domain, I can not do this. Any ideas how we could go about doing this?
selinux-policy-3.9.5-10.fc14 has been pushed to the Fedora 14 stable repository. If problems still persist, please make note of it in this bug report.
The issue is the dbus_session_domain attribute used in dbus_session_domain is assigned to all domains that call the dbus_role_template (like userdomains but also xdm_t and unconfined_t) I've been experimenting with domain prefixed dbus_session_domains instead so that we can more specifically define who can transition where: dbus_session_type, some_entry_file, some_domain versus somedomain_dbusd_t, some_entry_file, some_domain However this seems currently not possible due to duplicate declaration of "somedonain_dbusd_t" type or out of scope issues. So in my experience this prefixed type can only de used in one place. This issue is not only an issue for dbus_session_domain but also for the dbus_connect_session_bus. Many dbus session domains also use dbus connect session bus. This is also an issue for xserver (prefixes) In my view a solution would be to deal with that issue either by rearranging the interfaces/templates applicable or deal with the underlying issues that prevent the use of prefixed types in several places. I worked around this issue in a branch of mine by splitting the applicable dbus and xserver (role) templates/interfaces into delclarations and policy. Where the declarations are only called once. However this does not solve all issues , and i still ended up putting all involved application modules (modules user xserver and dbus) plus the dbus and xserver modules in the base module. Properly solve this issue, is in my view an important step towards user space confinement.
To show you how i think i dealt with this in a branch of mine: prerequisites: 1. dbus module must be in base. 2. telepathy module must be in base. other notes: This example not only deals with this specific issue but also other issues that will arise in user user space. The dbus_session_domain i used: ######################################## ## <summary> ## Allow a application domain to be started ## by the session dbus. ## </summary> ## <param name="role_prefix"> ## <summary> ## Domain allowed to transition. ## </summary> ## </param> ## <param name="target_domain"> ## <summary> ## Type to be used as a domain. ## </summary> ## </param> ## <param name="entry_point"> ## <summary> ## Type of the program to be used as an ## entry point to this domain. ## </summary> ## </param> # interface(`dbus_session_domain',` gen_require(` type $1_dbusd_t; ') domtrans_pattern($1_dbusd_t, $3, $2) dbus_session_bus_client($2) dbus_connect_session_bus($2) ') Note the usage of $1_dbusd_t type instead of dbus_session_type attribute: How i split up the dbus_role_template to avoid duplicate declarations of $1_dbusd_t: Split into 3 parts: 1. declarations 2. domain transition 3. policy ######################################## ## <summary> ## Role access for dbus declarations. ## </summary> ## <param name="role_prefix"> ## <summary> ## The prefix of the user role (e.g., user ## is the prefix for user_r). ## </summary> ## </param> ## <param name="role"> ## <summary> ## Role allowed access ## </summary> ## </param> # template(`dbus_declarations_role_template',` gen_require(` attribute session_bus_type; type session_dbusd_tmp_t, dbusd_exec_t; ') ############################## # # Delcarations # type $1_dbusd_t, session_bus_type; domain_type($1_dbusd_t) domain_entry_file($1_dbusd_t, dbusd_exec_t) ubac_constrained($1_dbusd_t) role $2 types $1_dbusd_t; ') ######################################## ## <summary> ## Role access for dbus domain transitions. ## </summary> ## <param name="role_prefix"> ## <summary> ## The prefix of the user role (e.g., user ## is the prefix for user_r). ## </summary> ## </param> ## <param name="domain"> ## <summary> ## domain allowed access ## </summary> ## </param> # template(`dbus_domtrans_role_template',` gen_require(` attribute session_bus_type; attribute dbusd_unconfined; type session_dbusd_tmp_t, dbusd_exec_t; type $1_dbusd_t, system_dbusd_t; ') ############################## # # Delcarations # allow $1_dbusd_t $2:process sigkill; allow $2 $1_dbusd_t:fd use; allow $2 $1_dbusd_t:fifo_file rw_fifo_file_perms; ps_process_pattern($2, $1_dbusd_t) allow $2 $1_dbusd_t:process { ptrace signal_perms }; allow $2 $1_dbusd_t:unix_stream_socket connectto; allow { dbusd_unconfined $2 } $1_dbusd_t:dbus { send_msg acquire_svc }; allow $2 system_dbusd_t:dbus { send_msg acquire_svc }; domtrans_pattern($2, dbusd_exec_t, $1_dbusd_t) ifdef(`hide_broken_symptoms',` dontaudit $2 $1_dbusd_t:netlink_selinux_socket rw_inherited_sock_file_perms; ') ') ######################################## ## <summary> ## Role access for dbus ## </summary> ## <param name="role_prefix"> ## <summary> ## The prefix of the user role (e.g., user ## is the prefix for user_r). ## </summary> ## </param> ## <param name="role"> ## <summary> ## Role allowed access ## </summary> ## </param> ## <param name="domain"> ## <summary> ## User domain for the role ## </summary> ## </param> # template(`dbus_role_template',` gen_require(` class dbus { send_msg acquire_svc }; type session_dbusd_tmp_t, dbusd_etc_t; type session_dbusd_home_t, $1_dbusd_t; type $1_t; ') ############################## # # Local policy # allow $1_dbusd_t self:process { getattr sigkill signal }; dontaudit $1_dbusd_t self:process ptrace; allow $1_dbusd_t self:file { getattr read write }; allow $1_dbusd_t self:fifo_file rw_fifo_file_perms; allow $1_dbusd_t self:dbus { send_msg acquire_svc }; allow $1_dbusd_t self:unix_stream_socket create_stream_socket_perms; allow $1_dbusd_t self:unix_dgram_socket create_socket_perms; allow $1_dbusd_t self:tcp_socket create_stream_socket_perms; allow $1_dbusd_t self:netlink_selinux_socket create_socket_perms; allow $1_dbusd_t dbusd_etc_t:dir list_dir_perms; read_files_pattern($1_dbusd_t, dbusd_etc_t, dbusd_etc_t) read_lnk_files_pattern($1_dbusd_t, dbusd_etc_t, dbusd_etc_t) manage_dirs_pattern($1_dbusd_t, session_dbusd_home_t, session_dbusd_home_t) manage_files_pattern($1_dbusd_t, session_dbusd_home_t, session_dbusd_home_t) userdom_user_home_dir_filetrans($1_dbusd_t, session_dbusd_home_t, { dir file }) manage_dirs_pattern($1_dbusd_t, session_dbusd_tmp_t, session_dbusd_tmp_t) manage_files_pattern($1_dbusd_t, session_dbusd_tmp_t, session_dbusd_tmp_t) files_tmp_filetrans($1_dbusd_t, session_dbusd_tmp_t, { file dir }) corecmd_shell_domtrans($1_dbusd_t, $1_t) corecmd_bin_domtrans($1_dbusd_t, $1_t) kernel_read_system_state($1_dbusd_t) kernel_read_kernel_sysctls($1_dbusd_t) corecmd_list_bin($1_dbusd_t) corecmd_read_bin_symlinks($1_dbusd_t) corecmd_read_bin_files($1_dbusd_t) corecmd_read_bin_pipes($1_dbusd_t) corecmd_read_bin_sockets($1_dbusd_t) corenet_all_recvfrom_unlabeled($1_dbusd_t) corenet_all_recvfrom_netlabel($1_dbusd_t) corenet_tcp_sendrecv_generic_if($1_dbusd_t) corenet_tcp_sendrecv_generic_node($1_dbusd_t) corenet_tcp_sendrecv_all_ports($1_dbusd_t) corenet_tcp_bind_generic_node($1_dbusd_t) # corenet_tcp_bind_reserved_port($1_dbusd_t) dev_read_urand($1_dbusd_t) domain_use_interactive_fds($1_dbusd_t) domain_read_all_domains_state($1_dbusd_t) files_read_etc_files($1_dbusd_t) files_list_home($1_dbusd_t) files_read_usr_files($1_dbusd_t) files_dontaudit_search_var($1_dbusd_t) fs_getattr_romfs($1_dbusd_t) fs_getattr_xattr_fs($1_dbusd_t) fs_list_inotifyfs($1_dbusd_t) fs_dontaudit_list_nfs($1_dbusd_t) selinux_get_fs_mount($1_dbusd_t) selinux_validate_context($1_dbusd_t) selinux_compute_access_vector($1_dbusd_t) selinux_compute_create_context($1_dbusd_t) selinux_compute_relabel_context($1_dbusd_t) selinux_compute_user_contexts($1_dbusd_t) auth_read_pam_console_data($1_dbusd_t) auth_use_nsswitch($1_dbusd_t) logging_send_audit_msgs($1_dbusd_t) logging_send_syslog_msg($1_dbusd_t) miscfiles_read_localization($1_dbusd_t) seutil_read_config($1_dbusd_t) seutil_read_default_contexts($1_dbusd_t) term_use_all_terms($1_dbusd_t) userdom_dontaudit_search_admin_dir($1_dbusd_t) gnome_read_gconf_home_files($1_dbusd_t) gnome_search_generic_data_dirs($1_dbusd_t) optional_policy(` hal_dbus_chat($1_dbusd_t) ') optional_policy(` xserver_use_xdm_fds($1_dbusd_t) xserver_rw_xdm_pipes($1_dbusd_t) ') ') How this is used in my telepathy module: ######################################## ## <summary> ## Role access for Telepathy. ## </summary> ## <param name="role_prefix"> ## <summary> ## Prefix to be used. ## </summary> ## </param> ## <param name="user_role"> ## <summary> ## Role allowed access. ## </summary> ## </param> ## <param name="user_domain"> ## <summary> ## User domain for the role. ## </summary> ## </param> # interface(`telepathy_role',` gen_require(` attribute tp_domain; attribute tp_mission_control_domain; type tp_butterfly_exec_t, tp_gabble_exec_t, tp_haze_exec_t; type tp_idle_exec_t, tp_mission_control_exec_t, tp_salut_exec_t; type tp_sofiasip_exec_t, tp_stream_engine_exec_t, tp_sunshine_exec_t; type tp_butterfly_tmp_t, tp_gabble_tmp_t, tp_gabble_cache_home_t; type tp_haze_tmp_t, tp_mission_control_home_t, tp_mission_control_cache_home_t; type tp_salut_tmp_t, tp_sunshine_tmp_t; ') ######################################## # # Telepathy global shared declarations. # ## <desc> ## <p> ## Allow the Telepathy connection managers ## to connect to any generic TCP port. This ## is used for Audio, video stream, desktop ## sharing and file transfers. ## </p> ## </desc> gen_tunable(telepathy_$1_tcp_connect_generic_network_ports, false) ## <desc> ## <p> ## Enable Telepathy networking. ## This enables basic functionality. ## </p> ## </desc> gen_tunable(telepathy_$1_network_connect, false) ######################################## # # Telepathy Butterfly shared declarations. # type $1_tp_butterfly_t, tp_domain; application_domain($1_tp_butterfly_t, tp_butterfly_exec_t) dbus_session_domain($1, $1_tp_butterfly_t, tp_butterfly_exec_t) ubac_constrained($1_tp_butterfly_t) role $2 types $1_tp_butterfly_t; ######################################## # # Telepathy Gabble shared declarations. # type $1_tp_gabble_t, tp_domain; application_domain($1_tp_gabble_t, tp_gabble_exec_t) dbus_session_domain($1, $1_tp_gabble_t, tp_gabble_exec_t) ubac_constrained($1_tp_gabble_t) role $2 types $1_tp_gabble_t; ######################################## # # Telepathy Haze shared declarations. # type $1_tp_haze_t, tp_domain; application_domain($1_tp_haze_t, tp_haze_exec_t) dbus_session_domain($1, $1_tp_haze_t, tp_haze_exec_t) ubac_constrained($1_tp_haze_t) role $2 types $1_tp_haze_t; ######################################## # # Telepathy Idle shared declarations. # type $1_tp_idle_t, tp_domain; application_domain($1_tp_idle_t, tp_idle_exec_t) dbus_session_domain($1, $1_tp_idle_t, tp_idle_exec_t) ubac_constrained($1_tp_idle_t) role $2 types $1_tp_idle_t; ######################################## # # Telepathy Mission-Control shared declarations. # type $1_tp_mission_control_t, tp_domain, tp_mission_control_domain; application_domain($1_tp_mission_control_t, tp_mission_control_exec_t) dbus_session_domain($1, $1_tp_mission_control_t, tp_mission_control_exec_t) ubac_constrained($1_tp_mission_control_t) role $2 types $1_tp_mission_control_t; ######################################## # # Telepathy Salut shared declarations. # type $1_tp_salut_t, tp_domain; application_domain($1_tp_salut_t, tp_salut_exec_t) dbus_session_domain($1, $1_tp_salut_t, tp_salut_exec_t) ubac_constrained($1_tp_salut_t) role $2 types $1_tp_salut_t; ######################################## # # Telepathy Sofiasip shared declarations. # type $1_tp_sofiasip_t, tp_domain; application_domain($1_tp_sofiasip_t, tp_sofiasip_exec_t) dbus_session_domain($1, $1_tp_sofiasip_t, tp_sofiasip_exec_t) ubac_constrained($1_tp_sofiasip_t) role $2 types $1_tp_sofiasip_t; ######################################## # # Telepathy Stream-Engine shared declarations. # type $1_tp_stream_engine_t, tp_domain; application_domain($1_tp_stream_engine_t, tp_stream_engine_exec_t) dbus_session_domain($1, $1_tp_stream_engine_t, tp_stream_engine_exec_t) ubac_constrained($1_tp_stream_engine_t) role $2 types $1_tp_stream_engine_t; ######################################## # # Telepathy Sunshine shared declarations. # type $1_tp_sunshine_t, tp_domain; application_domain($1_tp_sunshine_t, tp_sunshine_exec_t) dbus_session_domain($1, $1_tp_sunshine_t, tp_sunshine_exec_t) ubac_constrained($1_tp_sunshine_t) role $2 types $1_tp_sunshine_t; ######################################## # # Telepathy global shared policy. # allow tp_domain self:process { getsched signal }; allow tp_domain self:fifo_file rw_fifo_file_perms; tunable_policy(`telepathy_$1_network_connect',` corenet_all_recvfrom_netlabel(tp_domain) corenet_all_recvfrom_unlabeled(tp_domain) corenet_raw_bind_generic_node(tp_domain) corenet_raw_sendrecv_generic_if(tp_domain) corenet_raw_sendrecv_generic_node(tp_domain) corenet_tcp_bind_generic_node(tp_domain) corenet_tcp_sendrecv_generic_if(tp_domain) corenet_tcp_sendrecv_generic_node(tp_domain) corenet_tcp_sendrecv_all_ports(tp_domain) corenet_udp_bind_generic_node(tp_domain) corenet_udp_sendrecv_generic_if(tp_domain) corenet_udp_sendrecv_generic_node(tp_domain) corenet_udp_sendrecv_all_ports(tp_domain) ') fs_search_auto_mountpoints(tp_domain) miscfiles_read_localization(tp_domain) telepathy_dbus_chat_gabble($1, $3) telepathy_dbus_chat_haze($1, $3) telepathy_dbus_chat_salut($1, $3) telepathy_dbus_chat_idle($1, $3) telepathy_dbus_chat_mc($1, $3) telepathy_dbus_chat_se($1, $3) telepathy_dbus_chat_sunshine($1, $3) telepathy_dbus_chat_sofiasip($1, $3) telepathy_dbus_chat_butterfly($1, $3) userdom_stream_connect($1, tp_domain) userdom_use_user_terminals(tp_domain) tunable_policy(`telepathy_$1_tcp_connect_generic_network_ports',` corenet_tcp_connect_generic_port(tp_domain) corenet_sendrecv_generic_client_packets(tp_domain) ') optional_policy(` automount_dontaudit_getattr_tmp_dirs(tp_domain) ') optional_policy(` nis_use_ypbind(tp_domain) ') optional_policy(` xserver_rw_xdm_pipes(tp_domain) ') ######################################## # # Telepathy Butterfly shared policy. # allow $1_tp_butterfly_t self:netlink_route_socket create_netlink_socket_perms; allow $1_tp_butterfly_t self:tcp_socket create_socket_perms; allow $1_tp_butterfly_t self:udp_socket create_socket_perms; allow $1_tp_butterfly_t self:unix_dgram_socket create_socket_perms; domtrans_pattern($3, tp_butterfly_exec_t, $1_tp_butterfly_t) allow $3 $1_tp_butterfly_t:process { ptrace signal_perms }; ps_process_pattern($3, $1_tp_butterfly_t) gnome_filetrans_gconfd_tmp($1_tp_butterfly_t, tp_butterfly_tmp_t, sock_file) # this is for haze. manage_dirs_pattern($1_tp_butterfly_t, tp_butterfly_tmp_t, tp_butterfly_tmp_t) manage_files_pattern($1_tp_butterfly_t, tp_butterfly_tmp_t, tp_butterfly_tmp_t) manage_sock_files_pattern($1_tp_butterfly_t, tp_butterfly_tmp_t, tp_butterfly_tmp_t) exec_files_pattern($1_tp_butterfly_t, tp_butterfly_tmp_t, tp_butterfly_tmp_t) files_tmp_filetrans($1_tp_butterfly_t, tp_butterfly_tmp_t, { dir file sock_file }) tunable_policy(`telepathy_$1_network_connect',` corenet_sendrecv_http_client_packets($1_tp_butterfly_t) corenet_sendrecv_msnp_client_packets($1_tp_butterfly_t) corenet_tcp_connect_http_port($1_tp_butterfly_t) corenet_tcp_connect_msnp_port($1_tp_butterfly_t) corenet_tcp_sendrecv_http_port($1_tp_butterfly_t) corenet_tcp_sendrecv_msnp_port($1_tp_butterfly_t) ') #uname corecmd_exec_bin($1_tp_butterfly_t) corecmd_exec_shell($1_tp_butterfly_t) corecmd_read_bin_symlinks($1_tp_butterfly_t) kernel_read_system_state($1_tp_butterfly_t) dev_read_urand($1_tp_butterfly_t) files_read_etc_files($1_tp_butterfly_t) gnome_read_gconf_home_files($1_tp_butterfly_t) gnome_stream_connect_gvfsd($1, $1_tp_butterfly_t) gnome_rw_inherited_stream_sockets_gvfsd($1, $1_tp_butterfly_t) # this is for haze. gnome_dontaudit_setattr_tmp_dirs_gconfd($1_tp_butterfly_t) libs_exec_ldconfig($1_tp_butterfly_t) logging_send_syslog_msg($1_tp_butterfly_t) sysnet_read_config($1_tp_butterfly_t) telepathy_dbus_chat_gabble($1, $1_tp_butterfly_t) telepathy_dbus_chat_haze($1, $1_tp_butterfly_t) telepathy_dbus_chat_salut($1, $1_tp_butterfly_t) telepathy_dbus_chat_idle($1, $1_tp_butterfly_t) telepathy_dbus_chat_mc($1, $1_tp_butterfly_t) telepathy_dbus_chat_se($1, $1_tp_butterfly_t) telepathy_dbus_chat_sunshine($1, $1_tp_butterfly_t) telepathy_dbus_chat_sofiasip($1, $1_tp_butterfly_t) tunable_policy(`use_nfs_home_dirs',` fs_list_nfs($1_tp_butterfly_t) fs_read_nfs_files($1_tp_butterfly_t) ') tunable_policy(`use_samba_home_dirs',` fs_list_cifs($1_tp_butterfly_t) fs_read_cifs_files($1_tp_butterfly_t) ') optional_policy(` abrt_read_config($1_tp_butterfly_t) ') ######################################## # # Telepathy Gabble shared policy. # allow $1_tp_gabble_t self:netlink_route_socket create_netlink_socket_perms; allow $1_tp_gabble_t self:tcp_socket create_stream_socket_perms; allow $1_tp_gabble_t self:udp_socket create_socket_perms; allow $1_tp_gabble_t self:unix_dgram_socket { create_socket_perms sendto }; domtrans_pattern($3, tp_gabble_exec_t, $1_tp_gabble_t) allow $3 $1_tp_gabble_t:process { ptrace signal_perms }; ps_process_pattern($3, $1_tp_gabble_t) manage_dirs_pattern($1_tp_gabble_t, tp_gabble_tmp_t, tp_gabble_tmp_t) manage_sock_files_pattern($1_tp_gabble_t, tp_gabble_tmp_t, tp_gabble_tmp_t) files_tmp_filetrans($1_tp_gabble_t, tp_gabble_tmp_t, { dir sock_file }) manage_dirs_pattern($1_tp_gabble_t, tp_gabble_cache_home_t, tp_gabble_cache_home_t) manage_files_pattern($1_tp_gabble_t, tp_gabble_cache_home_t, tp_gabble_cache_home_t) gnome_cache_filetrans($1_tp_gabble_t, tp_gabble_cache_home_t, { dir file }) tunable_policy(`telepathy_$1_network_connect',` corenet_sendrecv_jabber_client_client_packets($1_tp_gabble_t) corenet_tcp_connect_jabber_client_port($1_tp_gabble_t) corenet_tcp_sendrecv_jabber_client_port($1_tp_gabble_t) corenet_sendrecv_http_client_packets($1_tp_gabble_t) corenet_tcp_connect_http_port($1_tp_gabble_t) corenet_tcp_sendrecv_http_port($1_tp_gabble_t) corenet_sendrecv_vnc_client_packets($1_tp_gabble_t) corenet_tcp_connect_vnc_port($1_tp_gabble_t) corenet_tcp_sendrecv_vnc_port($1_tp_gabble_t) corenet_sendrecv_commplex_client_packets($1_tp_gabble_t) corenet_tcp_connect_commplex_port($1_tp_gabble_t) corenet_tcp_sendrecv_commplex_port($1_tp_gabble_t) ') dev_read_rand($1_tp_gabble_t) dev_read_urand($1_tp_gabble_t) files_read_etc_files($1_tp_gabble_t) files_read_usr_files($1_tp_gabble_t) miscfiles_read_certs($1_tp_gabble_t) sysnet_read_config($1_tp_gabble_t) dbus_system_bus_client($1_tp_gabble_t) gnome_search_generic_config_dirs($1_tp_gabble_t) telepathy_dbus_chat_haze($1, $1_tp_gabble_t) telepathy_dbus_chat_salut($1, $1_tp_gabble_t) telepathy_dbus_chat_idle($1, $1_tp_gabble_t) telepathy_dbus_chat_mc($1, $1_tp_gabble_t) telepathy_dbus_chat_se($1, $1_tp_gabble_t) telepathy_dbus_chat_sunshine($1, $1_tp_gabble_t) telepathy_dbus_chat_sofiasip($1, $1_tp_gabble_t) telepathy_dbus_chat_butterfly($1, $1_tp_gabble_t) telepathy_gabble_stream_connect($1, $3) gnome_dbus_chat_gvfsd($1, $1_tp_gabble_t) tunable_policy(`use_nfs_home_dirs',` fs_manage_nfs_dirs($1_tp_gabble_t) fs_manage_nfs_files($1_tp_gabble_t) ') tunable_policy(`use_samba_home_dirs',` fs_manage_cifs_dirs($1_tp_gabble_t) fs_manage_cifs_files($1_tp_gabble_t) ') ######################################## # # Telepathy Haze shared policy. # allow $1_tp_haze_t self:process setsched; allow $1_tp_haze_t self:tcp_socket create_socket_perms; allow $1_tp_haze_t self:udp_socket create_socket_perms; domtrans_pattern($3, tp_haze_exec_t, $1_tp_haze_t) allow $3 $1_tp_haze_t:process { ptrace signal_perms }; ps_process_pattern($3, $1_tp_haze_t) manage_dirs_pattern($1_tp_haze_t, tp_haze_tmp_t, tp_haze_tmp_t) manage_files_pattern($1_tp_haze_t, tp_haze_tmp_t, tp_haze_tmp_t) files_tmp_filetrans($1_tp_haze_t, tp_haze_tmp_t, { dir file }) dev_read_urand($1_tp_haze_t) files_read_etc_files($1_tp_haze_t) files_read_usr_files($1_tp_haze_t) sysnet_read_config($1_tp_haze_t) dbus_system_bus_client($1_tp_haze_t) gnome_read_gconf_home_files($1_tp_haze_t) telepathy_dbus_chat_gabble($1, $1_tp_haze_t) telepathy_dbus_chat_salut($1, $1_tp_haze_t) telepathy_dbus_chat_idle($1, $1_tp_haze_t) telepathy_dbus_chat_mc($1, $1_tp_haze_t) telepathy_dbus_chat_se($1, $1_tp_haze_t) telepathy_dbus_chat_sunshine($1, $1_tp_haze_t) telepathy_dbus_chat_sofiasip($1, $1_tp_haze_t) telepathy_dbus_chat_butterfly($1, $1_tp_haze_t) ######################################## # # Telepathy Idle shared policy. # allow $1_tp_idle_t self:netlink_route_socket create_netlink_socket_perms; allow $1_tp_idle_t self:tcp_socket create_socket_perms; allow $1_tp_idle_t self:udp_socket create_socket_perms; domtrans_pattern($3, tp_idle_exec_t, $1_tp_idle_t) allow $3 $1_tp_idle_t:process { ptrace signal_perms }; ps_process_pattern($3, $1_tp_idle_t) tunable_policy(`telepathy_$1_network_connect',` corenet_sendrecv_ircd_client_packets($1_tp_idle_t) corenet_tcp_connect_ircd_port($1_tp_idle_t) corenet_tcp_sendrecv_ircd_port($1_tp_idle_t) ') files_read_etc_files($1_tp_idle_t) sysnet_read_config($1_tp_idle_t) telepathy_dbus_chat_gabble($1, $1_tp_idle_t) telepathy_dbus_chat_haze($1, $1_tp_idle_t) telepathy_dbus_chat_salut($1, $1_tp_idle_t) telepathy_dbus_chat_mc($1, $1_tp_idle_t) telepathy_dbus_chat_se($1, $1_tp_idle_t) telepathy_dbus_chat_sunshine($1, $1_tp_idle_t) telepathy_dbus_chat_sofiasip($1, $1_tp_idle_t) telepathy_dbus_chat_butterfly($1, $1_tp_idle_t) ######################################## # # Telepathy Mission-Control shared policy. # domtrans_pattern($3, tp_mission_control_exec_t, $1_tp_mission_control_t) allow $3 $1_tp_mission_control_t:process { ptrace signal_perms }; ps_process_pattern($3, $1_tp_mission_control_t) manage_dirs_pattern($1_tp_mission_control_t, tp_mission_control_home_t, tp_mission_control_home_t) manage_files_pattern($1_tp_mission_control_t, tp_mission_control_home_t, tp_mission_control_home_t) userdom_user_home_dir_filetrans($1_tp_mission_control_t, tp_mission_control_home_t, { dir file }) manage_files_pattern($1_tp_mission_control_t, tp_mission_control_cache_home_t, tp_mission_control_cache_home_t) gnome_cache_filetrans($1_tp_mission_control_t, tp_mission_control_cache_home_t, file) auth_use_nsswitch($1_tp_mission_control_t) dev_read_rand($1_tp_mission_control_t) files_read_etc_files($1_tp_mission_control_t) files_read_usr_files($1_tp_mission_control_t) gnome_dbus_chat_gnomekeyringd($1_tp_mission_control_t) gnome_read_gconf_home_files($1_tp_mission_control_t) gnome_search_generic_data_dirs($1_tp_mission_control_t) gnome_setattr_cache_home_dir($1_tp_mission_control_t) telepathy_dbus_chat_gabble($1, $1_tp_mission_control_t) telepathy_dbus_chat_haze($1, $1_tp_mission_control_t) telepathy_dbus_chat_salut($1, $1_tp_mission_control_t) telepathy_dbus_chat_idle($1, $1_tp_mission_control_t) telepathy_dbus_chat_se($1, $1_tp_mission_control_t) telepathy_dbus_chat_sunshine($1, $1_tp_mission_control_t) telepathy_dbus_chat_sofiasip($1, $1_tp_mission_control_t) telepathy_dbus_chat_butterfly($1, $1_tp_mission_control_t) tunable_policy(`use_nfs_home_dirs',` fs_manage_nfs_dirs($1_tp_mission_control_t) fs_manage_nfs_files($1_tp_mission_control_t) ') tunable_policy(`use_samba_home_dirs',` fs_manage_cifs_dirs($1_tp_mission_control_t) fs_manage_cifs_files($1_tp_mission_control_t) ') optional_policy(` nscd_socket_use($1_tp_mission_control_t) ') ######################################## # # Telepathy Salut shared policy. # allow $1_tp_salut_t self:netlink_route_socket create_netlink_socket_perms; allow $1_tp_salut_t self:tcp_socket create_stream_socket_perms; allow $1_tp_salut_t self:udp_socket create_socket_perms; domtrans_pattern($3, tp_salut_exec_t, $1_tp_salut_t) allow $3 $1_tp_salut_t:process { ptrace signal_perms }; ps_process_pattern($3, $1_tp_salut_t) manage_sock_files_pattern($1_tp_salut_t, tp_salut_tmp_t, tp_salut_tmp_t) files_tmp_filetrans($1_tp_salut_t, tp_salut_tmp_t, sock_file) tunable_policy(`telepathy_$1_network_connect',` corenet_sendrecv_presence_server_packets($1_tp_salut_t) corenet_sendrecv_presence_client_packets($1_tp_salut_t) corenet_tcp_bind_presence_port($1_tp_salut_t) corenet_tcp_connect_presence_port($1_tp_salut_t) corenet_tcp_sendrecv_presence_port($1_tp_salut_t) ') dev_read_urand($1_tp_salut_t) files_read_etc_files($1_tp_salut_t) sysnet_read_config($1_tp_salut_t) dbus_system_bus_client($1_tp_salut_t) avahi_dbus_chat($1_tp_salut_t) telepathy_dbus_chat_gabble($1, $1_tp_salut_t) telepathy_dbus_chat_haze($1, $1_tp_salut_t) telepathy_dbus_chat_idle($1, $1_tp_salut_t) telepathy_dbus_chat_mc($1, $1_tp_salut_t) telepathy_dbus_chat_se($1, $1_tp_salut_t) telepathy_dbus_chat_sunshine($1, $1_tp_salut_t) telepathy_dbus_chat_sofiasip($1, $1_tp_salut_t) telepathy_dbus_chat_butterfly($1, $1_tp_salut_t) telepathy_salut_stream_connect($1, $3) ######################################## # # Telepathy Sofiasip shared policy. # allow $1_tp_sofiasip_t self:netlink_route_socket create_netlink_socket_perms; allow $1_tp_sofiasip_t self:rawip_socket create_stream_socket_perms; allow $1_tp_sofiasip_t self:tcp_socket create_stream_socket_perms; allow $1_tp_sofiasip_t self:udp_socket create_socket_perms; domtrans_pattern($3, tp_sofiasip_exec_t, $1_tp_sofiasip_t) allow $3 $1_tp_sofiasip_t:process { ptrace signal_perms }; ps_process_pattern($3, $1_tp_sofiasip_t) tunable_policy(`telepathy_$1_network_connect',` corenet_sendrecv_sip_client_packets($1_tp_sofiasip_t) corenet_tcp_connect_sip_port($1_tp_sofiasip_t) corenet_tcp_sendrecv_sip_port($1_tp_sofiasip_t) ') kernel_request_load_module($1_tp_sofiasip_t) dev_read_urand($1_tp_sofiasip_t) sysnet_read_config($1_tp_sofiasip_t) telepathy_dbus_chat_gabble($1, $1_tp_sofiasip_t) telepathy_dbus_chat_haze($1, $1_tp_sofiasip_t) telepathy_dbus_chat_salut($1, $1_tp_sofiasip_t) telepathy_dbus_chat_idle($1, $1_tp_sofiasip_t) telepathy_dbus_chat_mc($1, $1_tp_sofiasip_t) telepathy_dbus_chat_se($1, $1_tp_sofiasip_t) telepathy_dbus_chat_sunshine($1, $1_tp_sofiasip_t) telepathy_dbus_chat_butterfly($1, $1_tp_sofiasip_t) ######################################## # # Telepathy Stream-Engine shared policy. # domtrans_pattern($3, tp_stream_engine_exec_t, $1_tp_stream_engine_t) allow $3 $1_tp_stream_engine_t:process { ptrace signal_perms }; ps_process_pattern($3, $1_tp_stream_engine_t) telepathy_dbus_chat_gabble($1, $1_tp_stream_engine_t) telepathy_dbus_chat_haze($1, $1_tp_stream_engine_t) telepathy_dbus_chat_salut($1, $1_tp_stream_engine_t) telepathy_dbus_chat_idle($1, $1_tp_stream_engine_t) telepathy_dbus_chat_mc($1, $1_tp_stream_engine_t) telepathy_dbus_chat_sunshine($1, $1_tp_stream_engine_t) telepathy_dbus_chat_sofiasip($1, $1_tp_stream_engine_t) telepathy_dbus_chat_butterfly($1, $1_tp_stream_engine_t) ######################################## # # Telepathy Sunshine shared policy. # domtrans_pattern($3, tp_sunshine_exec_t, $1_tp_sunshine_t) allow $3 $1_tp_sunshine_t:process { ptrace signal_perms }; ps_process_pattern($3, $1_tp_sunshine_t) manage_files_pattern($1_tp_sunshine_t, tp_sunshine_tmp_t, tp_sunshine_tmp_t) exec_files_pattern($1_tp_sunshine_t, tp_sunshine_tmp_t, tp_sunshine_tmp_t) files_tmp_filetrans($1_tp_sunshine_t, tp_sunshine_tmp_t, file) corecmd_list_bin($1_tp_sunshine_t) kernel_read_system_state($1_tp_sunshine_t) dev_read_urand($1_tp_sunshine_t) files_read_etc_files($1_tp_sunshine_t) files_read_usr_files($1_tp_sunshine_t) telepathy_dbus_chat_gabble($1, $1_tp_sunshine_t) telepathy_dbus_chat_haze($1, $1_tp_sunshine_t) telepathy_dbus_chat_salut($1, $1_tp_sunshine_t) telepathy_dbus_chat_idle($1, $1_tp_sunshine_t) telepathy_dbus_chat_mc($1, $1_tp_sunshine_t) telepathy_dbus_chat_se($1, $1_tp_sunshine_t) telepathy_dbus_chat_sofiasip($1, $1_tp_sunshine_t) telepathy_dbus_chat_butterfly($1, $1_tp_sunshine_t) optional_policy(` xserver_read_xdm_pid($1_tp_sunshine_t) xserver_stream_connect($1_tp_sunshine_t) ') ') And how i dealt with this in the userdomain (userdom_restricted_xwindows_user_template): Note: this is not optional: dbus_declarations_role_template($1, $1_r) dbus_domtrans_role_template($1, $1_usertype) dbus_role_template($1, $1_r, $1_usertype) dbus_system_bus_client($1_usertype) dbus_manage_session_home($1_usertype) dbus_relabel_session_home($1_usertype) dbus_manage_session_tmp($1_usertype) dbus_relabel_session_tmp($1_usertype) allow $1_usertype $1_usertype:dbus send_msg; telepathy_role($1, $1_r, $1_t) ¥he example abovve deals with 2 issues (which in my view should both be addressed: 1. using prefixed types in other modules ($1_dbusd_t) 2. allowing transparent domain transition example: 1. imagine a confined firefox and confine thunderbird. 2. thunderbird can run firefox and firefox can run thunderbird. 3. how can we fasicilate that with keeping prefixes: (dgrift_t -> firefox_exec_t -> [dgrift_firefox_t) -> thunderbird_exec_t -> (dgrift_thunderbird_t] -> firefox_exec_t -> dgrift_firefox_t) (etc, etc, etc) It is kind of hard to explain and understand the issues i am trying to highlight without trying it out. Also should be noted that these issues are encountered/experimented with, with Fedora policy. Refpolicy may behave differently.
I'm still seeing this with telepathy-haze-0.4.0-1.fc14.x86_64 and selinux-policy-3.9.5-10.fc14.noarch.
Try one of the newer packages it should not transition any longer.