'allow XXXX udev_tdb_t:dir r_dir_perms' needed...

[Tom London]

Running strict/enforcing, latest Rawhide....

X fails to come up, etc.

Looks like 
    allow XXXX udev_tdb_t:dir r_dir_perms;
is needed pretty generally, especially
for xdm_t, xdm_server_t, ptal_t, pam_console_t,
lvm_t, hald_t, gpm_t, cupsd_t.  Even
user_t seems to want it for configuring esd.

Should this be added to  macros somewhere?

tom

[Daniel J Walsh]

Tom London wrote:
> Running strict/enforcing, latest Rawhide....
>
> X fails to come up, etc.
>
> Looks like 
>    allow XXXX udev_tdb_t:dir r_dir_perms;
> is needed pretty generally, especially
> for xdm_t, xdm_server_t, ptal_t, pam_console_t,
> lvm_t, hald_t, gpm_t, cupsd_t.  Even
> user_t seems to want it for configuring esd.
>
> Should this be added to  macros somewhere?
>
> tom

Does this solve the problem?

diff -u global_macros.te~ global_macros.te
--- global_macros.te~   2004-12-22 11:18:14.000000000 -0500
+++ global_macros.te    2004-12-22 12:56:43.883461279 -0500
@@ -242,7 +242,7 @@
 allow $1_t { self proc_t }:dir r_dir_perms;
 allow $1_t { self proc_t }:lnk_file read;

-allow $1_t device_t:dir { getattr search };
+r_dir_file($1_t, device_t)
 allow $1_t null_device_t:chr_file rw_file_perms;
 dontaudit $1_t console_device_t:chr_file rw_file_perms;
 dontaudit $1_t unpriv_userdomain:fd use;

[Tom London]

On Wed, 22 Dec 2004 12:58:23 -0500, Daniel J Walsh  wrote:
> Tom London wrote:
>
> Does this solve the problem?
>
> diff -u global_macros.te~ global_macros.te
> --- global_macros.te~   2004-12-22 11:18:14.000000000 -0500
> +++ global_macros.te    2004-12-22 12:56:43.883461279 -0500
> @@ -242,7 +242,7 @@
>  allow $1_t { self proc_t }:dir r_dir_perms;
>  allow $1_t { self proc_t }:lnk_file read;
>
> -allow $1_t device_t:dir { getattr search };
> +r_dir_file($1_t, device_t)
>  allow $1_t null_device_t:chr_file rw_file_perms;
>  dontaudit $1_t console_device_t:chr_file rw_file_perms;
>  dontaudit $1_t unpriv_userdomain:fd use;

Dan,

I'm at work, so I'll test this later.

Since the AVCs had read/getattr denials
for udev_tdb_t (not device_t), I would think
that we would need a fix like this:
> +r_dir_file($1_t, { device_t udev_tdb_t })

Am I missing something obvious?

tom

[Daniel J Walsh]

Tom London wrote:
> On Wed, 22 Dec 2004 12:58:23 -0500, Daniel J Walsh  wrote:
> > Tom London wrote:
> >
> > Does this solve the problem?
> >
> > diff -u global_macros.te~ global_macros.te
> > --- global_macros.te~   2004-12-22 11:18:14.000000000 -0500
> > +++ global_macros.te    2004-12-22 12:56:43.883461279 -0500
> > @@ -242,7 +242,7 @@
> > allow $1_t { self proc_t }:dir r_dir_perms;
> > allow $1_t { self proc_t }:lnk_file read;
> >
> > -allow $1_t device_t:dir { getattr search };
> > +r_dir_file($1_t, device_t)
> > allow $1_t null_device_t:chr_file rw_file_perms;
> > dontaudit $1_t console_device_t:chr_file rw_file_perms;
> > dontaudit $1_t unpriv_userdomain:fd use;
>
> Dan,
>
> I'm at work, so I'll test this later.
>
> Since the AVCs had read/getattr denials
> for udev_tdb_t (not device_t), I would think
> that we would need a fix like this:
> > +r_dir_file($1_t, { device_t udev_tdb_t })
>
> Am I missing something obvious?
>
> tom

No but I am :^)  r_dir_file($1_t, udev_tdb_t) is probably sufficient

[Tom London]

On Wed, 22 Dec 2004 13:52:36 -0500, Daniel J Walsh  wrote:
> >
>
> No but I am :^)  r_dir_file($1_t, udev_tdb_t) is probably sufficient

Dan,

Sorry, but that didn't quite work.

Here's what seems to get rhgb and X running again:

global_macros.te:
allow $1_t { self proc_t }:dir r_dir_perms;
allow $1_t { self proc_t }:lnk_file read;

+allow $1_t { device_t udev_tdb_t }:dir { getattr search };
allow $1_t null_device_t:chr_file rw_file_perms;
dontaudit $1_t console_device_t:chr_file rw_file_perms;
dontaudit $1_t unpriv_userdomain:fd use;

udev.te:
allow udev_t etc_t:file ioctl;
ifdef(`xdm.te', `
allow udev_t xdm_var_run_t:file { getattr read };
+allow xdm_xserver_t udev_tdb_t:dir r_dir_perms;
')

However, still get lots of AVCs for udev_tdb_t for
lvm_t, pam_console_t, ptal_t, xdm_t, and user_t

Does it make sense to add it base_user_domain()?
full_user_role()? (they already has access to device_t).
daemon_base_domain()?

[I'm sure I'm making this too complicated, but
I'm trying to avoide adding an 'allow ... udev_tdb_t:dir'
to each seperate .te file .....]

tom

[Russell Coker]

On Thursday 23 December 2004 15:12, Tom London  wrote:
> Here's what seems to get rhgb and X running again:
>
> global_macros.te:
> allow $1_t { self proc_t }:dir r_dir_perms;
> allow $1_t { self proc_t }:lnk_file read;
>
> +allow $1_t { device_t udev_tdb_t }:dir { getattr search };

The problem is that the directory should have type device_t not udev_tdb_t.  
The recent trend has been to label all directories under /dev as device_t.

-file_type_auto_trans(udev_t, device_t, udev_tdb_t, { file dir })
+file_type_auto_trans(udev_t, device_t, udev_tdb_t, file)

If the above change is made to udev.te and the below change is made to udev.fc 
then everything will work well.  This is the easiest and simplest change that 
preserves expected functionality.

-/dev/.udev.tdb(/.*)? system_u:object_r:udev_tdb_t
+/dev/.udev.tdb/.* -- system_u:object_r:udev_tdb_t

I assume that the file names in directory /dev/.udev.tdb don't give anything 
away - otherwise the directory surely wouldn't have mode 0755...

[Tom London]

On Thu, 23 Dec 2004 21:36:42 +1100, Russell Coker  wrote:
> On Thursday 23 December 2004 15:12, Tom London  wrote:
> > Here's what seems to get rhgb and X running again:
> >
> > global_macros.te:
> > allow $1_t { self proc_t }:dir r_dir_perms;
> > allow $1_t { self proc_t }:lnk_file read;
> >
> > +allow $1_t { device_t udev_tdb_t }:dir { getattr search };
>
> The problem is that the directory should have type device_t not udev_tdb_t.
> The recent trend has been to label all directories under /dev as device_t.
>
> -file_type_auto_trans(udev_t, device_t, udev_tdb_t, { file dir })
> +file_type_auto_trans(udev_t, device_t, udev_tdb_t, file)
>
> If the above change is made to udev.te and the below change is made to udev.fc
> then everything will work well.  This is the easiest and simplest change that
> preserves expected functionality.
>
> -/dev/.udev.tdb(/.*)? system_u:object_r:udev_tdb_t
> +/dev/.udev.tdb/.* -- system_u:object_r:udev_tdb_t
>
> I assume that the file names in directory /dev/.udev.tdb don't give anything
> away - otherwise the directory surely wouldn't have mode 0755...
>
> --

Russell, Dan,

Yes, this fixes it, even the user_t accesses.

Thanks!

tom