Skip to content

Commit

Permalink
Allow xdm write to gnome-initial-setup fifo files
Browse files Browse the repository at this point in the history
The commit addresses the following AVC denial:
type=PROCTITLE msg=audit(09/18/2024 16:14:09.301:217) : proctitle=/usr/bin/gnome-shell
type=SYSCALL msg=audit(09/18/2024 16:14:09.301:217) : arch=x86_64 syscall=recvmsg success=yes exit=52 a0=0xad a1=0x7ffcc3ba4450 a2=MSG_DONTWAIT|MSG_CMSG_CLOEXEC a3=0x0 items=0 ppid=1166 pid=1178 auid=unset uid=gnome-initial-setup gid=gnome-initial-setup euid=gnome-initial-setup suid=gnome-initial-setup fsuid=gnome-initial-setup egid=gnome-initial-setup sgid=gnome-initial-setup fsgid=gnome-initial-setup tty=tty1 ses=unset comm=gnome-shell exe=/usr/bin/gnome-shell subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 key=(null)
type=AVC msg=audit(09/18/2024 16:14:09.301:217) : avc:  denied  { write } for  pid=1178 comm=gnome-shell path=pipe:[19167] dev="pipefs" ino=19167 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:system_r:gnome_initial_setup_t:s0-s0:c0.c1023 tclass=fifo_file permissive=0

Resolves: rhbz#2278845
  • Loading branch information
zpytela committed Sep 18, 2024
1 parent 6939d61 commit 0067b65
Show file tree
Hide file tree
Showing 2 changed files with 20 additions and 0 deletions.
19 changes: 19 additions & 0 deletions policy/modules/contrib/gnome.if
Original file line number Diff line number Diff line change
Expand Up @@ -2207,6 +2207,25 @@ interface(`gnome_initial_setup_read_state',`
ps_process_pattern($1, gnome_initial_setup_t)
')

########################################
## <summary>
## Write/append gnome-initial-setup fifo files
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`gnome_initial_setup_write_fifo_files',`
gen_require(`
type gnome_initial_setup_t;
')


allow $1 gnome_initial_setup_t:fifo_file write_fifo_file_perms;
')

########################################
## <summary>
## Transition to gnome-initial-setup named content
Expand Down
1 change: 1 addition & 0 deletions policy/modules/services/xserver.te
Original file line number Diff line number Diff line change
Expand Up @@ -1067,6 +1067,7 @@ optional_policy(`
gnome_initial_setup_manage_var_run(xdm_t)
gnome_initial_setup_noatsecure(xdm_t)
gnome_initial_setup_read_state(xdm_t)
gnome_initial_setup_write_fifo_files(xdm_t)
')

optional_policy(`
Expand Down

0 comments on commit 0067b65

Please sign in to comment.