From e6f28c51a2716f4209de9da5b39da3b3730729cd Mon Sep 17 00:00:00 2001 From: David Sugar Date: Thu, 30 Nov 2017 23:04:44 +0000 Subject: [PATCH] Change label for ~/.xsession-errors Currently .xsession-errors is labeled user_home_t when created by xdm_t. Switch to using existing interface xserver_user_home_dir_filetrans_user_xsession_log to create file with label xsession_log_t. This includes using the interface manage the type xsession_log_t. type=AVC msg=audit(1511962175.985:77): avc: denied { create } for pid=1163 comm="lightdm" name=".xsession-errors" scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:xsession_log_t:s0 tclass=file type=AVC msg=audit(1511962175.985:77): avc: denied { write open } for pid=1163 comm="lightdm" path="/home/user/.xsession-errors" dev="dm-0" ino=17153285 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:xsession_log_t:s0 tclass=file type=AVC msg=audit(1511962941.991:268): avc: denied { rename } for pid=1721 comm="lightdm" name=".xsession-errors" dev="dm-0" ino=17153285 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:xsession_log_t:s0 tclass=file type=AVC msg=audit(1511962977.779:419): avc: denied { unlink } for pid=1814 comm="lightdm" name=".xsession-errors.old" dev="dm-0" ino=17153285 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:xsession_log_t:s0 tclass=file Signed-off-by: Dave Sugar --- policy/modules/services/xserver.te | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/policy/modules/services/xserver.te b/policy/modules/services/xserver.te index 7fb5d6bcb..988fdd520 100644 --- a/policy/modules/services/xserver.te +++ b/policy/modules/services/xserver.te @@ -274,7 +274,6 @@ files_tmp_filetrans(xauth_t, xauth_tmp_t, { file dir }) allow xdm_t xauth_home_t:file manage_file_perms; userdom_user_home_dir_filetrans(xdm_t, xauth_home_t, file, ".Xauthority") -userdom_user_home_dir_filetrans_user_home_content(xdm_t, file, ".xsession-errors") allow xauth_t xdm_t:process sigchld; allow xauth_t xdm_t:fd use; @@ -498,8 +497,10 @@ userdom_signal_all_users(xdm_t) # and it is now obsolete in Gnome3 xserver_read_user_dmrc(xdm_t) +xserver_manage_xsession_log(xdm_t) xserver_rw_session(xdm_t, xdm_tmpfs_t) xserver_unconfined(xdm_t) +xserver_user_home_dir_filetrans_user_xsession_log(xdm_t) tunable_policy(`use_nfs_home_dirs',` fs_manage_nfs_dirs(xdm_t)