SELinux policy for printing

[Antoine Martin]

A simple policy is better than none.

The server needs a lot of permissions...
And we need the clients to be able to connect to the server using unix domain sockets (and also transition from cups backend domain to our new domain to be able to support printing #598)

[Antoine Martin]

work in progress patch

[Antoine Martin]

much better patch - the server starts and client can connect!

[Antoine Martin]

The patch above works surprisingly well!
Things left TODO:

• lots of testing
• fix shared memory: XShmWrapper.setup() shmat(20840475, NULL, 0) failed!
• fix pulseaudio: /bin/sh: /usr/bin/pulseaudio: Permission denied
• fix dbus access:
  • server side:

    cannot load dbus helper: org.freedesktop.DBus.Error.AccessDenied: \
        An SELinux policy prevents this sender from sending this message to this recipient, 0 matched rules; \
        type="method_call", sender="(null)" (inactive) interface="org.freedesktop.DBus" member="Hello" \
        error name="(unset)" requested_reply="0" destination="org.freedesktop.DBus" (bus)
    

  • client side:

    dbus setup error: org.freedesktop.DBus.Error.AccessDenied: Failed to connect to socket \
        /var/run/dbus/system_bus_socket: Permission denied
    

• fix cups:

  Unhandled error while processing a 'query-printers' packet from peer using <bound method XpraClient._process_query_printers of gtk2.client>
  Traceback (most recent call last):
    File "/usr/lib64/python2.7/site-packages/xpra/client/client_base.py", line 733, in process_packet
      handler(packet)
    File "/usr/lib64/python2.7/site-packages/xpra/client/client_base.py", line 580, in _process_query_printers
      printers = get_printers()
    File "/usr/lib64/python2.7/site-packages/xpra/platform/pycups_printing.py", line 64, in get_printers
      conn = cups.Connection()
  RuntimeError: failed to connect to server
  

• fix the cups backend (#598)
• fix sound, at the very least client side:

  sound source pipeline error: GStreamer encountered a general resource error. / pulsesink.c(570): gst_pulseringbuffer_open_device (): /GstPulseSink:autoaudiosink0-actual-sink-pulse
  sound source pipeline error: Could not initialise supporting library. / gstautoaudiosink.c(369): gst_auto_audio_sink_detect (): /GstPipeline:pipeline0/GstAutoAudioSink:autoaudiosink0:
  Failed to find a supported audio sink
  

• packaging

[Antoine Martin]

printing works, dbus and sound still do not

[Antoine Martin]

out of time

[Antoine Martin]

Note: this change might make things easier to implement if we use the sockets placed in /run instead of the home folder: #888.

[Antoine Martin]

alternatively, this patch to the core policy is supposed to work

[Antoine Martin]

Some minor changes in r11544 to better support new socket locations (#963).
Unfortunately, even using sockets in /tmp or /run does not allow us to talk to the socket from the cups backend.

But maybe the alternative locations will be more palatable for a merge upstream?

• for /tmp:

  Hash: xpra,cupsd_t,user_tmp_t,sock_file,write
  

(this one may be acceptable? still better than home dir..)

• for /run/user/$UID/xpra/SOCKETNAME:

  Hash: xpra,cupsd_t,unconfined_t,unix_stream_socket,connectto
  

(this one would require a specific policy for the directory?)

[Antoine Martin]

updated patch for Fedora 23

[Antoine Martin]

TODO:

• gstreamer gets into a horrible spin and will just waste CPU cycles until you kill it
• fakexinerama should be converted to using /var/run (we can check and set an env var before using it)
• pulseaudio still won't run (no avc messages to investigate)
• printing works if I set the lpr module to permissive: semanage permissive -a lpr_t, but I can't find any avcs to fix! Some links:
  • ​lpr_selinux
  • ​Eating my own dogfood: mozilla plugin + lpr

[Antoine Martin]

Trying to solve the printing problem first: ​xpra printer forwarding currently requires a change to the core policy on the ​Fedora SELinux mailing list

[Antoine Martin]

As suggested in this reply: ​Could you try to label the backend.., after chcon -t cups_pdf_exec_t /usr/lib/cups/backend/xpraforwarder and the socket in .xpra:

AVC avc:  denied  { search } for  pid=12058 comm="xpra" name=".xpra" dev="md122" ino=3965034 scontext=system_u:system_r:cups_pdf_t:s0-s0:c0.c1023 tcontext=system_u:object_r:unlabeled_t:s0 tclass=dir permissive=0
AVC avc:  denied  { create } for  pid=12057 comm="python" scontext=system_u:system_r:cups_pdf_t:s0-s0:c0.c1023 tcontext=system_u:system_r:cups_pdf_t:s0-s0:c0.c1023 tclass=unix_dgram_socket permissive=0
AVC avc:  denied  { create } for  pid=12057 comm="python" scontext=system_u:system_r:cups_pdf_t:s0-s0:c0.c1023 tcontext=system_u:system_r:cups_pdf_t:s0-s0:c0.c1023 tclass=unix_dgram_socket permissive=0
AVC avc:  denied  { create } for  pid=12057 comm="python" scontext=system_u:system_r:cups_pdf_t:s0-s0:c0.c1023 tcontext=system_u:system_r:cups_pdf_t:s0-s0:c0.c1023 tclass=unix_dgram_socket permissive=0
PID 12057 (/usr/lib/cups/backend/xpraforwarder) stopped with status 1.

With the socket in /var/run/user/$UID/xpra:

AVC avc:  denied  { write } for  pid=12809 comm="xpra" name="desktop-100" dev="tmpfs" ino=454089 scontext=system_u:system_r:cups_pdf_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_tmp_t:s0 tclass=sock_file permissive=0
AVC avc:  denied  { create } for  pid=12808 comm="python" scontext=system_u:system_r:cups_pdf_t:s0-s0:c0.c1023 tcontext=system_u:system_r:cups_pdf_t:s0-s0:c0.c1023 tclass=unix_dgram_socket permissive=0
AVC avc:  denied  { create } for  pid=12808 comm="python" scontext=system_u:system_r:cups_pdf_t:s0-s0:c0.c1023 tcontext=system_u:system_r:cups_pdf_t:s0-s0:c0.c1023 tclass=unix_dgram_socket permissive=0
AVC avc:  denied  { create } for  pid=12808 comm="python" scontext=system_u:system_r:cups_pdf_t:s0-s0:c0.c1023 tcontext=system_u:system_r:cups_pdf_t:s0-s0:c0.c1023 tclass=unix_dgram_socket permissive=0
PID 12808 (/usr/lib/cups/backend/xpraforwarder) stopped with status 1.

[Antoine Martin]

Continuing with the socket in /var/run/user/$UID/xpra and fixing with audit2allow every time:

AVC avc:  denied  { connectto } for  pid=16204 comm="xpra" path="/run/user/1000/xpra/desktop-100" scontext=system_u:system_r:cups_pdf_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=unix_stream_socket permissive=0
AVC avc:  denied  { connect } for  pid=16203 comm="python" scontext=system_u:system_r:cups_pdf_t:s0-s0:c0.c1023 tcontext=system_u:system_r:cups_pdf_t:s0-s0:c0.c1023 tclass=unix_dgram_socket permissive=0
AVC avc:  denied  { connect } for  pid=16203 comm="python" scontext=system_u:system_r:cups_pdf_t:s0-s0:c0.c1023 tcontext=system_u:system_r:cups_pdf_t:s0-s0:c0.c1023 tclass=unix_dgram_socket permissive=0
AVC avc:  denied  { connect } for  pid=16203 comm="python" scontext=system_u:system_r:cups_pdf_t:s0-s0:c0.c1023 tcontext=system_u:system_r:cups_pdf_t:s0-s0:c0.c1023 tclass=unix_dgram_socket permissive=0

This "fixes" it:

module xpraforwarder 1.0;

require {
	type user_tmp_t;
	type cups_pdf_t;
	type unconfined_t;
	class unix_dgram_socket create;
	class unix_dgram_socket connect;
	class sock_file write;
	class unix_stream_socket connectto;
}

allow cups_pdf_t self:unix_dgram_socket { create connect };
allow cups_pdf_t user_tmp_t:sock_file write;
allow cups_pdf_t unconfined_t:unix_stream_socket connectto;

[Antoine Martin]

Managed to come up with a policy that allows the backend to run without warnings or errors: r13317.

Still TODO:

• get feedback and fix all the problems
• package it for fedora and centos, see ​SELinux Policy Modules Packaging Draft and ​PackagingDrafts/SELinux

[Antoine Martin]

r13346 adds RPM packaging support for the "cups_xpra" selinux module.

Moving the full selinux policy to #1283.

[Antoine Martin]

God some feedback, made some improvements in r13358.
(r13367 includes a patch for the policy so that it can be used on systems that do not support XDG_RUNTIME_DIR, see ticket:1129#comment:23 for details).

Ready for testing.

[Smo]

I haven't found any issues with this on fedora 23 and 24. I've done some rough testing with a non attached printer but not much with a real printer.

If we run into errors we'll open a new ticket.

[Antoine Martin]

See also #1283, #2265