A simple policy is better than none.
The server needs a lot of permissions... And we need the clients to be able to connect to the server using unix domain sockets (and also transition from cups backend domain to our new domain to be able to support printing #598)
work in progress patch
much better patch - the server starts and client can connect!
The patch above works surprisingly well! Things left TODO:
XShmWrapper.setup() shmat(20840475, NULL, 0) failed!
/bin/sh: /usr/bin/pulseaudio: Permission denied
cannot load dbus helper: org.freedesktop.DBus.Error.AccessDenied: \
An SELinux policy prevents this sender from sending this message to this recipient, 0 matched rules; \
type="method_call", sender="(null)" (inactive) interface="org.freedesktop.DBus" member="Hello" \
error name="(unset)" requested_reply="0" destination="org.freedesktop.DBus" (bus)
dbus setup error: org.freedesktop.DBus.Error.AccessDenied: Failed to connect to socket \
/var/run/dbus/system_bus_socket: Permission denied
Unhandled error while processing a 'query-printers' packet from peer using <bound method XpraClient._process_query_printers of gtk2.client>
Traceback (most recent call last):
File "/usr/lib64/python2.7/site-packages/xpra/client/client_base.py", line 733, in process_packet
handler(packet)
File "/usr/lib64/python2.7/site-packages/xpra/client/client_base.py", line 580, in _process_query_printers
printers = get_printers()
File "/usr/lib64/python2.7/site-packages/xpra/platform/pycups_printing.py", line 64, in get_printers
conn = cups.Connection()
RuntimeError: failed to connect to server
sound source pipeline error: GStreamer encountered a general resource error. / pulsesink.c(570): gst_pulseringbuffer_open_device (): /GstPulseSink:autoaudiosink0-actual-sink-pulse sound source pipeline error: Could not initialise supporting library. / gstautoaudiosink.c(369): gst_auto_audio_sink_detect (): /GstPipeline:pipeline0/GstAutoAudioSink:autoaudiosink0: Failed to find a supported audio sink
printing works, dbus and sound still do not
out of time
Note: this change might make things easier to implement if we use the sockets placed in /run instead of the home folder: #888.
alternatively, this patch to the core policy is supposed to work
Some minor changes in r11544 to better support new socket locations (#963). Unfortunately, even using sockets in /tmp or /run does not allow us to talk to the socket from the cups backend.
But maybe the alternative locations will be more palatable for a merge upstream?
Hash: xpra,cupsd_t,user_tmp_t,sock_file,write
(this one may be acceptable? still better than home dir..)
/run/user/$UID/xpra/SOCKETNAME:
Hash: xpra,cupsd_t,unconfined_t,unix_stream_socket,connectto
(this one would require a specific policy for the directory?)
updated patch for Fedora 23
TODO:
/var/run (we can check and set an env var before using it)
semanage permissive -a lpr_t, but I can't find any avcs to fix! Some links:
Trying to solve the printing problem first: Fedora SELinux mailing list
As suggested in this reply: Could you try to label the backend.., after chcon -t cups_pdf_exec_t /usr/lib/cups/backend/xpraforwarder and the socket in .xpra:
AVC avc: denied { search } for pid=12058 comm="xpra" name=".xpra" dev="md122" ino=3965034 scontext=system_u:system_r:cups_pdf_t:s0-s0:c0.c1023 tcontext=system_u:object_r:unlabeled_t:s0 tclass=dir permissive=0
AVC avc: denied { create } for pid=12057 comm="python" scontext=system_u:system_r:cups_pdf_t:s0-s0:c0.c1023 tcontext=system_u:system_r:cups_pdf_t:s0-s0:c0.c1023 tclass=unix_dgram_socket permissive=0
AVC avc: denied { create } for pid=12057 comm="python" scontext=system_u:system_r:cups_pdf_t:s0-s0:c0.c1023 tcontext=system_u:system_r:cups_pdf_t:s0-s0:c0.c1023 tclass=unix_dgram_socket permissive=0
AVC avc: denied { create } for pid=12057 comm="python" scontext=system_u:system_r:cups_pdf_t:s0-s0:c0.c1023 tcontext=system_u:system_r:cups_pdf_t:s0-s0:c0.c1023 tclass=unix_dgram_socket permissive=0
PID 12057 (/usr/lib/cups/backend/xpraforwarder) stopped with status 1.
With the socket in /var/run/user/$UID/xpra:
AVC avc: denied { write } for pid=12809 comm="xpra" name="desktop-100" dev="tmpfs" ino=454089 scontext=system_u:system_r:cups_pdf_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_tmp_t:s0 tclass=sock_file permissive=0
AVC avc: denied { create } for pid=12808 comm="python" scontext=system_u:system_r:cups_pdf_t:s0-s0:c0.c1023 tcontext=system_u:system_r:cups_pdf_t:s0-s0:c0.c1023 tclass=unix_dgram_socket permissive=0
AVC avc: denied { create } for pid=12808 comm="python" scontext=system_u:system_r:cups_pdf_t:s0-s0:c0.c1023 tcontext=system_u:system_r:cups_pdf_t:s0-s0:c0.c1023 tclass=unix_dgram_socket permissive=0
AVC avc: denied { create } for pid=12808 comm="python" scontext=system_u:system_r:cups_pdf_t:s0-s0:c0.c1023 tcontext=system_u:system_r:cups_pdf_t:s0-s0:c0.c1023 tclass=unix_dgram_socket permissive=0
PID 12808 (/usr/lib/cups/backend/xpraforwarder) stopped with status 1.
Continuing with the socket in /var/run/user/$UID/xpra and fixing with audit2allow every time:
AVC avc: denied { connectto } for pid=16204 comm="xpra" path="/run/user/1000/xpra/desktop-100" scontext=system_u:system_r:cups_pdf_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=unix_stream_socket permissive=0
AVC avc: denied { connect } for pid=16203 comm="python" scontext=system_u:system_r:cups_pdf_t:s0-s0:c0.c1023 tcontext=system_u:system_r:cups_pdf_t:s0-s0:c0.c1023 tclass=unix_dgram_socket permissive=0
AVC avc: denied { connect } for pid=16203 comm="python" scontext=system_u:system_r:cups_pdf_t:s0-s0:c0.c1023 tcontext=system_u:system_r:cups_pdf_t:s0-s0:c0.c1023 tclass=unix_dgram_socket permissive=0
AVC avc: denied { connect } for pid=16203 comm="python" scontext=system_u:system_r:cups_pdf_t:s0-s0:c0.c1023 tcontext=system_u:system_r:cups_pdf_t:s0-s0:c0.c1023 tclass=unix_dgram_socket permissive=0
This "fixes" it:
module xpraforwarder 1.0;
require {
type user_tmp_t;
type cups_pdf_t;
type unconfined_t;
class unix_dgram_socket create;
class unix_dgram_socket connect;
class sock_file write;
class unix_stream_socket connectto;
}
allow cups_pdf_t self:unix_dgram_socket { create connect };
allow cups_pdf_t user_tmp_t:sock_file write;
allow cups_pdf_t unconfined_t:unix_stream_socket connectto;
Managed to come up with a policy that allows the backend to run without warnings or errors: r13317.
Still TODO:
r13346 adds RPM packaging support for the "cups_xpra" selinux module.
Moving the full selinux policy to #1283.
God some feedback, made some improvements in r13358. (r13367 includes a patch for the policy so that it can be used on systems that do not support XDG_RUNTIME_DIR, see ticket:1129#comment:23 for details).
Ready for testing.
I haven't found any issues with this on fedora 23 and 24. I've done some rough testing with a non attached printer but not much with a real printer.
If we run into errors we'll open a new ticket.
this ticket has been moved to: https://github.com/Xpra-org/xpra/issues/815