xpra icon
Bug tracker and wiki

Opened 2 years ago

Closed 4 months ago

Last modified 4 months ago

#815 closed task (fixed)

SELinux policy for printing

Reported by: Antoine Martin Owned by: Smo
Priority: critical Milestone: 1.0
Component: core Version: trunk
Keywords: Cc:

Description

A simple policy is better than none.

The server needs a lot of permissions...
And we need the clients to be able to connect to the server using unix domain sockets (and also transition from cups backend domain to our new domain to be able to support printing #598)

Attachments (5)

selinux.patch (2.0 KB) - added by Antoine Martin 2 years ago.
work in progress patch
selinux-v2.patch (7.4 KB) - added by Antoine Martin 2 years ago.
much better patch - the server starts and client can connect!
selinux-v3.patch (8.1 KB) - added by Antoine Martin 2 years ago.
printing works, dbus and sound still do not
allow-cupsd-access-userhome.patch (602 bytes) - added by Antoine Martin 18 months ago.
alternatively, this patch to the core policy is supposed to work
selinux-v4.patch (8.4 KB) - added by Antoine Martin 12 months ago.
updated patch for Fedora 23

Download all attachments as: .zip

Change History (19)

Changed 2 years ago by Antoine Martin

Attachment: selinux.patch added

work in progress patch

Changed 2 years ago by Antoine Martin

Attachment: selinux-v2.patch added

much better patch - the server starts and client can connect!

comment:1 Changed 2 years ago by Antoine Martin

Status: newassigned

The patch above works surprisingly well!
Things left TODO:

  • lots of testing
  • fix shared memory: XShmWrapper.setup() shmat(20840475, NULL, 0) failed!
  • fix pulseaudio: /bin/sh: /usr/bin/pulseaudio: Permission denied
  • fix dbus access:
    • server side:
      cannot load dbus helper: org.freedesktop.DBus.Error.AccessDenied: \
          An SELinux policy prevents this sender from sending this message to this recipient, 0 matched rules; \
          type="method_call", sender="(null)" (inactive) interface="org.freedesktop.DBus" member="Hello" \
          error name="(unset)" requested_reply="0" destination="org.freedesktop.DBus" (bus)
      
    • client side:
      dbus setup error: org.freedesktop.DBus.Error.AccessDenied: Failed to connect to socket \
          /var/run/dbus/system_bus_socket: Permission denied
      
  • fix cups:
    Unhandled error while processing a 'query-printers' packet from peer using <bound method XpraClient._process_query_printers of gtk2.client>
    Traceback (most recent call last):
      File "/usr/lib64/python2.7/site-packages/xpra/client/client_base.py", line 733, in process_packet
        handler(packet)
      File "/usr/lib64/python2.7/site-packages/xpra/client/client_base.py", line 580, in _process_query_printers
        printers = get_printers()
      File "/usr/lib64/python2.7/site-packages/xpra/platform/pycups_printing.py", line 64, in get_printers
        conn = cups.Connection()
    RuntimeError: failed to connect to server
    
  • fix the cups backend (#598)
  • fix sound, at the very least client side:
    sound source pipeline error: GStreamer encountered a general resource error. / pulsesink.c(570): gst_pulseringbuffer_open_device (): /GstPulseSink:autoaudiosink0-actual-sink-pulse
    sound source pipeline error: Could not initialise supporting library. / gstautoaudiosink.c(369): gst_auto_audio_sink_detect (): /GstPipeline:pipeline0/GstAutoAudioSink:autoaudiosink0:
    Failed to find a supported audio sink
    
  • packaging
Last edited 2 years ago by Antoine Martin (previous) (diff)

Changed 2 years ago by Antoine Martin

Attachment: selinux-v3.patch added

printing works, dbus and sound still do not

comment:2 Changed 2 years ago by Antoine Martin

Milestone: 0.15future

out of time

comment:3 Changed 20 months ago by Antoine Martin

Note: this change might make things easier to implement if we use the sockets placed in /run instead of the home folder: #888.

Changed 18 months ago by Antoine Martin

alternatively, this patch to the core policy is supposed to work

comment:4 Changed 15 months ago by Antoine Martin

Some minor changes in r11544 to better support new socket locations (#963).
Unfortunately, even using sockets in /tmp or /run does not allow us to talk to the socket from the cups backend.

But maybe the alternative locations will be more palatable for a merge upstream?

  • for /tmp:
    Hash: xpra,cupsd_t,user_tmp_t,sock_file,write
    

(this one may be acceptable? still better than home dir..)

  • for /run/user/$UID/xpra/SOCKETNAME:
    Hash: xpra,cupsd_t,unconfined_t,unix_stream_socket,connectto
    

(this one would require a specific policy for the directory?)

Changed 12 months ago by Antoine Martin

Attachment: selinux-v4.patch added

updated patch for Fedora 23

comment:5 Changed 12 months ago by Antoine Martin

TODO:

  • gstreamer gets into a horrible spin and will just waste CPU cycles until you kill it
  • fakexinerama should be converted to using /var/run (we can check and set an env var before using it)
  • pulseaudio still won't run (no avc messages to investigate)
  • printing works if I set the lpr module to permissive: semanage permissive -a lpr_t, but I can't find any avcs to fix! Some links:
Last edited 12 months ago by Antoine Martin (previous) (diff)

comment:7 Changed 8 months ago by Antoine Martin

As suggested in this reply: Could you try to label the backend.., after chcon -t cups_pdf_exec_t /usr/lib/cups/backend/xpraforwarder and the socket in .xpra:

AVC avc:  denied  { search } for  pid=12058 comm="xpra" name=".xpra" dev="md122" ino=3965034 scontext=system_u:system_r:cups_pdf_t:s0-s0:c0.c1023 tcontext=system_u:object_r:unlabeled_t:s0 tclass=dir permissive=0
AVC avc:  denied  { create } for  pid=12057 comm="python" scontext=system_u:system_r:cups_pdf_t:s0-s0:c0.c1023 tcontext=system_u:system_r:cups_pdf_t:s0-s0:c0.c1023 tclass=unix_dgram_socket permissive=0
AVC avc:  denied  { create } for  pid=12057 comm="python" scontext=system_u:system_r:cups_pdf_t:s0-s0:c0.c1023 tcontext=system_u:system_r:cups_pdf_t:s0-s0:c0.c1023 tclass=unix_dgram_socket permissive=0
AVC avc:  denied  { create } for  pid=12057 comm="python" scontext=system_u:system_r:cups_pdf_t:s0-s0:c0.c1023 tcontext=system_u:system_r:cups_pdf_t:s0-s0:c0.c1023 tclass=unix_dgram_socket permissive=0
PID 12057 (/usr/lib/cups/backend/xpraforwarder) stopped with status 1.

With the socket in /var/run/user/$UID/xpra:

AVC avc:  denied  { write } for  pid=12809 comm="xpra" name="desktop-100" dev="tmpfs" ino=454089 scontext=system_u:system_r:cups_pdf_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_tmp_t:s0 tclass=sock_file permissive=0
AVC avc:  denied  { create } for  pid=12808 comm="python" scontext=system_u:system_r:cups_pdf_t:s0-s0:c0.c1023 tcontext=system_u:system_r:cups_pdf_t:s0-s0:c0.c1023 tclass=unix_dgram_socket permissive=0
AVC avc:  denied  { create } for  pid=12808 comm="python" scontext=system_u:system_r:cups_pdf_t:s0-s0:c0.c1023 tcontext=system_u:system_r:cups_pdf_t:s0-s0:c0.c1023 tclass=unix_dgram_socket permissive=0
AVC avc:  denied  { create } for  pid=12808 comm="python" scontext=system_u:system_r:cups_pdf_t:s0-s0:c0.c1023 tcontext=system_u:system_r:cups_pdf_t:s0-s0:c0.c1023 tclass=unix_dgram_socket permissive=0
PID 12808 (/usr/lib/cups/backend/xpraforwarder) stopped with status 1.

comment:8 Changed 8 months ago by Antoine Martin

Continuing with the socket in /var/run/user/$UID/xpra and fixing with audit2allow every time:

AVC avc:  denied  { connectto } for  pid=16204 comm="xpra" path="/run/user/1000/xpra/desktop-100" scontext=system_u:system_r:cups_pdf_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=unix_stream_socket permissive=0
AVC avc:  denied  { connect } for  pid=16203 comm="python" scontext=system_u:system_r:cups_pdf_t:s0-s0:c0.c1023 tcontext=system_u:system_r:cups_pdf_t:s0-s0:c0.c1023 tclass=unix_dgram_socket permissive=0
AVC avc:  denied  { connect } for  pid=16203 comm="python" scontext=system_u:system_r:cups_pdf_t:s0-s0:c0.c1023 tcontext=system_u:system_r:cups_pdf_t:s0-s0:c0.c1023 tclass=unix_dgram_socket permissive=0
AVC avc:  denied  { connect } for  pid=16203 comm="python" scontext=system_u:system_r:cups_pdf_t:s0-s0:c0.c1023 tcontext=system_u:system_r:cups_pdf_t:s0-s0:c0.c1023 tclass=unix_dgram_socket permissive=0

This "fixes" it:

module xpraforwarder 1.0;

require {
	type user_tmp_t;
	type cups_pdf_t;
	type unconfined_t;
	class unix_dgram_socket create;
	class unix_dgram_socket connect;
	class sock_file write;
	class unix_stream_socket connectto;
}

allow cups_pdf_t self:unix_dgram_socket { create connect };
allow cups_pdf_t user_tmp_t:sock_file write;
allow cups_pdf_t unconfined_t:unix_stream_socket connectto;

comment:9 Changed 8 months ago by Antoine Martin

Managed to come up with a policy that allows the backend to run without warnings or errors: r13317.

Still TODO:

comment:10 Changed 7 months ago by Antoine Martin

r13346 adds RPM packaging support for the "cups_xpra" selinux module.

Moving the full selinux policy to #1283.

comment:11 Changed 7 months ago by Antoine Martin

Owner: changed from Antoine Martin to Smo
Status: assignednew

God some feedback, made some improvements in r13358.
(r13367 includes a patch for the policy so that it can be used on systems that do not support XDG_RUNTIME_DIR, see ticket:1129#comment:23 for details).

Ready for testing.

Last edited 6 months ago by Antoine Martin (previous) (diff)

comment:12 Changed 6 months ago by Antoine Martin

Milestone: future1.0
Priority: majorcritical

comment:13 Changed 4 months ago by Smo

Resolution: fixed
Status: newclosed

I haven't found any issues with this on fedora 23 and 24. I've done some rough testing with a non attached printer but not much with a real printer.

If we run into errors we'll open a new ticket.

comment:14 Changed 4 months ago by Antoine Martin

Summary: SELinux policySELinux policy for printing
Note: See TracTickets for help on using tickets.