I'm on an Ubuntu 14.04 derivative, elementary OS Freya.
I have installed and configured SELinux using the selinux-policy-default
package, which contains a lot of modules. I've also added my user to the staff_u
SELinux user:
$ sudo semanage login -l
Login Name SELinux User MLS/MCS Range Service
__default__ unconfined_u SystemLow-SystemHigh *
naftuli staff_u SystemLow-SystemHigh *
root unconfined_u SystemLow-SystemHigh *
system_u system_u SystemLow-SystemHigh *
For reference, here are the SELinux users:
$ sudo semanage user -l
Labeling MLS/ MLS/
SELinux User Prefix MCS Level MCS Range SELinux Roles
root sysadm SystemLow SystemLow-SystemHigh staff_r sysadm_r system_r
staff_u staff SystemLow SystemLow-SystemHigh staff_r sysadm_r
sysadm_u sysadm SystemLow SystemLow-SystemHigh sysadm_r
system_u user SystemLow SystemLow-SystemHigh system_r
unconfined_u unconfined SystemLow SystemLow-SystemHigh system_r unconfined_r
user_u user SystemLow SystemLow user_r
After I login, I have a strange type, and I find myself in sysadm_r
instead of staff_r
:
$ id -Z
staff_u:sysadm_r:gpg_agent_t:SystemLow
I might be able to explain the gpg_agent_t
, as I have a script in my Xsession.d which starts gpg-agent
, /etc/X11/Xsession.d/90gpg-agent
:
: ${GNUPGHOME=$HOME/.gnupg}
GPGAGENT=/usr/bin/gpg-agent
PID_FILE="$HOME/.gpg-agent-info"
if grep -qs '^[[:space:]]*use-agent' "$GNUPGHOME/gpg.conf" "$GNUPGHOME/options" &&
test -x $GPGAGENT &&
{ test -z "$GPG_AGENT_INFO" || ! $GPGAGENT 2>/dev/null; }; then
if [ -r "$PID_FILE" ]; then
. "$PID_FILE"
fi
# Invoking gpg-agent with no arguments exits successfully if the agent
# is already running as pointed by $GPG_AGENT_INFO
if ! $GPGAGENT 2>/dev/null; then
STARTUP="$GPGAGENT --daemon --enable-ssh-support --sh --write-env-file=$PID_FILE $STARTUP"
fi
fi
However, I can't find out why any graphical shells I open have the gpg_agent_t
type and why they have the sysadm_r
role. In my /etc/sudoers
, I've granted access to be able to transition up to the sysadm_r
with sudo, but I shouldn't have that by default:
naftuli ALL=(ALL:ALL) ROLE=sysadm_r PASSWD: ALL
If I login with a TTY, everything looks great:
staff_u:staff_r:staff_t:SystemLow-SystemHigh
Why is lightdm or gala giving me this strange type and role? How can I fix it?
I know that there's no policy for either lightdm or gala, I might be writing one. I'm trying to get this system into enforcing mode, I'm currently in permissive because X/gala/lightdm crashes as soon as I setenforce 1
.
EDIT: By editing my gpg-agent start script, I'm now logged in as staff_u:sysadm_r:sysadm_t
. Also, my session processes look like this:
system_u:system_r:sysadm_t:s0 root 1875 0.0 0.0 292864 5888 ? SLsl 10:33 0:00 lightdm
system_u:system_r:xserver_t:s0 root 1927 6.3 0.4 396864 74804 tty7 Ssl+ 10:33 12:38 /usr/bin/X -core :0 -seat seat0 -auth /var/run/lightdm/root/:0 -nolisten tcp vt7 -novtswitch
system_u:system_r:sysadm_t:s0 root 4699 0.0 0.0 170580 4688 ? Sl 10:33 0:00 lightdm --session-child 12 19
staff_u:sysadm_r:sysadm_t:s0 naftuli 5067 2.0 0.4 974688 75180 ? Sl 10:34 4:08 gala
I think that Gala is doing it wrong. It could be lightdm, which is my login greeter, but I'm not sure. Again, this is Ubuntu so SELinux awareness is not likely.
gpg_agent_t
. The role is probably part of the transition. Did you check if it works for you when you skip thegpg-agent
or start it usual way aseval $(gpg-agent --daemon)
with your options?staff_u:sysadm_r:sysadm_t:SystemLow
fromid -Z
.ps auxfZ
. How do the processes related to your session look like (basically underlightdm
andX
)? It should be possible to trace if it is originally with wrong context or it breaks somewhere on the way or if it was not even correctly set (also possibility).