Bug ID | 1208606 |
---|---|
Summary | [SELinux] greetd/sway session runs too many applications in xdm_t context |
Classification | openSUSE |
Product | openSUSE Tumbleweed |
Version | Current |
Hardware | Other |
OS | Other |
Status | NEW |
Severity | Normal |
Priority | P5 - None |
Component | Security |
Assignee | filippo.bonazzi@suse.com |
Reporter | mcepl@suse.com |
QA Contact | qa-bugs@suse.de |
Found By | --- |
Blocker | --- |
Created attachment 865083 [details]
Output of ausearch -m AVC -ts today
With greetd-0.9.0-38.4.x86_64, gtkgreet-0.7-2.1.x86_64, sway-1.8.1-1.1.x86_64,
selinux-policy-targeted-20221019-8.1.noarch I get
stitny~$ ps auxZ|grep xdm_t
system_u:system_r:xdm_t:s0-s0:c0.c1023 root 2464 0.0 0.0 3908 3668 ?
SLs 18:14 0:00 greetd
system_u:system_r:xdm_t:s0-s0:c0.c1023 root 2734 0.1 0.0 7512 7472 tty2
SLs+ 18:14 0:00 /usr/bin/greetd --session-worker 12
system_u:system_r:xdm_t:s0-s0:c0.c1023 matej 2755 0.0 0.0 7012 3172 tty2
S+ 18:14 0:00 /bin/sh /usr/bin/sway-run.sh
system_u:system_r:xdm_t:s0-s0:c0.c1023 matej 2800 5.9 0.7 3089064 118052 tty2
Rl+ 18:14 0:00 sway
system_u:system_r:xdm_t:s0-s0:c0.c1023 matej 2823 0.3 0.0 17124 9724 tty2
S+ 18:14 0:00 swaybg -o * -i /usr/share/wallpapers/default-1920x1080.jpg -m
fill
system_u:system_r:xdm_t:s0-s0:c0.c1023 matej 2834 3.3 0.3 1938976 61960 tty2
Sl+ 18:14 0:00 waybar -b bar-0
system_u:system_r:xdm_t:s0-s0:c0.c1023 matej 2836 0.0 0.0 6256 1540 ?
S 18:14 0:00 swayidle -w timeout 300 swaylock -f -c 000000 timeout 600
swaymsg "output * dpms off" resume swaymsg "output * dpms on" before-sleep
swaylock -f -c 000000
system_u:system_r:xdm_t:s0-s0:c0.c1023 matej 2856 0.0 0.0 7012 3216 ?
S 18:14 0:00 sh -c tail -f $SWAYSOCK.wob | wob --config
/etc/sway/wob/wob.ini
system_u:system_r:xdm_t:s0-s0:c0.c1023 matej 2860 1.5 0.1 339372 27536 ?
Sl 18:14 0:00 swaync --style /etc/sway/swaync/style.css --config
/etc/sway/swaync/config.json
system_u:system_r:xdm_t:s0-s0:c0.c1023 matej 2861 0.0 0.0 5568 1044 ?
S 18:14 0:00 tail -f /run/user/1000/sway-ipc.1000.2800.sock.wob
system_u:system_r:xdm_t:s0-s0:c0.c1023 matej 2862 0.0 0.0 2916 1100 ?
S 18:14 0:00 wob --config /etc/sway/wob/wob.ini
system_u:system_r:xdm_t:s0-s0:c0.c1023 matej 2890 0.0 0.0 7012 3152 ?
S 18:14 0:00 sh -c tail -f $SWAYSOCK.wob | wob
system_u:system_r:xdm_t:s0-s0:c0.c1023 matej 2896 1.2 0.1 337620 23484 ?
Sl 18:14 0:00 /usr/libexec/polkit-gnome-authentication-agent-1
system_u:system_r:xdm_t:s0-s0:c0.c1023 matej 2897 0.0 0.0 5568 1000 ?
S 18:14 0:00 tail -f /run/user/1000/sway-ipc.1000.2800.sock.wob
system_u:system_r:xdm_t:s0-s0:c0.c1023 matej 2898 0.0 0.0 2944 1148 ?
S 18:14 0:00 wob
system_u:system_r:xdm_t:s0-s0:c0.c1023 matej 2900 0.0 0.0 2708 1056 ?
S 18:14 0:00 wl-paste -t text --watch clipman store
--histpath=~/.cache/clipman.json
system_u:system_r:xdm_t:s0-s0:c0.c1023 matej 2989 0.0 0.0 7012 3156 tty2
S 18:14 0:00 sh -c swaymsg -mrt subscribe '["input"]' | jq -r --unbuffered
"select(.change == \"xkb_layout\") | .input | select(.type == \"keyboard\") |
.xkb_active_layout_name | .[0:2]"
system_u:system_r:xdm_t:s0-s0:c0.c1023 matej 2994 0.0 0.0 2672 964 tty2
S 18:14 0:00 swaymsg -mrt subscribe ["input"]
system_u:system_r:xdm_t:s0-s0:c0.c1023 matej 2995 0.2 0.0 5084 3284 tty2
S 18:14 0:00 jq -r --unbuffered select(.change == "xkb_layout") | .input |
select(.type == "keyboard") | .xkb_active_layout_name | .[0:2]
system_u:system_r:xdm_t:s0-s0:c0.c1023 matej 3009 0.0 0.0 7012 3136 tty2
S 18:14 0:00 sh -c swaymsg -mrt subscribe '["input"]' | jq -r --unbuffered
"select(.change == \"xkb_layout\") | .input | select(.type == \"keyboard\") |
.xkb_active_layout_name | .[0:2]"
system_u:system_r:xdm_t:s0-s0:c0.c1023 matej 3014 0.0 0.0 2672 964 tty2
S 18:14 0:00 swaymsg -mrt subscribe ["input"]
system_u:system_r:xdm_t:s0-s0:c0.c1023 matej 3015 0.2 0.0 5084 3180 tty2
S 18:14 0:00 jq -r --unbuffered select(.change == "xkb_layout") | .input |
select(.type == "keyboard") | .xkb_active_layout_name | .[0:2]
system_u:system_r:xdm_t:s0-s0:c0.c1023 matej 3031 5.4 0.1 1135464 27864 ?
Sl 18:14 0:00 foot
system_u:system_r:xdm_t:s0-s0:c0.c1023 matej 3032 0.5 0.0 160620 8488 pts/0
Ss+ 18:14 0:00 /usr/bin/fish
system_u:system_r:xdm_t:s0-s0:c0.c1023 matej 3044 0.0 0.0 81508 1092 ?
Ss 18:14 0:00 gpg-agent --homedir /home/matej/.gnupg --use-standard-socket
--daemon
system_u:system_r:xdm_t:s0-s0:c0.c1023 matej 3051 0.0 0.0 7344 760 ?
Ss 18:14 0:00 ssh-agent -c
system_u:system_r:xdm_t:s0-s0:c0.c1023 matej 3069 7.1 0.1 1135476 24144 ?
Sl 18:14 0:00 foot
system_u:system_r:xdm_t:s0-s0:c0.c1023 matej 3070 1.3 0.0 164568 12428 pts/1
Ssl 18:14 0:00 /usr/bin/fish
system_u:system_r:xdm_t:s0-s0:c0.c1023 matej 3099 7.2 0.1 1135332 24736 ?
Sl 18:14 0:00 foot
system_u:system_r:xdm_t:s0-s0:c0.c1023 matej 3100 0.8 0.0 160620 8512 pts/2
Ss+ 18:14 0:00 /usr/bin/fish
system_u:system_r:xdm_t:s0-s0:c0.c1023 matej 3142 0.0 0.0 10980 4080 pts/1
R+ 18:14 0:00 ps auxZ
system_u:system_r:xdm_t:s0-s0:c0.c1023 matej 3143 0.0 0.0 6584 2180 pts/1
R+ 18:14 0:00 grep --color=auto xdm_t
stitny~$
I have SELinux in the Permissive mode.