From 6a6fff9f00a02723d3a9c58e892e12a527df8efa Mon Sep 17 00:00:00 2001
From: Zdenek Pytela <zpytela@redhat.com>
Date: Tue, 16 Nov 2021 20:50:48 +0100
Subject: [PATCH] Allow PID 1 and dbus-broker IPC with a systemd user session

Reference: https://gitbub.com/fedora-selinux/selinux-policy/commit/6a6fff9f00a02723d3a9c58e892e12a527df8efa
Conflict: NA

systemd-stdio-bridge is invoked using systemd-run to connect to a user
bus from a privileged context:
systemd-run -M.host -PGq --wait -pUser=user1 -pPAMName=login systemd-stdio-bridge -punix:path=${XDG_RUNTIME_DIR}/bus

The commands sequence is as follows:
1. dnf invokes rpm
2. a scriptlet is called from rpm
3. the scriptlet calls /usr/lib/systemd/systemd-update-helper
4. systemd-update-helper calls systemctl --user <uid>@ ...
5. in the systemctl binary, sd-bus invokes systemd-run
6. which invokes systemd-stdio-bridge as the user
7. systemctl communicates with the user manager over the bridge

Refer to this commit for more information:
https://github.com/systemd/systemd/pull/17967/commits/1b630835dff

Addresses the following AVC denials:
----
type=AVC msg=audit(11/15/2021 08:56:59.167:1097) : avc:  denied  { read write } for  pid=458 comm=dbus-broker path=socket:[37803] dev="sockfs" ino=37803 scontext=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=unix_stream_socket permissive=1
----
type=AVC msg=audit(11/15/2021 08:56:59.168:1098) : avc:  denied  { read write } for  pid=1 comm=systemd path=socket:[37803] dev="sockfs" ino=37803 scontext=system_u:system_r:init_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=unix_stream_socket permissive=1
----
type=PROCTITLE msg=audit(11/15/2021 08:56:59.184:1100) : proctitle=(o-bridge)
type=SYSCALL msg=audit(11/15/2021 08:56:59.184:1100) : arch=x86_64 syscall=ioctl success=no exit=ENOTTY(Inappropriate ioctl for device) a0=0x0 a1=TCGETS a2=0x7ffca74d78a0 a3=0x0 items=0 ppid=1 pid=6580 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=(o-bridge) exe=/usr/lib/systemd/systemd subj=system_u:system_r:init_t:s0 key=(null)
type=AVC msg=audit(11/15/2021 08:56:59.184:1100) : avc:  denied  { ioctl } for  pid=6580 comm=(o-bridge) path=socket:[37803] dev="sockfs" ino=37803 ioctlcmd=TCGETS scontext=system_u:system_r:init_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=unix_stream_socket permissive=1
----

Resolves: rhbz#2023332
Signed-off-by: lujie54 <lujie54@huawei.com>
---
 policy/modules/contrib/dbus.te | 4 ++++
 policy/modules/system/init.te  | 1 +
 2 files changed, 5 insertions(+)

diff --git a/policy/modules/contrib/dbus.te b/policy/modules/contrib/dbus.te
index a426d29..76fb3b6 100644
--- a/policy/modules/contrib/dbus.te
+++ b/policy/modules/contrib/dbus.te
@@ -236,6 +236,10 @@ optional_policy(`
 ')
 
 optional_policy(`
+	userdom_rw_stream(system_dbusd_t)
+')
+
+optional_policy(`
 	virt_list_sandbox_dirs(system_dbusd_t)
 ')
 
diff --git a/policy/modules/system/init.te b/policy/modules/system/init.te
index b261f08..22e363a 100644
--- a/policy/modules/system/init.te
+++ b/policy/modules/system/init.te
@@ -872,6 +872,7 @@ optional_policy(`
 
 optional_policy(`
 	userdom_exec_user_bin_files(init_t)
+	userdom_rw_stream(init_t)
 ')
 
 ########################################
-- 
1.8.3.1