Bugs found by SELinux

[DemiMarie]

Qubes OS version:

Qubes release 4.0 (R4.0)

Affected component(s) or functionality:

Probably multiple. Bugs have been found in qrexec, qubes-firewall, and others so far.

---

Steps to reproduce the behavior:

Run with SELinux in strict enforcing mode and start writing SELinux policies.

Expected or desired behavior:

• qrexec-agent doesn’t leak a Xen FD and a TTY FD to processes spawned by PAM.
• qubes-firewall ships with .pyc files in the RPM package.
• udevadm is not run except using sudo.

Actual behavior:

• qrexec-agent leaks a Xen FD and a TTY FD to processes spawned by PAM.
• qubes-firewall doesn’t ship with .pyc files in the RPM package.
• udevadm is run without sudo.

General notes:

These show up as AVC denials. In the first case, namespace_init_t was passed FDs belonging to Xen and a TTY, which SELinux (correctly) blocked. In the second case, init_t was trying to write compiled Python bytecode, which was also blocked. The third and forth cases are because on strict SELinux systems, administrative users such as user log in as staff_u:staff_r:staff_t:s0-s0:c0.c1023 by default. This does not grant them permission to run udevadm, but using sudo, they can transition to staff_u:sysadm_r:sysadm_t:s0-s0:c0.c1023, which does have the needed permissions.

---

I have consulted the following relevant documentation:

I am aware of the following related, non-duplicate issues:

#4329, #4278, #4279

[marmarek]

Can you paste full relevant messages?

As for .pyc files, which exactly? I see those:

$ rpm -ql qubes-core-agent|grep pyc$
/usr/lib/python2.7/site-packages/qubesagent/__init__.pyc
/usr/lib/python2.7/site-packages/qubesagent/firewall.pyc
/usr/lib/python2.7/site-packages/qubesagent/test_firewall.pyc
/usr/lib/python2.7/site-packages/qubesagent/xdg.pyc
/usr/lib/yum-plugins/yum-qubes-hooks.pyc

[DemiMarie]

There are missing .pyc files under the Qubes kernel module directory, but I think the missing files here are actually bugs in Fedora.

[DemiMarie]

Presumably fixed by QubesOS/qubes-core-qrexec@0516ffc, closing.

[marmarek]

• qrexec-agent leaks a Xen FD and a TTY FD to processes spawned by PAM.

• qubes-firewall doesn’t ship with .pyc files in the RPM package.

• udevadm is run without sudo.

The change you linked is only at the dom0 side, so it's unlikely fixing any of those.

[github-actions]

This issue is being closed because:

• This issue is believed to affect only Qubes OS 4.1 (and possibly earlier).
• Qubes OS 4.1 has reached end-of-life (EOL).

If anyone believes that this issue should be reopened, please leave a comment saying so.
(For example, if a bug still affects Qubes OS 4.2, then the comment "Affects 4.2" will suffice.)