From 0ed8e5127011aa4a75f57c250b5cc89b71949179 Mon Sep 17 00:00:00 2001
From: Zdenek Pytela <zpytela@redhat.com>
Date: Thu, 13 Jan 2022 22:57:07 +0100
Subject: [PATCH] Allow login_userdomain watch accountsd lib directories

Reference: https://gitbub.com/fedora-selinux/selinux-policy/commit/0ed8e5127011aa4a75f57c250b5cc89b71949179
Conflict: NA

Addresses the following AVC denial:

type=PROCTITLE msg=audit(3.1.2022 08:48:10.041:403) : proctitle=/usr/bin/plasmashell --no-respawn
type=PATH msg=audit(3.1.2022 08:48:10.041:403) : item=0 name=/var/lib/AccountsService/icons inode=102167247 dev=fd:00 mode=dir,775 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:accountsd_var_lib_t:s0 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0
type=SYSCALL msg=audit(3.1.2022 08:48:10.041:403) : arch=x86_64 syscall=inotify_add_watch success=yes exit=16 a0=0xd a1=0x556d0da251b8 a2=0x2000fc6 a3=0x7f74d2859329 items=1 ppid=1775 pid=1944 auid=username uid=username gid=username euid=username suid=username fsuid=username egid=username sgid=username fsgid=username tty=(none) ses=3 comm=plasmashell exe=/usr/bin/plasmashell subj=staff_u:staff_r:staff_t:s0-s0:c0.c1023 key=(null)
type=AVC msg=audit(3.1.2022 08:48:10.041:403) : avc:  denied  { watch } for  pid=1944 comm=plasmashell path=/var/lib/AccountsService/icons dev="dm-0" ino=102167247 scontext=staff_u:staff_r:staff_t:s0-s0:c0.c1023 tcontext=system_u:object_r:accountsd_var_lib_t:s0 tclass=dir permissive=1

Signed-off-by: lujie54 <lujie54@huawei.com>
---
 policy/modules/system/userdomain.te | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/policy/modules/system/userdomain.te b/policy/modules/system/userdomain.te
index 86617c3..465e0a3 100644
--- a/policy/modules/system/userdomain.te
+++ b/policy/modules/system/userdomain.te
@@ -409,6 +409,10 @@ optional_policy(`
 ')
 
 optional_policy(`
+	accountsd_watch_lib(login_userdomain)
+')
+
+optional_policy(`
 	dbus_create_session_tmp_sock_files(login_userdomain)
 ')
 
-- 
1.8.3.1

