mozilla adds .mozilla directory to /etc/skel which useradd tries to copy

When the copy fails it stops copying any other files. node=asdf type=AVC msg=audit(1731544222.421:251876): avc: denied { create } for pid=14952 comm="useradd" name=".mozilla" scontext=system_u:system_r:useradd_t:s0 tcontext=user_u:object_r:mozilla_home_t:s0 tclass=dir permissive=0 node=asdf type=AVC msg=audit(1731545219.731:272250): avc: denied { create } for pid=19939 comm="useradd" name=".mozilla" scontext=system_u:system_r:useradd_t:s0 tcontext=user_u:object_r:mozilla_home_t:s0 tclass=dir permissive=1 node=asdf type=AVC msg=audit(1731545219.731:272251): avc: denied { setattr } for pid=19939 comm="useradd" name=".mozilla" dev="dm-7" ino=1703938 scontext=system_u:system_r:useradd_t:s0 tcontext=user_u:object_r:mozilla_home_t:s0 tclass=dir permissive=1 node=asdf type=AVC msg=audit(1731545219.732:272255): avc: denied { search } for pid=19939 comm="useradd" name=".mozilla" dev="dm-7" ino=1703938 scontext=system_u:system_r:useradd_t:s0 tcontext=user_u:object_r:mozilla_home_t:s0 tclass=dir permissive=1 node=asdf type=AVC msg=audit(1731545219.732:272255): avc: denied { write } for pid=19939 comm="useradd" name=".mozilla" dev="dm-7" ino=1703938 scontext=system_u:system_r:useradd_t:s0 tcontext=user_u:object_r:mozilla_home_t:s0 tclass=dir permissive=1 node=asdf type=AVC msg=audit(1731545219.732:272255): avc: denied { add_name } for pid=19939 comm="useradd" name="extensions" scontext=system_u:system_r:useradd_t:s0 tcontext=user_u:object_r:mozilla_home_t:s0 tclass=dir permissive=1 node=asdf type=AVC msg=audit(1731545219.732:272262): avc: denied { create } for pid=19939 comm="useradd" name="plugins" scontext=system_u:system_r:useradd_t:s0 tcontext=user_u:object_r:mozilla_plugin_home_t:s0 tclass=dir permissive=1 node=asdf type=AVC msg=audit(1731545219.732:272263): avc: denied { setattr } for pid=19939 comm="useradd" name="plugins" dev="dm-7" ino=1703940 scontext=system_u:system_r:useradd_t:s0 tcontext=user_u:object_r:mozilla_plugin_home_t:s0 tclass=dir permissive=1 Signed-off-by: Dave Sugar <[email protected]>
SELinuxProject · Nov 14, 2024 · ba09a5b · ba09a5b
1 parent cc6ce5d
commit ba09a5b
Show file tree

Hide file tree

Showing 2 changed files with 24 additions and 0 deletions.
diff --git a/policy/modules/admin/usermanage.te b/policy/modules/admin/usermanage.te
@@ -557,6 +557,10 @@ userdom_manage_user_home_content_dirs(useradd_t)
 userdom_manage_user_home_content_files(useradd_t)
 userdom_user_home_dir_filetrans_user_home_content(useradd_t, notdevfile_class_set)
 
+optional_policy(`
+	mozilla_create_user_home_dirs(useradd_t)
+')
+
 optional_policy(`
 	mta_manage_spool(useradd_t)
 ')

diff --git a/policy/modules/apps/mozilla.if b/policy/modules/apps/mozilla.if
@@ -234,6 +234,26 @@ interface(`mozilla_dontaudit_manage_user_home_files',`
 	dontaudit $1 mozilla_home_t:lnk_file manage_lnk_file_perms;
 ')
 
+########################################
+## <summary>
+##	Create mozilla directories in user home directory.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`mozilla_create_user_home_dirs',`
+	gen_require(`
+		type mozilla_home_t, mozilla_plugin_home_t;
+	')
+
+	userdom_search_user_home_dirs($1)
+	allow $1 { mozilla_home_t  mozilla_plugin_home_t}:dir setattr;
+	create_dirs_pattern($1, mozilla_home_t, { mozilla_home_t mozilla_plugin_home_t })
+')
+
 ########################################
 ## <summary>
 ##	Execute mozilla plugin home directory files.