Bugs found by SELinux

[DemiMarie]

Qubes OS version:

Qubes release 4.0 (R4.0)

Affected component(s) or functionality:

Probably multiple. Bugs have been found in qrexec and qubes-firewall so far.

---

Steps to reproduce the behavior:

Run with SELinux in strict enforcing mode and start writing SELinux policies.

Expected or desired behavior:

• qrexec-agent doesn’t leak a Xen FD and a TTY FD to processes spawned by PAM.
• qubes-firewall ships with .pyc files in the RPM package.

Actual behavior:

• qrexec-agent leaks a Xen FD and a TTY FD to processes spawned by PAM.
• qubes-firewall doesn’t ship with .pyc files in the RPM package.

General notes:

These show up as AVC denials. In the first case, namespace_init_t was passed FDs belonging to Xen and a TTY, which SELinux (correctly) blocked. In the second case, init_t was trying to write compiled Python bytecode, which was also blocked.

---

I have consulted the following relevant documentation:

I am aware of the following related, non-duplicate issues:

#4329, #4278, #4279

[DemiMarie]

Oops, double-post. Duplicate of #5124.