Re: xauth type

On 7/19/2025 7:36 AM, Russell Coker wrote:
> # sesearch -T -D xauth_home_t
> type_transition auditadm_su_t user_home_dir_t:file xauth_home_t;
> type_transition secadm_su_t user_home_dir_t:file xauth_home_t;
> type_transition staff_su_t user_home_dir_t:file xauth_home_t;
> type_transition sysadm_su_t user_home_dir_t:file xauth_home_t;
> type_transition user_su_t user_home_dir_t:file xauth_home_t;
> type_transition xauth_t user_home_dir_t:file xauth_home_t;
> type_transition xauth_t user_tmp_t:file xauth_home_t;
> type_transition xdm_t user_home_dir_t:file xauth_home_t .Xauthority;
> 
> The above are the transition rules to label xauth files with X11 (xdm, su,
> etc).
> 
> When running Wayland the window manager does this, kwin uses
> /run/user/$UID/xauth_$RAND and GNOME uses
> /run/user/$UID/.mutter.XWaylandauth-$RAND and they get labeled as either
> user_tmp_t or user_runtime_t neither of which is good and as the filename is
> random we can't have a domain transition rule.
> 
> The Window manager does many things so having it create all files as
> xauth_home_t isn't going to work.
> 
> Any suggestions?

This sounds like a perfect use for type_transition prefix matching.[1] 
I'm told it hasn't yet been merged because of performance problems.

My only idea is to write file contexts for the paths and trying to 
precreate the dirs, e.g. by systemd-tmpfiles, before they're needed.


[1] 
https://lore.kernel.org/all/[email protected]/

-- 
Chris PeBenito