SELinux: allow vncsession create .vnc directory

Resolves: bz#2164703

tigervnc-selinux-allow-vncsession-create-vnc-directory.patch

@@ -0,0 +1,31 @@
+From 717d787de8f913070446444e37d552b51f05515e Mon Sep 17 00:00:00 2001
+From: Zdenek Pytela <zpytela@redhat.com>
+Date: Mon, 16 Jan 2023 12:35:40 +0100
+Subject: [PATCH] SELinux: Allow vncsession create ~/.vnc directory
+
+Addresses the following AVC denial:
+
+type=PROCTITLE msg=audit(01/12/2023 02:58:12.648:696) : proctitle=/usr/sbin/vncsession fedora :1
+type=PATH msg=audit(01/12/2023 02:58:12.648:696) : item=1 name=/home/fedora/.vnc nametype=CREATE cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0
+type=PATH msg=audit(01/12/2023 02:58:12.648:696) : item=0 name=/home/fedora/ inode=262145 dev=fc:02 mode=dir,700 ouid=fedora ogid=fedora rdev=00:00 obj=unconfined_u:object_r:user_home_dir_t:s0 nametype=PARENT cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0
+type=CWD msg=audit(01/12/2023 02:58:12.648:696) : cwd=/home/fedora
+type=SYSCALL msg=audit(01/12/2023 02:58:12.648:696) : arch=x86_64 syscall=mkdir success=no exit=EACCES(Permission denied) a0=0x7fff47d52540 a1=0755 a2=0x0 a3=0x0 items=2 ppid=2869 pid=2880 auid=fedora uid=fedora gid=fedora euid=fedora suid=fedora fsuid=fedora egid=fedora sgid=fedora fsgid=fedora tty=(none) ses=8 comm=vncsession exe=/usr/sbin/vncsession subj=system_u:system_r:vnc_session_t:s0 key=(null)
+type=AVC msg=audit(01/12/2023 02:58:12.648:696) : avc:  denied  { create } for  pid=2880 comm=vncsession name=.vnc scontext=system_u:system_r:vnc_session_t:s0 tcontext=system_u:object_r:vnc_home_t:s0 tclass=dir permissive=0
+
+Resolves: rhbz#2143704
+---
+ unix/vncserver/selinux/vncsession.te | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/unix/vncserver/selinux/vncsession.te b/unix/vncserver/selinux/vncsession.te
+index fb966c14b..680be8ea1 100644
+--- a/unix/vncserver/selinux/vncsession.te
++++ b/unix/vncserver/selinux/vncsession.te
+@@ -37,6 +37,7 @@ allow vnc_session_t self:fifo_file rw_fifo_file_perms;
+ allow vnc_session_t vnc_session_var_run_t:file manage_file_perms;
+ files_pid_filetrans(vnc_session_t, vnc_session_var_run_t, file)
+
++create_dirs_pattern(vnc_session_t, vnc_home_t, vnc_home_t)
+ manage_files_pattern(vnc_session_t, vnc_home_t, vnc_home_t)
+ manage_fifo_files_pattern(vnc_session_t, vnc_home_t, vnc_home_t)
+ manage_sock_files_pattern(vnc_session_t, vnc_home_t, vnc_home_t)

tigervnc.spec

@@ -5,7 +5,7 @@
 
 Name:           tigervnc
 Version:        1.12.0
-Release:        11%{?dist}
+Release:        12%{?dist}
 Summary:        A TigerVNC remote display system
 
 %global _hardened_build 1
@@ -34,6 +34,7 @@ Patch54:        tigervnc-fix-ghost-cursor-in-zaphod-mode.patch
 # https://github.com/TigerVNC/tigervnc/pull/1510
 Patch55:        tigervnc-add-new-keycodes-for-unknown-keysyms.patch
 Patch56:        tigervnc-sanity-check-when-cleaning-up-keymap-changes.patch
+Patch57:        tigervnc-selinux-allow-vncsession-create-vnc-directory.patch
 
 # This is tigervnc-%%{version}/unix/xserver116.patch rebased on the latest xorg
 Patch100:       tigervnc-xserver120.patch
@@ -175,6 +176,7 @@ popd
 %patch54 -p1 -b .fix-ghost-cursor-in-zaphod-mode
 %patch55 -p1 -b .add-new-keycodes-for-unknown-keysyms
 %patch56 -p1 -b .sanity-check-when-cleaning-up-keymap-changes
+%patch57 -p1 -b .selinux-allow-vncsession-create-vnc-directory
 
 %build
 %ifarch sparcv9 sparc64 s390 s390x
@@ -353,6 +355,10 @@ fi
 %ghost %verify(not md5 size mtime) %{_sharedstatedir}/selinux/%{selinuxtype}/active/modules/200/%{modulename}
 
 %changelog
+* Tue Feb 21 2023 Jan Grulich <jgrulich@redhat.com> - 1.12.0-12
+- SELinux: allow vncsession create .vnc directory
+  Resolves: bz#2164703
+
 * Wed Feb 15 2023 Jan Grulich <jgrulich@redhat.com> - 1.12.0-11
 - Add sanity check when cleaning up keymap changes
   Resolves: bz#2169965