Re: dynamic context transitions

[Colin Walters <walters@verbum.org>]

[-- Attachment #1: Type: text/plain, Size: 1955 bytes --]

On Tue, 2004-11-02 at 08:59 -0500, Stephen Smalley wrote:
> On Mon, 2004-11-01 at 21:18, Colin Walters wrote:
> > I can see some specialized uses for this with e.g. the Samba example,
> > but I'm having trouble seeing how it would be broadly useful, although I
> > haven't thought about the MLS case much.  But in your examples above,
> > the policy can already restrict which ports a domain can bind; it
> > doesn't seem useful to drop the privileges to bind to those ports.
> > Also, why would it be useful to drop the privileges to read
> > configuration files?
> 
> Classic example that shows up often in Fedora is allowing the daemon to
> access the tty during startup for error reporting 

initlog already sends error messages printed to stdout/stderr
to /var/log/messages.  I don't really see it as a problem that you don't
get them duplicated on the tty; usually most daemons close stderr and
start logging to syslog anyways pretty early, so you always need to look
there for errors.

> and user interaction
> (e.g. ssl), then removing its ability to access the tty subsequently. 

And this one just seems broken to me, outside of SELinux.  It doesn't
work if your server boots up remotely and you're not physically in front
of it, nor does it work if you're restarting services from a GUI with no
tty.  A better solution would be for Apache to simply run a helper
program, say /usr/sbin/httpd-readpassword, that could read the
passphrase in a configurable way.  In most cases, this would
use /dev/tty, but there's lots of other interesting things one could do.
For example, I've heard of sysadmins having their systems send an IM
when there's a problem; extending this slightly, simply have the httpd-
readpassword program send an IM query for the passphrase and wait for a
response.  Or in the GUI service case, we could do some D-BUS thing back
to the user session.  But hardcoding /dev/tty I think is broken.

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 189 bytes --]