Re: expect

[Tom <tom@lemuria.org>]

On Mon, Dec 02, 2002 at 03:58:27PM +0100, Russell Coker wrote:
> Allowing daemons the tty access could probably be addressed in another way.  
> If we had a separate role and domain for starting daemons that could be 
> entered with newrole (which then removes the need for run_init as the role 
> would not have permission to do anything other than restarting daemons) we 
> could then allow all daemons read/write/ioctl access to the terminal for it.  
> Then if we deny the daemons read access to /dev (wherever possible) and 
> /dev/pts (always) then after you exit the shell that newrole ran (relabelling 
> your tty) the daemon won't be able to access your tty or open other ttys.


I like this idea a lot. It would make a real-life admin job much, much
easier. It's not just that sometimes you have several daemons to
(re)start, it is during development that you easily restart a given
service a couple dozen times. I know I considered the password request
a nuisance after the 5th or so time.


> I believe that this isn't as good as my solution with expect, and it isn't 
> something that can be done in a hurry either.

Actually, it may turn out to be a better solution, mostly because
expect is no longer required (and a couple of the recent postings here have 
shown just why that may be a good thing).

-- 
PGP/GPG key: http://web.lemuria.org/pubkey.html
pub  1024D/2D7A04F5 2002-05-16 Tom Vogt <tom@lemuria.org>
     Key fingerprint = C731 64D1 4BCF 4C20 48A4  29B2 BF01 9FA1 2D7A 04F5

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.