FAM uses seteuid and setegid

[Luke Kenneth Casson Leighton <lkcl@lkcl.net>]

hi,

just taking a look at famd, which uses seteuid and setegid before
going and 'avin a look at files (Cred::Implementation::become_user())

so, famd is designed to "effectively" set its user and group ids,
such that any file access is done as these, whilst still remaining
actually running as root.

... so... what tricks can be done that are equivalent to this?

setfscreatecon doesn't apply because that's presumably for file
creation, and famd does file access not file creation.

setexeccon doesn't apply because there _are_ no relevant exec
calls that occur in famd, and the only forks() and execs()
are to run programs (e.g. "insmod imon").

hum.

-- 
-- 
expecting email to be received and understood is a bit like
picking up the telephone and immediately dialing without
checking for a dial-tone; speaking immediately without listening
for either an answer or ring-tone; hanging up immediately and
believing that you have actually started a conversation.
--
<a href="http://lkcl.net">      lkcl.net      </a> <br />
<a href="mailto:lkcl@lkcl.net"> lkcl@lkcl.net </a> <br />


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.