Re: [patch] fix /var/run/console bits

[Russell Coker <rcoker@redhat.com>]

On Wed, 4 Aug 2004 23:03, Colin Walters <walters@redhat.com> wrote:
> > I think that perhaps the following would be good for the fc entry to keep
> > the convention:
> > /var/run/console/(.*)?                    
> > system_u:object_r:pam_var_console_t
>
> Sounds good.

Actually I did a typo, this is what is should be:
/var/run/console(/.*)?    system_u:object_r:pam_var_console_t

> > This is not what we want.  Ideally we will never have any files of type
> > var_run_t.
> > rw_dir_create_file(xdm_t, var_run_t)
> > rw_dir_create_file($1_login_t, var_run_t)
>
> I agree, but unfortunately pam_console creates a lockfile
> named /var/run/console.lock.  We should probably fix that.

Dan has just offered to fix that.  But if it was not possible to change that 
then the solution would be to have a file_type_auto_trans() rule.

I've been thinking of adding neverallow rules to prevent any access to files 
of type var_run_t, tmp_t, and tmpfs_t...

> > I guess that the following code is to allow the xdm to check which login
> > processes are active when searching for an unused virtual console.
>
> Ok.  I just thought it was weird at first glance, and worthy of a
> comment :)

It is weird, and probably something needs to be changed about it.

-- 
http://apac.redhat.com/disclaimer
See above URL for disclaimer.

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.