Re: sereference: screen policy

["Serge E. Hallyn" <serue@us.ibm.com>]

Quoting Christopher J. PeBenito (cpebenito@tresys.com):
> The rule for the user's own terminal should be in.  I don't know if we
> should trust screen to use all terminals.
> 
> > 	allow $1_screen_t tty_device_t:lnk_file read;
> 
> Looks like a mislabeled symlink.  Currently the symlinks in /dev are all
> device_t, as far as I know.  Looking at terminal.fc, everything is
> marked -c (with the exception of /dev/pts directory which is -d), so I'm
> not sure how this would happen.
> 
> > Note that I also still need my other patch for local logins from Jan 11.
> 
> Ok, I'll go back and look at it.  The response you made to your email
> made me think it wasn't actually needed.

Ah, ok, I added a line to terminal.fc in my login patch to label my
/dev/ttyS1 as tty_device_t:

+/dev/.*tty[^/]*                -l gen_context(system_u:object_r:tty_device _t,s0)

Let me see if removing that lets me still log in, and if so I guess I
may not need

> > 	allow $1_screen_t tty_device_t:lnk_file read;

in the screen template.

thanks,
-serge

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.