[refpolicy] [PATCH] Allow getty the sys_admin capability

[jason@perfinion.com (Jason Zaman)]

On Sat, Mar 05, 2016 at 01:18:07PM +0100, Nicolas Iooss wrote:
> On 03/04/2016 04:54 PM, Dominick Grift wrote:
> > On 03/04/2016 02:11 PM, Christopher J. PeBenito wrote:
> >> On 3/3/2016 9:05 PM, Luis Ressel wrote:
> >>> It's required for agetty on kernels with a recent grsecurity
> >>> patchset. (The denial itself has been showing up for quite some
> >>> time, but it hasn't had any obvious ill effects until recently.)
> > 
> >> I'm reluctant to add this because it is a significant permission
> >> and grsecurity is not commonly used with SELinux, to my knowledge.
> > 
> > 
> > My getty requests this permission as well [1] and i am not using
> > grsecurity. Although, i am not sure if the permission is absolutely
> > needed. (then again I do not believe that it requests it for its
> > health alone)
> 
> Hello, as I was wondering what was behind agetty requiring sys_admin
> capabilities and what would happen if the access is denied, I took a
> look to its source code.  The TIOCSTI ioctl (the mechanism which allows
> injecting characters in a terminal input queue) seems to only been used
> in a function named wait_for_term_input [1].  This allows the user input
> to be seen as a "normal input" while wait_for_term_input temporarily
> configured the terminal with ICANON, ECHO... attributes disabled.
> 
> If the ioctl(fd, TIOCSTI, buffer + i) call fails (for example because
> sys_admin is not granted by SELinux), this is silently ignored.  As far
> as I understand the code, wait_for_term_input function is only used at
> the beginning of the login prompt (the characters are echoed to the
> terminal) and not the password prompt.  Therefore the user may get the
> feeling that the first typed character has been dropped somewhere.  Is
> that so? Are there other annoyances that I missed in my quick analysis?
> 
> Anyway, before grsecurity added a test for sys_admin when a process uses
> TIOCSTI ioctl on its own tty, the capability has already been granted
> when distro_redhat is enabled.  The comment which is associated to this
> access, "getty requires sys_admin #209426", is not clear to me.  Where
> could I find more information about this bug report?

I assume this:
https://bugzilla.redhat.com/show_bug.cgi?id=209426

but i get:
You are not authorized to access bug #209426. To see this bug, you must
first log in to an account with the appropriate permissions.

-- Jason