Unexpected behaviour with SELinux.

Unexpected behaviour with SELinux.

[Daniel J Walsh]

On both strict and targetd policy.

ldd /usr/sbin/named gives no output.

ldd must be starting up the daemon and transitioning to it and can not 
write output to the terminal.

Dan

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: Unexpected behaviour with SELinux.

[Stephen Smalley]

On Fri, 2004-09-10 at 15:23, Daniel J Walsh wrote:
> On both strict and targetd policy.
> 
> ldd /usr/sbin/named gives no output.
> 
> ldd must be starting up the daemon and transitioning to it and can not 
> write output to the terminal.

Yes, at present, it appears that ldd is running the program with a set
of LD_* variable settings, so when sysadm_t runs ldd and
direct_sysadm_daemon is enabled, it will transition to the daemon domain
and lose access to the terminal.  Question:  Why doesn't ldd run the
program via ld.so and thus avoid the domain transition, e.g.

--- /usr/bin/ldd	2004-09-04 08:53:30.000000000 -0400
+++ ldd	2004-09-10 15:44:01.219386464 -0400
@@ -154,7 +154,7 @@
     fi
     case $ret in
     0)
-      eval $add_env '"$file"' || result=1
+      eval $add_env \${RTLD} '"$file"' || result=1
       ;;
     1)
       # This can be a non-ELF binary or no binary at all.
 
-- 
Stephen Smalley <sds@epoch.ncsc.mil>
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.