Re: /dev/pts/x use denials

[Daniel J Walsh <dwalsh@redhat.com>]

Ivan Gyurdiev wrote:

>>I don't see sysadm_tmp_t anywhere above. 
>>    
>>
>
>Right, that was a typo.. I'm sure I meant sysadm_devpts_t 
>(or at least I hope I did - sysadm_tmp_t doesn't make sense)
>
>  
>
>>I do see staff_t fd's, but that
>>just shows that the descriptor was opened by a staff_t process and then
>>inherited across the su, nothing surprising there.  Earlier versions of
>>pam_selinux did try closing and re-opening descriptors 0-2 as newrole
>>does, but that proved problematic.  su likely just needs to be directly
>>patched rather than using pam_selinux.
>>    
>>
>
>What was the problem?
>I remember another message about this, but I didn't understand it then -
>I see what you mean now.
>
>  
>
Closing and reopeing a tty device in a pam module is not a good idea.

-- 



--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.