Re: Current Reference Policy patch

[Daniel J Walsh <dwalsh@redhat.com>]

Christopher J. PeBenito wrote:
> On Fri, 2005-11-18 at 10:02 -0500, Daniel J Walsh wrote:
>   
>> Christopher J. PeBenito wrote:
>>     
>>> On Thu, 2005-11-17 at 10:55 -0500, Daniel J Walsh wrote:
>>>   
>>>       
>>>> Need to turn on rpm and not alias to unconfined_t, because the rule
>>>>
>>>> rpm_t->shell_exec_t->rpm_script_t was causing all terminal windows to 
>>>> run in rpm_script_t in targeted.     
>>>>         
>>> Yesterday I disabled that transition in targeted (it was the one causing
>>> the xdm logins to go to rpm_script_t), so do you still want to rpm_t as
>>> non-aliased?
>>>   
>>>       
>> Yes.  Lets move that way and see how it works.
>>     
>
> Ok, I've committed this part and re-enabled the transition to
> rpm_script_t.
>
>   
>>>> Allow users to su to root and then suspend the session.
>>>>         
>
> Did you really intend to add these to only the targeted policy?
>
>   
I think their could be a problem with terminal labeling if we allow it 
in strict.
Ie the tty gets labeled sysadm_tty_t and then you suspend, Nothing will 
work and you
can't type fg.
>>>> Pegasus policy was too loose.
>>>> /bin/ksh should be sheel_exec_t
>>>> (.*)?  is the same as .* and causes python to blow up.
>>>>         
>
> merged.  I didn't merge the hunks that hard-coded the role in the file
> contexts, as the hunks were not used in the targeted policy.  We need to
> have a fixed genhomedircon for strict to be usable again anyway, since
> not all home dirs are user_home(_dir)?_t.
>
>   
Yes, waiting as soon as libsemanage handles it properly I will fix it.

-- 



--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.