* xdm leaks file descriptors on purpose, but this is causing random avc messages.
@ 2006-10-04 20:40 Daniel J Walsh
2006-10-04 21:07 ` Christopher J. PeBenito
0 siblings, 1 reply; 2+ messages in thread
From: Daniel J Walsh @ 2006-10-04 20:40 UTC (permalink / raw)
To: Stephen Smalley, Christopher J. PeBenito, SE Linux
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=206709
Basically by design xdm/gdm opens a file descriptor to xsession-errors
and then passes this to the session as stdout/stderr. If at some time
later a user opens up a gnome terminal and restarts a confined domain.
AVC's are generated on this fd.
Not sure of a way to handle this other then "
dontaudit domain xdm_t:fd use;
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: xdm leaks file descriptors on purpose, but this is causing random avc messages.
2006-10-04 20:40 xdm leaks file descriptors on purpose, but this is causing random avc messages Daniel J Walsh
@ 2006-10-04 21:07 ` Christopher J. PeBenito
0 siblings, 0 replies; 2+ messages in thread
From: Christopher J. PeBenito @ 2006-10-04 21:07 UTC (permalink / raw)
To: Daniel J Walsh; +Cc: Stephen Smalley, SE Linux
On Wed, 2006-10-04 at 16:40 -0400, Daniel J Walsh wrote:
> https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=206709
>
> Basically by design xdm/gdm opens a file descriptor to xsession-errors
> and then passes this to the session as stdout/stderr. If at some time
> later a user opens up a gnome terminal and restarts a confined domain.
> AVC's are generated on this fd.
>
> Not sure of a way to handle this other then "
> dontaudit domain xdm_t:fd use;
There's something here that doesn't compute for me. When you open up a
gnome-terminal, the shell's fd 0, 1, and 2 should be set to the user's
own pty, replacing the fd 0, 1, and 2 that gnome-terminal itself
inherits from xdm. So I don't see how a daemon would get it.
--
Chris PeBenito
Tresys Technology, LLC
(410) 290-1411 x150
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2006-10-04 21:07 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2006-10-04 20:40 xdm leaks file descriptors on purpose, but this is causing random avc messages Daniel J Walsh
2006-10-04 21:07 ` Christopher J. PeBenito
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.