[refpolicy] Question: and the policy grows...

[dwalsh@redhat.com (Daniel J Walsh)]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Here is a patch against refpolicy that removes most of the opens on
terminals.

http://people.fedoraproject.org/~dwalsh/SELinux/refpolicy_inherited_term.patch

A similar patch on F15 shows

# sesearch -A -t user_devpts_t -p write -c chr_file -C  | grep -v ^D | wc -l
180
# sesearch -A -t user_devpts_t -p open -c chr_file -C  | grep -v ^D | wc -l
32

# sesearch -A -t user_tty_device_t -p write -c chr_file -C  | grep -v ^D
| wc -l
174
# sesearch -A -t user_tty_device_t -p open -c chr_file -C  | grep -v ^D
| wc -l
29
# sesearch -A -t tty_device_t -p write -c chr_file -C  | grep -v ^D | wc -l
72
# sesearch -A -t tty_device_t -p open -c chr_file -C  | grep -v ^D | wc -l
35

The Fedora patch is just tested locally and I will probably wait to put
this fix into F16 since it is kind of dangerous at this point.

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/

iEYEARECAAYFAk2CZcUACgkQrlYvE4MpobO6mACgoB/mXlZJuIebKmdhBIamoba5
ONAAoJ8Cf8XSU/aPjllYFfIMlg3Xwsep
=frjC
-----END PGP SIGNATURE-----