* [refpolicy] [PATCH] Dontaudit screen asking for the sys_tty_config capability
@ 2014-02-16 14:18 Luis Ressel
2014-03-03 14:07 ` Christopher J. PeBenito
0 siblings, 1 reply; 2+ messages in thread
From: Luis Ressel @ 2014-02-16 14:18 UTC (permalink / raw)
To: refpolicy
This avc shows up when using screen as root, however screen seems to
work fine without that permission.
---
screen.if | 2 ++
1 file changed, 2 insertions(+)
diff --git a/screen.if b/screen.if
index be5cce2..08c8978 100644
--- a/screen.if
+++ b/screen.if
@@ -54,6 +54,8 @@ template(`screen_role_template',`
dontaudit $3 $1_screen_t:unix_stream_socket { read write };
allow $1_screen_t $3:process signal;
+ dontaudit $1_screen_t self:capability sys_tty_config;
+
allow $3 screen_tmp_t:dir { manage_dir_perms relabel_dir_perms };
allow $3 screen_tmp_t:file { manage_file_perms relabel_file_perms };
allow $3 screen_tmp_t:fifo_file { manage_fifo_file_perms relabel_fifo_file_perms };
--
1.8.5.5
^ permalink raw reply related [flat|nested] 2+ messages in thread
* [refpolicy] [PATCH] Dontaudit screen asking for the sys_tty_config capability
2014-02-16 14:18 [refpolicy] [PATCH] Dontaudit screen asking for the sys_tty_config capability Luis Ressel
@ 2014-03-03 14:07 ` Christopher J. PeBenito
0 siblings, 0 replies; 2+ messages in thread
From: Christopher J. PeBenito @ 2014-03-03 14:07 UTC (permalink / raw)
To: refpolicy
On 2/16/2014 9:18 AM, Luis Ressel wrote:
> This avc shows up when using screen as root, however screen seems to
> work fine without that permission.
> ---
> screen.if | 2 ++
> 1 file changed, 2 insertions(+)
>
> diff --git a/screen.if b/screen.if
> index be5cce2..08c8978 100644
> --- a/screen.if
> +++ b/screen.if
> @@ -54,6 +54,8 @@ template(`screen_role_template',`
> dontaudit $3 $1_screen_t:unix_stream_socket { read write };
> allow $1_screen_t $3:process signal;
>
> + dontaudit $1_screen_t self:capability sys_tty_config;
> +
> allow $3 screen_tmp_t:dir { manage_dir_perms relabel_dir_perms };
> allow $3 screen_tmp_t:file { manage_file_perms relabel_file_perms };
> allow $3 screen_tmp_t:fifo_file { manage_fifo_file_perms relabel_fifo_file_perms };
Merged.
--
Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2014-03-03 14:07 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2014-02-16 14:18 [refpolicy] [PATCH] Dontaudit screen asking for the sys_tty_config capability Luis Ressel
2014-03-03 14:07 ` Christopher J. PeBenito
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.