Re: TTY question

[Stephen Smalley <sds@xxxxxxxxxxxxxx>]

On Wed, 2005-02-09 at 21:02, Ivan Gyurdiev wrote:
> # access_terminal(prefix, domain)
> access_terminal(`
>         allow $1_$2_t $1_tty_device_t:chr_file rw_file_perms;
>         allow $1_$2_t devtty_t:chr_file rw_file_perms;
>         allow $1_$2_t devpts_t:dir r_dir_perms;
>         allow $1_$2_t $1_devpts_t:chr_file rw_file_perms;
> ') dnl access_terminal

Why not just:
# access_terminal(domain, typeprefix)
define(`access_terminal', `
allow $1 $2_tty_device_t:chr_file rw_file_perms;
allow $1 devtty_t:chr_file rw_file_perms;
allow $1 devpts_t:dir r_dir_perms;
allow $1 $2_devpts_t:chr_file rw_file_perms;
') dnl access_terminal

Then the usage in e.g. x_client_domain becomes:
access_terminal($1_$2_t, $1)

whereas elsewhere it may just be:
access_terminal($1_t, $1) 

-- 
Stephen Smalley <sds@xxxxxxxxxxxxxx>
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@xxxxxxxxxxxxx with
the words "unsubscribe selinux" without quotes as the message.