Re: TTY question

[Stephen Smalley <sds@xxxxxxxxxxxxxx>]

On Thu, 2005-02-10 at 16:12, Ivan Gyurdiev wrote:
> It's restored fine.
> /dev/pts/x goes to sysadm_devpts_t after su
>   and back to user_devpts_t after exit.
>   
>  There are no denials.

Ok, good.

> The permissions you want to remove are { append lock ioctl } on
> chr_file, and { lock ioctl } on dir.
> 
> What should I do? ioctl could be allowed for su for now, and then if
> denials show up it could be reverted to rw_perms in the macro.

I'd reduce the permissions in the macro for now, and just give ioctl to
su via a separate allow rule.

> P.S. The java policy had dontaudit tty rules and not allow.
> I changed them by accident. Should they be changed back, or 
> do you think allow is correct?

I don't have that policy in our tree.  Is it for the java plugin run
from mozilla or for java run by a user domain?  If the former, likely
want dontaudit.  If the latter, likely want/need allow.

-- 
Stephen Smalley <sds@xxxxxxxxxxxxxx>
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@xxxxxxxxxxxxx with
the words "unsubscribe selinux" without quotes as the message.