Re: run_init and interactive scripts

On Wed, 2005-01-19 at 22:53, Manoj Srivastava wrote:
> run_init, as distributed, can run init scripts in the initrc
> domain. However, if the forked process is an interactive one, it
> inherits the controlling tty, which is would mean that the
> controlling tty is the controlling tty of a sysadm_t process -- and
> this can be a problem, since a process that has a pty can insert
> characters and potentially take over a sysadm_t session. (If the
> process invokes a daemon that does not close file handles, then if
> exploited can be used to take over administrative sessions). (This
> also inhibits denials due to an initrc_exec_t process trying to write
> to a sysadm_devpts_t object).

Just to clarify, the current SELinux security module rechecks access to the controlling tty and to any open file descriptors upon a context-changing exec, and will automatically revoke access if denied by policy. Hence, without any change, it should already be the case that unless the daemon is explicitly granted permissions to the pty, all access should be revoked upon the transition into the daemon's domain. If you have a daemon running in initrc_t, you have other problems. I'm not opposed to this patch (we did merge a version of open_init_pty from Russell a long time ago, but reverted it due to some problems with its implementation/dependency on expect), but wanted to clarify this point...
>
> ______________________________________________________________________

-- 
Stephen Smalley <sds@epoch.ncsc.mil>
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.