At the moment I'm trying to compile the shadow password programs from
Julianne Frances Haugh (as used in Debian for /bin/login and friends) with SE
support.
I've got login almost working (I think) but haven't tested it yet (anyone who's interested in seeing what I'm doing please contact me off the list - I'm not publishing untested patches).
I'm now thinking about what to do with su. Should su change the security of the tty with chsid() before spawning a new shell and then change it back afterwards as login does? Or is there some difference in the way that su and login work that requires some different code?
--
http://www.coker.com.au/bonnie++/ Bonnie++ hard drive benchmark http://www.coker.com.au/postal/ Postal SMTP/POP benchmark http://www.coker.com.au/projects.html Projects I am working on http://www.coker.com.au/~russell/ My home page
--
You have received this message because you are subscribed to the selinux list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
On Sat, 22 Dec 2001, Russell Coker wrote:
> I'm now thinking about what to do with su. Should su change the security of
> the tty with chsid() before spawning a new shell and then change it back
> afterwards as login does? Or is there some difference in the way that su and
> login work that requires some different code?
We intentionally chose to not modify the su program for SELinux. Hence, su only changes the Linux identity attributes, not the SELinux security context. su is most commonly used to obtain Linux capabilities for administrative tasks by becoming the superuser, but this merely reflects a change in privilege, not a real change in the user who is performing the tasks. We would prefer to leave the SELinux user identity unmodified for user accountability in this case.
-- Stephen D. Smalley, NAI Labs ssmalley@nai.com -- You have received this message because you are subscribed to the selinux list. If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with the words "unsubscribe selinux" without quotes as the message.
This archive was generated by hypermail 2.2.0 on Wed 11 Jun 2008 - 08:10:54 EDT