Bug 708378

Description of problem:

rwhod sends out idle times as zero for all users if selinux is enabled

Version-Release number of selected component (if applicable):

rwho-0.17-33.fc14.x86_64
selinux-policy-targeted-3.9.7-40.fc14.noarch


How reproducible:

100%

Steps to Reproduce:
1.  rwho
2.
3.
  
Actual results:

somebody     cc04:pts/1     May 27 08:11



Expected results:

somebody     cc04:pts/1     May 27 08:11 :04


Additional info:

First reported by me in 

   https://bugzilla.redhat.com/show_bug.cgi?id=357591 

on FC7.

The problem is that rwhod running as rwho_t cannot stat /dev/pts/*
due to selinux restriction.

strace of the child rwhod process shows...

--
stat("/var/run/utmp", {st_mode=S_IFREG|0664, st_size=3840, ...}) = 0
chdir("/dev/")                          = 0
stat(":0", 0x7fffe270e180)              = -1 ENOENT (No such file or directory)
stat("pts/0", 0x7fffe270e180)           = -1 EACCES (Permission denied)
stat("pts/1", 0x7fffe270e180)           = -1 EACCES (Permission denied)
open("/proc/loadavg", O_RDONLY)         = 5
--


This ruleset fixes the problem:

---
require {
        type rwho_t;
        type user_devpts_t;
        class chr_file { getattr };
}

allow rwho_t user_devpts_t:chr_file getattr;
--