Red Hat Bugzilla – Bug 119546
w doesn't show /dev/ttyn things in the enforcing mode
Last modified: 2007-11-30 17:10:39 EST
From Bugzilla Helper:
User-Agent: Mozilla/5.0 (X11; U; Linux i686; ja-JP; rv:1.6)
Description of problem:
When I run the w command on the console in the enforcing mode, it
doesn't work properly-- actually loggin into /dev/ttyn is me as the
normal user. but I can't find meself out from the result of w. but it
works well in the permissive mode. so I guess the file contexts for
/dev/tty* may be wrong.
Version-Release number of selected component (if applicable):
Steps to Reproduce:
1.login as the normal user in the enforcing mode.
Actual Results: /dev/ttyn entries is hidden
Expected Results: it should be shown
I couldn't find any avc messages related this, though
Looks like an omission from the policy,
allow $1_t initrc_var_run_t:file r_file_perms;
in user_macros.te or base_user_macros.te.
Adding Russell to cc line, as this is a policy issue.
Side bar: base_user_macros.te currently gives lock permission, this
seems like a bad idea.
Fixed in policy-1.9.1-1
confirmed the working. Thanks!
this problem appears again. I've tested this on policy 1.11.2-8. reopening
Ok. This happens because w.c looks through /proc for the PID of the
login process associated with their login. Since user_t isn't allowed
getattr on local_login_t, this is denied.
It apparently does this because it's double-checking that the login
still exists. So we could either
1) Allow users to stat local_login_t processes
2) Disable the code in w.c that looks for the login process, and just
accept that the information could be stale.
Any opinions on which would be better? I have a patch for 1), and a
patch for 2) should be pretty easy too.
I went ahead and did 2) for now. Comments still welcome. I don't
think the procps maintainer will like the patch...