Description of problem: After using 'newrole' to change roles on an MLS system, the 'more' command no longer works. It gets an EBADF when trying to read the user's input for paging. The problem is that 'more' reads stderr but 'newrole' closes stderr and re-opens it as WRONLY. Should we make 'newrole' less paranoid with respect to stderr or fix 'more'? 'less' reads stdin and therefore works. Version-Release number of selected component (if applicable): RHEL5 Beta 2 with MLS policy and policycoreutils from dwalsh people page. How reproducible: very Steps to Reproduce: 1.install an mls system 2.log in 3.run 'more' on a file bigger than a screen full (works) 4.run 'newrole' to change roles, or probably anything else 5.run 'more' again on the same file and it will terminate after the first screen full. An strace shows its an EBADF and I've verified that the newrole code closes and reopens the fd. Actual results: 'more' aborts after the first screen full. Expected results: 'more' should wait for user input and then page through the file according. Additional info:
Recommend reverting newrole to opening all three descriptors rw, as it used to do before it was "cleaned up". This seems consistent with how the shell sets up descriptors for the tty as well. Should be a trivial patch, please take to selinux list.
Fixed in policycoreutils-1.33.6-4.el5
When this shows up in a repo or a kit I'll give it a try. Are you also posting a patch to the selinux list?
QE ack for RHEL5.
A package has been built which should help the problem described in this bug report. This report is therefore being closed with a resolution of CURRENTRELEASE. You may reopen this bug report if the solution does not work for you.