dmesg avcs
Josh Boyer
jwboyer at charter.net
Sun Mar 7 13:18:35 UTC 2004
On Saturday 06 March 2004 10:15 pm, Russell Coker wrote:
> This should not be possible. You should only be able to enter the dmesg_t
> domain from sysadm_t, anaconda_t, or initrc_t. None of those domains
> should have a terminal labeled with user_devpts_t open at the time.
>
> How exactly are you running dmesg? What is the context of the program that
> runs it?
start konsole. su - to root. run dmesg. the output from ps -e --context for
the bash shell:
2011 root:sysadm_r:sysadm_t -bash
> We don't want dmesg_t programs to be under the control of user_t programs.
> If dmesg_t can be reached from user_t and can access it's terminals then
> user_t has a chance at getting sys_admin capability (if the user_r user in
> question has UID==0). sys_admin capability should give full control of the
> machine.
ok. i should do more reading on how the rules and domain transitions
function.
josh
More information about the fedora-selinux-list
mailing list