Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 576522 - agetty needs CAP_SYS_ADMIN if CONFIG_GRKERNSEC_HARDEN_TTY is enabled
Summary: agetty needs CAP_SYS_ADMIN if CONFIG_GRKERNSEC_HARDEN_TTY is enabled
Status: RESOLVED FIXED
Alias: None
Product: Gentoo Linux
Classification: Unclassified
Component: SELinux (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: SE Linux Bugs
URL:
Whiteboard: sec-policy r3
Keywords:
Depends on:
Blocks:
 
Reported: 2016-03-05 15:12 UTC by Mira Ressel
Modified: 2016-09-15 09:35 UTC (History)
0 users

See Also:
Package list:
Runtime testing required: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Mira Ressel 2016-03-05 15:12:48 UTC 
agetty performs an ioctl(TIOCSTI) operation. If a hardened-sources kernel with CONFIG_GRKERNSEC_HARDEN_TTY=y is used, this requires the SYS_ADMIN capability. Our SELinux policy denies it this capability, thereby causing the first character of the username to be chomped.

Two ways to fix this:

1) Add "allow getty_t self:capability sys_admin" to getty.te. pebenito doesn't want this, so we'd wrap it in a distro_gentoo block.

2) Edit the sys-apps/util-linux ebuild to compile agetty with -UAGETTY_RELOAD if USE=selinux.

What do you think?
Comment 1 Mira Ressel 2016-03-05 17:49:35 UTC 
Personally, I'd prefer (2), but I'm a bit uncomfortable with making USE=selinux disable random program features.
Comment 2 Mira Ressel 2016-03-07 16:45:11 UTC 
Upstream merged solution (1) after all.
Comment 3 Jason Zaman gentoo-dev 2016-03-23 19:10:59 UTC 
in ~arch
Comment 4 Jason Zaman gentoo-dev 2016-09-15 09:35:32 UTC 
r4 is stable