How do I make sure programs have write access to their own tty?

[Aleksey Nogin]

When I run (from staff_r) things via sudo, then sometimes it turns out 
that the programs I run end up not being able to communicate back to me 
as they are denied access to the tty they are running on (see 
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=119209 for details).

Is there some way within the SELinux framework to give programs write 
access to the tty they are running on w/o giving them write access to 
all the ttys of the same type?

[Stephen Smalley]

On Sat, 2004-03-27 at 20:12, Aleksey Nogin wrote:
> When I run (from staff_r) things via sudo, then sometimes it turns out 
> that the programs I run end up not being able to communicate back to me 
> as they are denied access to the tty they are running on (see 
> https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=119209 for details).
>
> Is there some way within the SELinux framework to give programs write 
> access to the tty they are running on w/o giving them write access to 
> all the ttys of the same type?

Types are security equivalence classes.  So if you've placed a set of
objects into a single type, then they are accessible in the same
manner.  Now, you can have programs transition into derived domains that
preserve their call chain information, and use that to control access to
types, e.g staff_t runs program foo in staff_foo_t and sysadm_t run
program foo in sysadm_foo_t, and $1_foo_t only gets access to
$1_devpts_t.

However, in this particular case, where sudo is performing an explicit
role change, I would expect that sudo would relabel the pty based on the
new user domain, so it should be relabeled to sysadm_devpts_t while the
command is being executed, and then reset to its original type.