On 04/04/2013 01:10 PM, Sven Vermeulen wrote:
Hi all,
I'm running with policycoreutils-2.1.13 and am noticing that tmux does not
display its terminal output when I have switched roles with newrole. tmux is
not SELinux-aware (not linked with libselinux) and this behavior is also
apparent when I run in permissive mode, so I'm guessing this has to do with
what newrole does rather then SELinux policy itself.
During a strace, I notice that what I believe is the file descriptor
representing the standard output of the tmux application is readonly,
whereas when I have not switched roles, this is read-write.
Non-working:
#v+
10905 recvmsg(8, {msg_name(0)=NULL, msg_iov(1)=[{"31:*.war=01;31:*.ear=01;31:*.sar=01;31:*.rar=01;31:*.ace=01;31:*.zoo=01;31:*.cpio=01;31:*.7z=01;31:*.rz=01;31:*.jpg=01;35:*.jpeg=01;35:*.gif=01;35:*.bmp=01;35:*.pbm=01;35:*.pgm=01;35:*.ppm=01;35:*.tga=01;35:*.xbm=01;35:*.xpm=01;35:*.tif=01;35:*.tiff=01;35:"..., 65071}], msg_controllen=24, {cmsg_len=20, cmsg_level=SOL_SOCKET, cmsg_type=SCM_RIGHTS, {10}}, msg_flags=0}, 0) = 10036
10905 fcntl(9, F_GETFL) = 0x8000 (flags O_RDONLY|O_LARGEFILE)
10905 fcntl(9, F_SETFL, O_RDONLY|O_NONBLOCK|O_LARGEFILE) = 0
#v-
Working:
#v+
10905 recvmsg(8, {msg_name(0)=NULL, msg_iov(1)=[{"31:*.war=01;31:*.ear=01;31:*.sar=01;31:*.rar=01;31:*.ace=01;31:*.zoo=01;31:*.cpio=01;31:*.7z=01;31:*.rz=01;31:*.jpg=01;35:*.jpeg=01;35:*.gif=01;35:*.bmp=01;35:*.pbm=01;35:*.pgm=01;35:*.ppm=01;35:*.tga=01;35:*.xbm=01;35:*.xpm=01;35:*.tif=01;35:*.tiff=01;35:"..., 65071}], msg_controllen=24, {cmsg_len=20, cmsg_level=SOL_SOCKET, cmsg_type=SCM_RIGHTS, {10}}, msg_flags=0}, 0) = 12116
10905 fcntl(9, F_GETFL) = 0x8002 (flags O_RDWR|O_LARGEFILE)
10905 fcntl(9, F_SETFL, O_RDWR|O_NONBLOCK|O_LARGEFILE) = 0
#v-
When the output isn't displayed, tmux does still work: I can run commands
(as if it is a shell) and can even see the output when I'm also attached
elsewhere - as long as I haven't switched roles. I can also send tmux
commands (like detach) which succeed.
Screen does not have this problem - even after switching roles, I can
succesfully attach/detach screens. Even more, I can launch a screen session
*after* switching role, and then I *can* use tmux (so tmux within screen)
and get its output.
Is there anything I can do to debug this further? newrole doesn't contain
much. Also, if some of you could see if they have the same problem or not
(tmux 1.6 and tmux 1.8 both have this behavior).
newrole closes and re-opens stdin, stdout, and stderr so that the open
file descriptions are in its security context rather than that of the
caller. It re-opens stdin with O_RDONLY and stdout / stderr with O_RDWR.
You could trivially patch newrole to open stdin with O_RDWR and see if
that helps. If so, then tmux is using stdin as both input and output,
which seems like a bug in it, but would work in the absence of newrole.
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@xxxxxxxxxxxxx with
the words "unsubscribe selinux" without quotes as the message.
