Re: [gentoo-hardened] Can't start eterm and xterm as normal user using X under SELinux and hardened gcc

[Victor Banatean]

Hi there,

thanks for your hints/help first.

>On Fri, 24 Sep 2004 16:51:11 +0200
>Victor Banatean <Pie_Oh_Pah@×××.net> wrote:
>
>
>
>>Hi everyone,
>>
>>I have a problem using eterm and xterm when starting X as a normal
>>user, as soon as I switch to root no problem at all.
>>
>>This is the error message for eterm and xterm:
>>Eterm: Error: Can't open pseudo-tty -- No such file or directory
>>Eterm: Error: Unable to run sub-command
>>
>>xterm: Error 32, errno 2: No such file or directory
>>Reason: get_pty: not enough ptys
>>
>>
>>
>>>
>>>Are you using udev-030? I had the same problem recently and
>>>emerging udev-032 fixed it. In both cases I had tty udev perms
>>>set to root:tty:0660, but I assumed the error was caused by a tty entry
>>>in 50-udev.rules, which in 032 was changed from
>>>KERNEL="tty[p-za-e][0-9a-f]*", NAME="tty/s%n", SYMLINK="%k"
>>>to
>>>KERNEL="tty[p-za-e][0-9a-f]*", NAME="pty/s%n", SYMLINK="%k"
>>>
>>>Hope that helps,
>>>
>>>Barry
>>>
>>>
>>>
>>>>Hi Victor,
>>>>
>>>>This sounds like you're having issues with device
>>>>permissions. You might be able to use "strace xterm"
>>>>to figure out where things get messed up. AFAIK
>>>>xterm will connect to /dev/tty and your user will have to
>>>>have rw permissions for it to do so. If your permissions
>>>>are different try to chmod them.
>>>>
>>>>MARKUS
>>>>
>>>>
>>>>This is most likely the case.  The current /dev/tty in the SELinux
>>>>stages is 0600, when it should be 0644.
>>>>Whoops, I mean 0666.
>>>>
>>>>
>>>> -- Chris PeBenito
>>>
>>
>>

To get rid of the problem with the xterm there are two
possibilities:

1. chmod 666 /dev/tty
2. emerge udev-030 and process
    "/etc/udev/permissions.d/50-udev.permissions":

    # /etc/udev/udev.permissions:  permission/ownership map for udev
    # $Header: 
/home/cvsroot/gentoo-x86/sys-fs/udev/files/udev.permissions,v 1.3 
2004/01/01 03:41:24 azarah Exp $

    # console devices
    console:root:tty:0600
    tty:root:tty:0666 => this line is relevant
    tty[0-9]*:root:tty:0660
    vc/[0-9]*:root:tty:0660

At the Eterm problem I tried the following things:

1. chmod 666 /dev/ptmx and chmod 666 pty*
2. process the two files
    "/etc/udev/permissions.d/50-udev.permissions" :

    # /etc/udev/udev.permissions:  permission/ownership map for udev
    # $Header: 
/home/cvsroot/gentoo-x86/sys-fs/udev/files/udev.permissions,v 1.3 
2004/01/01 03:41:24 azarah Exp $

    # console devices
    console:root:tty:0600
    tty:root:tty:0666
    tty[0-9]*:root:tty:0660
    vc/[0-9]*:root:tty:0660

    # pty devices
    #  Set this to 0660 if you only want users belonging to tty group
    #  to be able to allocate PTYs
    ptmx:root:tty:0666 => relevant line, standard value
    # pty[p-za-e][0-9a-f]*:root:tty:0660
    pty[p-za-e][0-9a-f]*:root:tty:0666 => relevant line, I changed it to 
this value
    tty[p-za-e][0-9a-f]*:root:tty:0660
    pty/m*:root:tty:0660
    vc/s*:root:tty:0660

    and "/etc/udev/rules.d/50-udev.rules" :

    # /etc/udev/udev.rules:  device naming rules for udev
    #
    # Gentoo specific rules, based a bit on devfs rules, but much simpler.
    #
    # There are a number of modifiers that are allowed to be used in 
some of the
    # fields.  See the udev man page for a full description of them.
    :
    :
    # pty devices
    KERNEL="pty[p-za-e][0-9a-f]*", NAME="pty/m%n", SYMLINK="%k"
    # KERNEL="tty[p-za-e][0-9a-f]*", NAME="tty/s%n", SYMLINK="%k"
    KERNEL="tty[p-za-e][0-9a-f]*", NAME="pty/s%n", SYMLINK="%k" => 
relevant line, I changed it to this value
    :
    :

However there is no change, Eterm will not start, the same error message.

Nevertheless I found a solution, but I do not prefer it, so I'll will 
try it again
tomorrow. If anyone have a good idea or hint,please tell it.

So my solution is to put the normal user at the "tty" group.
I guess this one is a bad suggestion, but it works :-D. I hope we will find
a better one tomorrow.

Thanks a lot for your help.
Good night.
See you tomorrow.

Victor

--
gentoo-hardened@g.o mailing list