Riny Qian wrote:
>> What happens in this (on TX) case:
That was supposed to say non TX. Device allocation
works without TX it is a standard Solaris feature.
> TX does not allow users to log in via console and virtual
Yes but that isn't relevant to the example I gave
since device allocation is a standard Solaris feature
that doesn't need TX.
I agree though that with TX enabled normal users won't
be able to login on the console or virtual consoles anyway
since they have a label outside of the users clearance.
>> That seems wrong and completely counter to the whole
>> purpose of device allocation.
> The changes to logindevperm should be independent on
I don't see that they are because with your project
adding an ACL to the device, say the audio device. How
is it ensuring that the device isn't already allocated
with allocate(1M) to an end user ?
> Any way, we'll look further and communicate with TX guys in
> security community.
Darren J Moffat