[PATCH] Hal privilige seperation

[John (J5) Palmieri]

On Fri, 2006-01-20 at 08:13 -0800, Artem Kachitchkine wrote:
> >   How does it work? Just before drops it's root privs. a small program is
> >   startup which will remain running as root and does the real execution of the
> >   addons/probes/callouts on hals behalf.
> 
> Does hald-runner exist only so that the addons have a privileged 
> ancestor they can inherit privileged uid/gid from? If so, wouldn't it be 
> much easier if hald regained its privileges temporarily before exec'ing 
> an addon and dropping them immediately after?
> 
> Also, this assumes that all addons/probes/callouts must run as root. 
> What if some of them don't?
> 
> -Artem.

Actually, I'm not 100% sure on this but I think it is much easier to
craft SELinux rules if we have separate processes.

-- 
John (J5) Palmieri <johnp at redhat.com>