Enabling Console Access For Other Applications - Red Hat ENTERPRISE LINUX 5 - DEPLOYMENT Deployment Manual

Open the original default perms file, 50-default.perms. The first section defines device classes,
with lines similar to the following:
<floppy>=/dev/fd[0-1]* \
/dev/floppy/* /mnt/floppy*
<sound>=/dev/dsp* /dev/audio* /dev/midi* \
/dev/mixer* /dev/sequencer \
/dev/sound/* /dev/beep \
/dev/snd/*
<cdrom>=/dev/cdrom* /dev/cdroms/* /dev/cdwriter* /mnt/cdrom*
Items enclosed in brackets name the device; in the above example, <cdrom> refers to the CD-
ROM drive. To add a new device, do not define it in the default 50-default.perms file; instead,
define it in 51-default.perms. For example, to define a scanner, add the following line to 51-
default.perms:
<scanner>=/dev/scanner /dev/usb/scanner*
Of course, you must use the appropriate name for the device. Ensure that /dev/scanner is really
your scanner and not some other device, such as your hard drive.
Once you have properly defined a device or file, the second step is to specify its permission
definitions. The second section of /etc/security/console.perms.d/50-default.perms
defines this, with lines similar to the following:
<console> 0660 <floppy> 0660 root.floppy
<console> 0600 <sound>
<console> 0600 <cdrom>
To define permissions for a scanner, add a line similar to the following in 51-default.perms:
<console> 0600 <scanner> 0600 root
Then, when you log in at the console, you are given ownership of the /dev/scanner device with the
permissions of 0600 (readable and writable by you only). When you log out, the device is owned by
root, and still has the permissions 0600 (now readable and writable by root only).
Warning
You must never edit the default 50-default.perms file. To edit permissions for a device
already defined in 50-default.perms, add the desired permission definition for that
device in 51-default.perms. This will override whatever permissions are defined in
50-default.perms.

27.5. Enabling Console Access for Other Applications

To make other applications accessible to console users, a bit more work is required.
First of all, console access only works for applications which reside in /sbin/ or /usr/sbin/, so the
application that you wish to run must be there. After verifying that, perform the following steps:
1. Create a link from the name of your application, such as our sample foo program, to the /usr/
bin/consolehelper application:
0640 root
0600 root.disk
Enabling Console Access for Other Applications
429