Hi, I am the Fedora's BOINC co-maintainer.
BOINC > 7.4.x wants to access to /dev/input/event9 that corresponds to user's keyboard
https://bugzilla.redhat.com/show_bug.cgi?id=1337607
I would need to know why it tries to read from that device. To detect user inactivity time?
As BOINC co-maintainers we have been asked (by SELinux maintainers) to decide if SELinux should allow such readings or not.

Yes, this is part of user inactivity detection. I don't see much discussion in the bug mentioned. Is the concern that the BOINC Client would act as a keylogger?

Is the concern that the BOINC Client would act as a keylogger?

Yeah exactly

Well then options are limited unless you come up with a better way to detect user idleness.

Any program, free or paid, could be a keylogger, for all I know my MS Office 365 does this, except my firewall is not recording any suspect outgoing traffic.

WCG (IBM) actually security audits the source code before [is in development of doing this for 7.6 at this time], because else they'd not get their corporate college/university, even banks as partners to allow installation. Go back to 7.2.42 or 7.2.47 [WCG skinned] and download it from their website, but can you trust them?

---

Coelum Non Animum Mutant, Qui Trans Mare Currunt

The code doesn't try to read the device file. It only tries to get its last modified time.

At least on Mint 17 = Ubuntu 14.04 the code doesn't actually work, the last modified time isn't updated. If Fedora is same then you could patch out the code to remove both the security concern and the SELinux warning.

Rom added the code in 2014. I would like to think that he tested it and found out that it does work on some, perhaps older, distro.

I added a suggestion about how to implement user idle time detection in systemd based Linux distributions
https://github.com/BOINC/boinc/issues/1187#issuecomment-225699768