Re: [SE/Linux] warning about debian hotplug package 20040329-9!

[Luke Kenneth Casson Leighton <lkcl@lkcl.net>]

On Mon, Jul 12, 2004 at 02:16:58PM -0700, Chris Babcock wrote:
> So then what if (horror of horrors) somebody puts "/var" on a usb disk
> device. (or some other type of device initialized by hotplug?)
 
 or an nfs-mounted partition.

 the suggestion in that case that i received by one of the hotplug
 developers / people-monitoring-debian-bugs-for-hotplug was that you
 should modify the /etc/hotplug scripts to use /devfs/shm/tmp instead,
 assuming that you have a debian initrd.

 now, on SE/Linux that isn't possible, and the reason isn't entirely
 clear, but i believe that the access permissions to the tmpfs
 created by the debian initrd are such that when the umount tmpfs
 occurs, it actually _does_ unmount it.

 on a standard debian/linux system (no selinux kernel) the initrd
 scripts attempt, amongst other things, to mount various filesystems
 and these are successful, but they are not _un_mounted properly later
 on.

 anyway, i digress: the idea i came up with was that the debian
 package be modified such that it's possible to specify the
 state directory, even if that's one of a list of possible
 locations e.g.  choose one: /etc/hotplug, /etc/hotplug/run,
 /var/run/hotplug, /devfs/shm/tmp, other.

 consequently, if this were to be implemented, at least people mad
 enough to use usb disks or nfs mounted stuff, they'd be able to
 at least get going without having to hack the source of hotplug.

 
> > dear selinux and linux kernel,
> >
> > i am after some assistance in clarifying how hotplug works, with
> > a view to solving an issue with SE/Linux where the default
> > SE/Linux policy is to deny write permission to /etc/hotplug
> > (with good reason) but the hotplug package is presently demanding
> > write permission.
> >
> > a simple request for a change to writing to /var/state/hotplug
> > instead has thrown up a number of issues with kernel (2.6.6)
> > hotplugging and i would greatly appreciate some confirmation
> > and some assistance.

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.