Re: temporary hack to use udev in selinux

[Luke Kenneth Casson Leighton <lkcl@lkcl.net>]

On Wed, Jul 28, 2004 at 08:29:45PM -0400, Joshua Brindle wrote:
> Luke Kenneth Casson Leighton wrote:
> 
> >i have a requirement (use of usb-mount, see
> >http://users.actrix.co.nz/michael/usbmount.html) that forces the use
> >of udev on an selinux system.
> >
> >fighting with it for a day, and after seeing some clues in the
> >file contexts (/(u)dev/....) i decided to try editing
> >/etc/udev/udev.conf to set it to use /udev instead of /dev.
> >
> >other than a warning about udev not starting up, well, everything
> >seems to work hunky-dory.
> >
> >somehow i do _get_ a udevd running, i could not tell you how it got
> >there.
> >
> >i notice the following message 
> >
> >	http://www.redhat.com/archives/fedora-devel-list/2004-March/msg00888.html
> >
> >in which steven (hi steven :) says that support for udev "fake"
> >attributes for ramfs and tmpfs, just like for devpts.
> >
> >is that literally as simple as cut/paste the devpts code...
> >the xattr stuff?
> >
> >cos if so, i _like_ cut/paste :)
> >
> >l.
> >
> > 
> >
> Chris PeBenito made this patch for Gentoo when we were evalutating udev 
> on selinux
> 
> http://dev.gentoo.org/~method/1330_linux-2.6.5-ramfs-xattr.patch
> 
> that should patch cleanly into 2.6.7, but I'd like to note that at this 
> point udev is braindead wrt SELinux.
> Once upon a time udev had selinux support integrated so that setfscreate 
> was called to set the context of the devices being written however it 
> was changed at some point to make SELinux an after device creation addon 
> script which makes it label the devices after they are created. 

 ... *click*... re-read what you said.

 yes, the change was made version 0.24 or so.

> Because 
> of this Hardened Gentoo has decided not to support udev at this time.


 why are project developers removing [selinux] stuff like this?

 i mean, not that i am in a position to care [whereas gentoo is]
 but that's just such an obvious No.

 you don't _create_ race conditions, even when the default permissions
 are going to be (null) on a mandatory access control system like
 selinux.

 removing setting of device contexts from udev _clearly_ sets the
 devices up for being inaccessible for a period of time.

 unless the developer of udev is somehow guaranteeing that no access
 will be made to the /dev item being created.

 l.


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.