From: Luke Kenneth Casson Leighton <lkcl@lkcl.net>
To: Stephen Smalley <sds@epoch.ncsc.mil>
Cc: SE-Linux <selinux@tycho.nsa.gov>,
Linux Hotplug Dev List
<linux-hotplug-devel@lists.sourceforge.net>
Subject: Re: lots of allow xxx_device_t device_t:filesystem { associate }
Date: Mon, 09 Aug 2004 18:59:21 +0000 [thread overview]
Message-ID: <20040809190901.GM3868@lkcl.net> (raw)
In-Reply-To: <1092077016.29199.166.camel@moss-spartans.epoch.ncsc.mil>
On Mon, Aug 09, 2004 at 02:43:36PM -0400, Stephen Smalley wrote:
> On Mon, 2004-08-09 at 13:52, Luke Kenneth Casson Leighton wrote:
> > i'm getting an awful lot of the above due to udev creating
> > inodes in /dev which i decided to associate with device_t.
>
> allow device_type device_t:filesystem associate;
> should cover most cases.
thank you: i found this: i was more concerned that i should
be setting mount -o fscontext=....fs_t instead?
> > now i have had to add about 15 or 20 lines so far each for pretty
> > much every xxx_device_t under the sun, and am concerned that i
> > am taking the wrong approach.
>
> Other than the associate permission, what else do you need to add?
eek.
allow initrc_t device_t:lnk_file { create };
for a symlink to be created between /proc/self/fd and /dev/fd
i realise it would be better to move stuff in /etc/init.d/udev
to a separate program, e.g. /sbin/udev-init, and to have that
program be given a separate domain instead of having to add
this to initrc_t.
allow udev_t device_t:file { getattr unlink };
for /sbin/udev to stat and remove /dev/null...
exactly what is going on here i don't know.
allow udev_t self:process { setfscreate };
surprise surprise, it's doing the same thing as restorecon,
so, duh, udev needs this.
more later.
l.
-------------------------------------------------------
SF.Net email is sponsored by Shop4tech.com-Lowest price on Blank Media
100pk Sonic DVD-R 4x for only $29 -100pk Sonic DVD+R for only $33
Save 50% off Retail on Ink & Toner - Free Shipping and Free Gift.
http://www.shop4tech.com/z/Inkjet_Cartridges/9_108_r285
_______________________________________________
Linux-hotplug-devel mailing list http://linux-hotplug.sourceforge.net
Linux-hotplug-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/linux-hotplug-devel
WARNING: multiple messages have this Message-ID (diff)
From: Luke Kenneth Casson Leighton <lkcl@lkcl.net>
To: Stephen Smalley <sds@epoch.ncsc.mil>
Cc: SE-Linux <selinux@tycho.nsa.gov>,
Linux Hotplug Dev List
<linux-hotplug-devel@lists.sourceforge.net>
Subject: Re: lots of allow xxx_device_t device_t:filesystem { associate }
Date: Mon, 9 Aug 2004 20:09:01 +0100 [thread overview]
Message-ID: <20040809190901.GM3868@lkcl.net> (raw)
In-Reply-To: <1092077016.29199.166.camel@moss-spartans.epoch.ncsc.mil>
On Mon, Aug 09, 2004 at 02:43:36PM -0400, Stephen Smalley wrote:
> On Mon, 2004-08-09 at 13:52, Luke Kenneth Casson Leighton wrote:
> > i'm getting an awful lot of the above due to udev creating
> > inodes in /dev which i decided to associate with device_t.
>
> allow device_type device_t:filesystem associate;
> should cover most cases.
thank you: i found this: i was more concerned that i should
be setting mount -o fscontext=....fs_t instead?
> > now i have had to add about 15 or 20 lines so far each for pretty
> > much every xxx_device_t under the sun, and am concerned that i
> > am taking the wrong approach.
>
> Other than the associate permission, what else do you need to add?
eek.
allow initrc_t device_t:lnk_file { create };
for a symlink to be created between /proc/self/fd and /dev/fd
i realise it would be better to move stuff in /etc/init.d/udev
to a separate program, e.g. /sbin/udev-init, and to have that
program be given a separate domain instead of having to add
this to initrc_t.
allow udev_t device_t:file { getattr unlink };
for /sbin/udev to stat and remove /dev/null...
exactly what is going on here i don't know.
allow udev_t self:process { setfscreate };
surprise surprise, it's doing the same thing as restorecon,
so, duh, udev needs this.
more later.
l.
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
next prev parent reply other threads:[~2004-08-09 18:59 UTC|newest]
Thread overview: 13+ messages / expand[flat|nested] mbox.gz Atom feed top
2004-08-09 17:52 lots of allow xxx_device_t device_t:filesystem { associate } Luke Kenneth Casson Leighton
2004-08-09 18:43 ` Stephen Smalley
2004-08-09 18:59 ` Luke Kenneth Casson Leighton [this message]
2004-08-09 19:09 ` Luke Kenneth Casson Leighton
2004-08-09 19:02 ` Stephen Smalley
2004-08-09 19:02 ` Stephen Smalley
2004-08-09 19:43 ` Luke Kenneth Casson Leighton
2004-08-09 19:43 ` Luke Kenneth Casson Leighton
2004-08-10 6:45 ` Russell Coker
2004-08-10 6:45 ` Russell Coker
2004-08-10 12:45 ` Luke Kenneth Casson Leighton
2004-08-10 12:45 ` Luke Kenneth Casson Leighton
2004-08-09 19:35 ` Luke Kenneth Casson Leighton
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20040809190901.GM3868@lkcl.net \
--to=lkcl@lkcl.net \
--cc=linux-hotplug-devel@lists.sourceforge.net \
--cc=sds@epoch.ncsc.mil \
--cc=selinux@tycho.nsa.gov \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.