Re: policy patch for tunable "/dev/hdc is removable drive"

[Luke Kenneth Casson Leighton <lkcl@lkcl.net>]

On Tue, Aug 24, 2004 at 11:15:20AM +0200, Thomas Bleher wrote:
> * Luke Kenneth Casson Leighton <lkcl@lkcl.net> [2004-08-24 03:38]:
> > in amongst this lot are two lines that say /dev/hdc something here
> > we go:
> > 
> > > +/.?u?dev/hdc		-b	system_u:object_r:tunably_defined_disk_t
> > > +/.?u?dev/[h]d[^/^c]*	-b	system_u:object_r:fixed_disk_device_t
> 
> I don't think this is the right approach. Not all users have their
> CD-Rom on /dev/hdc.

 no, i know: that's why i set it to a tunable called
 "tunably_defined_disk_t" :)

> I've been using a hack to the Makefile which works well on the
> hundred-odd machines we have here:
> 
> --- orig/Makefile
> +++ mod/Makefile
> @@ -145,6 +145,7 @@
>         @grep -v "^/root" $@.tmp > $@.root
>         @/usr/sbin/genhomedircon . $@.root  > $@
>         @grep "^/root" $@.tmp >> $@
> +       @for i in /proc/ide/hd*/media; do grep -q cdrom $$i && echo $$i | awk -F / '{ print "/dev/"$$4"\t-b\tsystem_u:object_r:removable_device_t"}' >> $@; done
>         @-rm $@.tmp $@.root

 okay... that's fine on a system that doesn't use udev :) :)

> This inserts a special line into the file_contexts file for every cdrom
> found on the system (according to proc).
> I am however not sure how a proper solution would look like; do we want
> to make policy that system dependant?
> Maybe we need a tool like genhomedircon for devices.
 
  perhaps udev could communicate to run-time tunables to "switch"
  certain device types (like the example tunably_defined_disk_t)
  from their aliases fixed_disk_device_t to removable_disk_device_t?

  of course, it would be necessary to do "prep" things with a
  tunably_defined_hda_t, tunably_defined_hdb_t, tunably_defined you
  get the idea.

  l.


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.