patch for fsadm

patch for fsadm

[Luke Kenneth Casson Leighton]

[-- Attachment #1: Type: text/plain, Size: 747 bytes --]

usb-mount uses sg_map and disktype.

both these programs require some extra stuff.

basically the usb-mount script uses sg_map, disktype and fdisk
to determine info about the usb scsi drive now within its evil
grasp: e.g. the volume name, volume id, and whether the disk
has a partition table on it or whether it _is_ a partition.

so, anyway, these additions were required to not have usb-mount
poo up.

l.

-- 
--
Truth, honesty and respect are rare commodities that all spring from
the same well: Love.  If you love yourself and everyone and everything
around you, funnily and coincidentally enough, life gets a lot better.
--
<a href="http://lkcl.net">      lkcl.net      </a> <br />
<a href="mailto:lkcl@lkcl.net"> lkcl@lkcl.net </a> <br />


[-- Attachment #2: fsadm --]
[-- Type: text/plain, Size: 1332 bytes --]

diff -Naur 
--- default.1.14/domains/program/fsadm.te	2004-08-02 08:28:37.000000000 +0100
+++ current/domains/program/fsadm.te	2004-08-22 17:58:20.000000000 +0100
@@ -117,3 +116,15 @@
 # Access to /initrd devices
 allow fsadm_t { file_t unlabeled_t }:dir rw_dir_perms;
 allow fsadm_t { file_t unlabeled_t }:blk_file rw_file_perms;
+
+# this is for sg_map and disktype
+allow fsadm_t scsi_generic_device_t:chr_file { ioctl read };
+allow fsadm_t tape_device_t:chr_file { read };
+allow fsadm_t removable_device_t:lnk_file { read };
+#allow fsadm_t device_t:chr_file { read ioctl };
+#allow fsadm_t device_t:blk_file { read ioctl getattr };
+
+# /bin/mountpoint to read /dev/shm
+allow fsadm_t devpts_t:dir { search };
+allow fsadm_t tmpfs_t:dir { getattr search };
+
diff -Naur 
--- default.1.14/file_contexts/program/fsadm.fc	2004-08-02 08:28:37.000000000 +0100
+++ current/file_contexts/program/fsadm.fc	2004-08-06 19:03:43.000000000 +0100
@@ -30,5 +30,7 @@
 /sbin/install-mbr	--	system_u:object_r:fsadm_exec_t
 /usr/bin/scsi_unique_id	--	system_u:object_r:fsadm_exec_t
 /usr/bin/raw		--	system_u:object_r:fsadm_exec_t
+/usr/bin/sg_map		--	system_u:object_r:fsadm_exec_t
+/usr/bin/disktype	--	system_u:object_r:fsadm_exec_t
 /sbin/partx		--	system_u:object_r:fsadm_exec_t
 /usr/bin/partition_uuid	--	system_u:object_r:fsadm_exec_t

Re: patch for fsadm

[Russell Coker]

On Tue, 24 Aug 2004 07:50, Luke Kenneth Casson Leighton <lkcl@lkcl.net> wrote:
> usb-mount uses sg_map and disktype.
>
> both these programs require some extra stuff.

# this is for sg_map and disktype
allow fsadm_t scsi_generic_device_t:chr_file { ioctl read };

It only needs ioctl and read access?  I'll give it r_file_perms.

+allow fsadm_t tape_device_t:chr_file { read };

Why does it need to access tape devices?

allow fsadm_t removable_device_t:lnk_file { read };

This is wrong.  We don't want to label lnk_file objects under /dev other than 
as device_t.

+# /bin/mountpoint to read /dev/shm
+allow fsadm_t devpts_t:dir { search };
+allow fsadm_t tmpfs_t:dir { getattr search };

The tmpfs_t part is good, I'm not so sure about the devpts_t part.

-- 
http://www.coker.com.au/selinux/   My NSA Security Enhanced Linux packages
http://www.coker.com.au/bonnie++/  Bonnie++ hard drive benchmark
http://www.coker.com.au/postal/    Postal SMTP/POP benchmark
http://www.coker.com.au/~russell/  My home page

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: patch for fsadm

[Luke Kenneth Casson Leighton]

On Wed, Aug 25, 2004 at 01:36:19AM +1000, Russell Coker wrote:
> On Tue, 24 Aug 2004 07:50, Luke Kenneth Casson Leighton <lkcl@lkcl.net> wrote:
> > usb-mount uses sg_map and disktype.
> >
> > both these programs require some extra stuff.
> 
> # this is for sg_map and disktype
> allow fsadm_t scsi_generic_device_t:chr_file { ioctl read };
> 
> It only needs ioctl and read access?  I'll give it r_file_perms.
> 
> +allow fsadm_t tape_device_t:chr_file { read };
> 
> Why does it need to access tape devices?
> 
> allow fsadm_t removable_device_t:lnk_file { read };
> 
> This is wrong.  We don't want to label lnk_file objects under /dev other than 
> as device_t.
> 
> +# /bin/mountpoint to read /dev/shm
> +allow fsadm_t devpts_t:dir { search };
> +allow fsadm_t tmpfs_t:dir { getattr search };
> 
> The tmpfs_t part is good, I'm not so sure about the devpts_t part.
 
 cool, hey, well, if enough ends up in the default policy, such that at
 some point in the future i can just do apt-get install
 selinux-policy-default and it works, _great_.

 until then, my lack of experience will mean i have lots of crud
 to throw at you, hopefully you'll know which bits to catch and which
 to dodge...

 l.


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.