Re: policy patch for tunable "/dev/hdc is removable drive"

[Luke Kenneth Casson Leighton <lkcl@lkcl.net>]

On Wed, Aug 25, 2004 at 09:40:41PM +1000, Russell Coker wrote:
> On Tue, 24 Aug 2004 19:15, Thomas Bleher <bleher@informatik.uni-muenchen.de> 
> wrote:
> > * Luke Kenneth Casson Leighton <lkcl@lkcl.net> [2004-08-24 03:38]:
> > > in amongst this lot are two lines that say /dev/hdc something here
> > >
> > > we go:
> > > > +/.?u?dev/hdc  -b system_u:object_r:tunably_defined_disk_t
> > > > +/.?u?dev/[h]d[^/^c]* -b system_u:object_r:fixed_disk_device_t
> >
> > I don't think this is the right approach. Not all users have their
> > CD-Rom on /dev/hdc.
> > I've been using a hack to the Makefile which works well on the
> > hundred-odd machines we have here:
> 
> I agree.  Luke's code makes a tunable for whether /dev/hdc is a cd-rom, not 
> whether /dev/hdb, /dev/hdd, etc might be a tunable.
> 
> > --- orig/Makefile
> > +++ mod/Makefile
> > @@ -145,6 +145,7 @@
> >         @grep -v "^/root" $@.tmp > $@.root
> >         @/usr/sbin/genhomedircon . $@.root  > $@
> >         @grep "^/root" $@.tmp >> $@
> > +       @for i in /proc/ide/hd*/media; do grep -q cdrom $$i && echo $$i |
> > awk -F / '{ print "/dev/"$$4"\t-b\tsystem_u:object_r:removable_device_t"}'
> > >> $@; done @-rm $@.tmp $@.root
> 
> Good work, but there's one minor bug.  

 would it work with udev, too?

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.