Re: policy patch for tunable "/dev/hdc is removable drive"

[Luke Kenneth Casson Leighton <lkcl@lkcl.net>]

On Wed, Aug 25, 2004 at 11:57:08PM +1000, Russell Coker wrote:
> On Wed, 25 Aug 2004 23:53, Luke Kenneth Casson Leighton <lkcl@lkcl.net> wrote:
> > > > --- orig/Makefile
> > > > +++ mod/Makefile
> > > > @@ -145,6 +145,7 @@
> > > >         @grep -v "^/root" $@.tmp > $@.root
> > > >         @/usr/sbin/genhomedircon . $@.root  > $@
> > > >         @grep "^/root" $@.tmp >> $@
> > > > +       @for i in /proc/ide/hd*/media; do grep -q cdrom $$i && echo $$i
> > > > | awk -F / '{ print
> > > > "/dev/"$$4"\t-b\tsystem_u:object_r:removable_device_t"}'
> > > >
> > > > >> $@; done @-rm $@.tmp $@.root
> > >
> > > Good work, but there's one minor bug.
> >
> >  would it work with udev, too?
> 
> udev uses the same file_contexts file, so it should work.  The only possible 
> problem I can think of is that if you have a machine which boots without IDE 
> disk access and which has no IDE modules loaded at the time that it has the 
> file_contexts file generated then this would not work (think of servers that 
> have IDE CD-ROM or DVD drives but hardware RAID or SCSI for main storage).
> 
> Of course this is not necessarily a problem, Fedora kernels have the IDE 
> drivers statically linked into the kernel, and there were some issues last 
> time I tried building a Debian kernel with IDE as a module so the number of 
> people who might get hit by this is very small.
 
 ... initrd.  initial ramdisk.  contains all ide drivers, 'n'stuff.

 i always always start from herbert's standard debian config files,
 add the selinux configs, then run make-kpkg --initrd kernel-image.

 then do a dpkg -i on the resultant .deb.

 that way i stand a good chance of minimising any potential problems
 with kernel/thingy inconsistencies.

 l.
 

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.