mount accessing /dev/cdrom as a symlink

mount accessing /dev/cdrom as a symlink

[Luke Kenneth Casson Leighton]

i had to add this to the mount.te policy in order to allow mount
to actually succeed on a udev-automatically-created /dev/cdrom symlink
(to /dev/hdc which is my ide cdrom drive).

so, the question is: should udev have relabelled that symlink correctly,
or should mount be allowed to read device_t symlinks?

bearing in mind that it's the udev *SCRIPTS* in /etc/udev that
will be creating the symlink, NOT the udevd program, nor the udev
program, nor the udevsend program.

likely to have been /etc/udev/ide-devfs.sh that done it, 'guv.

l.


--- /usr/share/selinux/policy/default.1.14/domains/program/mount.te	2004-08-02 08:28:37.000000000 +0100
+++ domains/program/mount.te	2004-08-28 18:54:24.000000000 +0100
@@ -96,3 +97,6 @@
 allow mount_t mnt_t:dir { getattr };
 dontaudit mount_t { userdomain kernel_t}:fd use;
 can_exec(mount_t, { sbin_t bin_t })
+
+allow mount_t device_t:lnk_file { read };
+	#EXE=/bin/mount  NAME=cdrom   :  read

-- 
--
Truth, honesty and respect are rare commodities that all spring from
the same well: Love.  If you love yourself and everyone and everything
around you, funnily and coincidentally enough, life gets a lot better.
--
<a href="http://lkcl.net">      lkcl.net      </a> <br />
<a href="mailto:lkcl@lkcl.net"> lkcl@lkcl.net </a> <br />


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: mount accessing /dev/cdrom as a symlink

[Russell Coker]

On Sun, 29 Aug 2004 04:19, Luke Kenneth Casson Leighton <lkcl@lkcl.net> wrote:
> i had to add this to the mount.te policy in order to allow mount
> to actually succeed on a udev-automatically-created /dev/cdrom symlink
> (to /dev/hdc which is my ide cdrom drive).
>
> so, the question is: should udev have relabelled that symlink correctly,
> or should mount be allowed to read device_t symlinks?

Mount should be allowed to read device_t symlinks.  There should be no symlink 
under /dev with a type other than device_t under the current design.

-- 
http://www.coker.com.au/selinux/   My NSA Security Enhanced Linux packages
http://www.coker.com.au/bonnie++/  Bonnie++ hard drive benchmark
http://www.coker.com.au/postal/    Postal SMTP/POP benchmark
http://www.coker.com.au/~russell/  My home page

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: mount accessing /dev/cdrom as a symlink

[Luke Kenneth Casson Leighton]

On Sun, Aug 29, 2004 at 05:08:23PM +1000, Russell Coker wrote:
> On Sun, 29 Aug 2004 04:19, Luke Kenneth Casson Leighton <lkcl@lkcl.net> wrote:
> > i had to add this to the mount.te policy in order to allow mount
> > to actually succeed on a udev-automatically-created /dev/cdrom symlink
> > (to /dev/hdc which is my ide cdrom drive).
> >
> > so, the question is: should udev have relabelled that symlink correctly,
> > or should mount be allowed to read device_t symlinks?
> 
> Mount should be allowed to read device_t symlinks.  There should be no symlink 
> under /dev with a type other than device_t under the current design.
 
 okay, great.  so for once i DidTheRightThing.  gosh.


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.