Re: Proposed Hardware File Context file.

[Luke Kenneth Casson Leighton <lkcl@lkcl.net>]

On Thu, Sep 02, 2004 at 11:52:03AM -0400, Daniel J Walsh wrote:
> Collin and I were discussing a way to label hardware devices correctly.
> 
> One proposal would be to come up with a new file_contexts file based off 
> of path and hardware type.
> 
> So we could have a file with
> 
> /dev/h
> 
> /u?dev/[shmx]d[^/]*    -b    system_u:object_r:fixed_disk_device_t

you mean:

  /u?dev/[shmx]d[^/]*    -b    system_u:object_r:fixed_disk_device_t disk

or do you mean _not_ having the extra word on the end to indicate
the default, should the type not be matched [by a udev script]?

> /u?dev/[shmx]d[^/]*    -b    system_u:object_r:removable_disk_device_t cdrom

> Then either add a param to matchpathcon or a new function that would 
> pass in the hardware type
> and get the correct context.
> 
> Then tools like udev could use this to create the device with the 
> correct context.
> 
> ideas??

 interesting.

 in some respects, it's almost like you don't need the /u?dev/[...]...
 bit: if it's a cdrom, you know it's removable_disk_device_t, end
 of story.

 hm.

 except.... what about restricting access to removable_disk_device_t,
 or is that covered by user_rw_noexattrfile?

 l.

 

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.