Re: Proposed Hardware File Context file.

[Luke Kenneth Casson Leighton <lkcl@lkcl.net>]

On Thu, Sep 02, 2004 at 04:08:53PM -0400, Daniel J Walsh wrote:

> >>The other thought would be to use a separate file that would map device 
> >>type to policy
> >>cat hardware_contexts
> >>
> >>cdrom system_u:object_r:removable_disk_device_t 
> >>
> >>disk system_u:object_r:fixed_disk_device_t
> >>   
> >>
> >
> >I think I like this better.  But let them also specify unit number or
> >similar so that multiple devices of the same type can be mapped to
> >different contexts, please.

 the major and minor numbers?

> >
> > 
> >
> Ok so the original context as specified in the file context file with 
> hardware type.   IE
> PATH  MODETYPE CONTEXT HARDWARE
> /dev/hd.* -b  system_u:object_r:removable_disk_device_t     cdrom
> /dev/hd.* -b  system_u:object_r:fixed_disk_device_t              disk
> 
> >>But this would still fail the restorecon, rpm and setfiles.
> >>
> >>One idea would be to not include /dev in the setfiles stuff.  ( I guess 
> >>it wouldn't now that it is a tmpfs file system)
> >>   
> >>
> >
> >True, relabel won't include tmpfs mounts.   Not sure about rpm and /dev
> >nodes, e.g. is dev package obsoleted by udev, and are there other /dev
> >nodes that are part of other packages?
> >
> > 
> >
> >>We still need a mapping in policy and a libselinux function to give us 
> >>that mapping.
> >>   
> >>
> >
> >True.  But much simpler than matchpathcon.

well as an API, you'd have something like

	int matchdevcon(char *devicename, char *devicetype, mode_t mode,
					scontext *scontext);

or:

	int matchdevcon(int major, int minor, char *devicetype, mode_t mode,
					scontext *scontext);

in using something like that, would you _care_ if underneath it did
regexps like matchpathcon does?

l.



--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.