Re: Proposed Hardware File Context file.

[Luke Kenneth Casson Leighton <lkcl@lkcl.net>]

On Thu, Sep 02, 2004 at 03:38:39PM -0400, Stephen Smalley wrote:

> On Thu, 2004-09-02 at 11:52, Daniel J Walsh wrote:
> > Collin and I were discussing a way to label hardware devices correctly.
> > 
> > One proposal would be to come up with a new file_contexts file based off 
> > of path and hardware type.
> > 
> > So we could have a file with
> > 
> > /dev/h
> > 
> > /u?dev/[shmx]d[^/]*    -b    system_u:object_r:fixed_disk_device_t
> > /u?dev/[shmx]d[^/]*    -b    system_u:object_r:removable_disk_device_t cdrom

> This is separate from the main file_contexts configuration used by
> setfiles, restorecon, and rpm?  If so, what prevents the device from
> being relabeled back to the wrong type by them?  If not, how do they
> determine the hardware type to pass in?  
> 
> It also isn't clear that you care about the pathname regex or file type
> if you know that you are dealing with a particular hardware type (and
> unit); you can just map those directly to a context.

okay: i got it, i got it.

the "cdrom" bit on the end is a "shortcut keyword" to say
"please override the default".

we need an "alternative" file system context function.

the function - setalternatefscontext() - should take two arguments:

- the name of the device (/dev/hdc)
- the "keyword" e.g. "cdrom".

setfscontextbykeyword() should:

- match the device against the regexp
- match the keyword against the last line: if there isn't one that
  matches, return an error (?)

if both device and keyword match, set the file context.


it remains the responsibility of programs that use the "alternative"
to reset the context back to the default after they're done.

so udev would need a udevremove if it doesn't already have one.


this is generic enough for it to be useable for purposes other than
/dev.

l.


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.