Re: Proposed Hardware File Context file.

[Luke Kenneth Casson Leighton <lkcl@lkcl.net>]

On Fri, Sep 03, 2004 at 12:28:41PM -0400, Stephen Smalley wrote:
> On Fri, 2004-09-03 at 10:38, Luke Kenneth Casson Leighton wrote:
> >   what do you think of the idea of
> >   "run-time enabling of alternative file contexts"?
> > 
> >   because i still think that extending the existing
> >   file_contexts syntax to have an optional keyword at the
> >   end, and then providing extended versions of the existing
> >   libselinux file context related functions, would provide
> >   the simplest from-here-to-there approach.
> 
> I don't like it.  Rationale:
> - programs that don't have device information (or whatever the keyword
> is based on) available to them can't provide useful input to the
> libselinux function, so they will end up matching the wrong entry. 

 it's the sort of thing that is only going to be used by programs
 that understand it.

 e.g. the "postfix" keyword to activate the chroot-specific
 file_contexts is specific to postfix.

 the "mozilla download helper" keyword is specific to the mozilla
 download helper.

 as for udev, once udev is written i do not believe that someone would
 wish to write an alternative, but should they choose to do so, the
 keywords could be extended to say udev_cdrom, udev_disk, such that
 another program could do "myotherdevmanagementprogram_cdrom" etc. etc.


> Essentially, udev is an object manager for /dev, and I'd be glad to push
> management of the device node contexts into it.  And the closer it
> parallels the existing support for ownership/permissions, the better, as
> that increases the likelihood of the SELinux support being understood
> and maintained properly.

 understood.



--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.