Context mounts and unsupported context strings

[Cory Olmo <colmo@TrustedCS.com>]

I recently ran into a problem with mounting file systems for particular
context strings.  At this point we are still in the analysis phase so any
information or ideas would be appreciated.

The problem:

Attempt to mount a cdrom with the context option of
context=system_u:object_r:iso9660_t:s1:c0,c2,c4

The context will get interpreted as only
system_u:object_r:iso9660_t:s1:c0.  The reason is that the field separator
for the option field is ',', which is the same as that for categories. As a
result the rest of the context ends up being interpreted as additional
mount options that get passed on to the file system.

We've considered translation, escape characters, and quoting the entire
context string.  So far the most feasible appear to be either escaping or
quoting the entire context string.


-- 
Cory Olmo
Trusted Computer Solutions
www.TrustedCS.com

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.