From: Cory Olmo <colmo@TrustedCS.com>
To: selinux@tycho.nsa.gov
Subject: [RFC Patch 0/3] Context Mounts and Unsupported Contexts
Date: Tue, 15 Aug 2006 10:55:58 -0500 [thread overview]
Message-ID: <20060815105558.0b44a54a.colmo@TrustedCS.com> (raw)
This is a potential patch set to correct the collision which is occurring
between commas in contexts and the comma delimiter between option values for
mount.
The Problem:
If the context option specified to mount contains a comma then the value of
the context option will be improperly broken up.
Example:
Using an MCS translation setup with these entries.
s0:c1=PatientRecord
s0:c2=Unclassified
s0:c3=Secret
s0:c4=TopSecret
s0:c1,c3,c4=CompanySecrets
With translations turned off:
mount -t iso9660 /dev/cdrom /media/cdrom -o \
ro,context=system_u:object_r:iso9660_t:s0:c2,c3,c4,exec
The context option that will be interpreted by SeLinux is
context=system_u:object_r:iso9660_t:s0:c2
The options that will be passed on to the file system will be ro,c3,c4,exec.
If translations are turned on the context that will be interpreted for the
context, system_u:object_r:iso9660_t:Unclassified,Secret,TopSecret, will be
system_u:object_r:iso9660_t:Unclassified.
Proposed Solution:
The proposed solution is to allow/require the SeLinux context option specified
to mount to use escaped quotes when the context contains a comma. The patches
that are included are for the kernel, util-linux, and nfs-utils. They were
generated against the following Fedora rawhide rpms util-linux-2.13-0.36,
nfs-utils-1.0.9-3, and kernel-2.6.17-1.2528.
--
Cory Olmo
Trusted Computer Solutions
www.TrustedCS.com
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
reply other threads:[~2006-08-15 15:56 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20060815105558.0b44a54a.colmo@TrustedCS.com \
--to=colmo@trustedcs.com \
--cc=selinux@tycho.nsa.gov \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.