Re: Proposed Hardware File Context file.

[Daniel J Walsh <dwalsh@redhat.com>]

Stephen Smalley wrote:

>On Thu, 2004-09-02 at 11:52, Daniel J Walsh wrote:
>  
>
>>Collin and I were discussing a way to label hardware devices correctly.
>>
>>One proposal would be to come up with a new file_contexts file based off 
>>of path and hardware type.
>>
>>So we could have a file with
>>
>>/dev/h
>>
>>/u?dev/[shmx]d[^/]*    -b    system_u:object_r:fixed_disk_device_t
>>/u?dev/[shmx]d[^/]*    -b    system_u:object_r:removable_disk_device_t cdrom
>>
>>Then either add a param to matchpathcon or a new function that would 
>>pass in the hardware type
>>and get the correct context.
>>
>>Then tools like udev could use this to create the device with the 
>>correct context.
>>
>>ideas??
>>    
>>
>
>This is separate from the main file_contexts configuration used by
>setfiles, restorecon, and rpm?  If so, what prevents the device from
>being relabeled back to the wrong type by them?  If not, how do they
>determine the hardware type to pass in?  
>  
>
Yes we talked about that but did not have a good answer.  I am not sure 
that it would need to be a separate file from the file_contexts file,
if it was the same then the tools would need to be modified to handle 
it.  IE use the one without the fourth parameter.
The other thought would be to use a separate file that would map device 
type to policy
cat hardware_contexts

cdrom system_u:object_r:removable_disk_device_t 

disk system_u:object_r:fixed_disk_device_t

...

But this would still fail the restorecon, rpm and setfiles.

One idea would be to not include /dev in the setfiles stuff.  ( I guess it wouldn't now that it is a tmpfs file system)

>It also isn't clear that you care about the pathname regex or file type
>if you know that you are dealing with a particular hardware type (and
>unit); you can just map those directly to a context.
>
>  
>
We still need a mapping in policy and a libselinux function to give us 
that mapping.

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.