[refpolicy] kernel_filesystem.patch

[dwalsh@redhat.com (Daniel J Walsh)]

On 03/12/2010 11:41 AM, Christopher J. PeBenito wrote:
> On Tue, 2010-02-23 at 17:09 -0500, Daniel J Walsh wrote:
>    
>> http://people.fedoraproject.org/~dwalsh/SELinux/F13/kernel_filesystem.patch
>>
>> Changes for handling leaks
>>
>> Handling fusefs and hugetlbfs, cgroups
>>      
> I'm confused by this:
>
> +files_type(hugetlbfs_t)
> +files_poly_parent(hugetlbfs_t)
>
> If its a filesystem, its not a regular file.
>
>    
Looks like a cut and paste error.
>> gpfs file system
>> devtmpfs file system
>>      
> I'm thinking that perhaps devtmpfs should be moved to devices and use
> device_t, since thats its only purpose.
>
>    
Sounds good to me.

Will this work?

fs_use_trans devtmpfs gen_context(system_u:object_r:device_t,s0);


> Fixed fs_dontaudit_read_nfs_symlinks() (it was allowing instead of
> dontauditing).
>
> Otherwise merged, with some rearrangement.
>
>    
Thanks.