We are seeing more and more programs accessing sysfs_t.

We are seeing more and more programs accessing sysfs_t.

[Daniel J Walsh]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Every domain is now reading /sys/devices/system/cpu/online because of
changes to glibc.

We are also seeing domains that need write access.

For example

> https://bugzilla.redhat.com/show_bug.cgi?id=685096
> 
> for https://bugzilla.redhat.com/show_bug.cgi?id=685096 (IP over 
> Infiniband support for NetworkManager), NM needs to be able to 
> write to /sys/class/net/ib*/mode. audit2allow says:
> 
> allow NetworkManager_t sysfs_t:file write;

It seems we need a better way of labeling files under /sys.

genfscon only seems to work at the top level.

Allowing all domains to read sysfs_t does not seem like the correct
solution, and allow NetworkManager to write anywhere on /sys is
probably not good either.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEYEARECAAYFAk7nt5oACgkQrlYvE4MpobOyfwCfav6hMLyB5kPcAJvW81zhqC7o
s30AoJv2aI8RmLi8gDq2gGMjadiyLziP
=PVUp
-----END PGP SIGNATURE-----

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: We are seeing more and more programs accessing sysfs_t.

[Stephen Smalley]

On Tue, 2011-12-13 at 15:37 -0500, Daniel J Walsh wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> Every domain is now reading /sys/devices/system/cpu/online because of
> changes to glibc.
> 
> We are also seeing domains that need write access.
> 
> For example
> 
> > https://bugzilla.redhat.com/show_bug.cgi?id=685096
> > 
> > for https://bugzilla.redhat.com/show_bug.cgi?id=685096 (IP over 
> > Infiniband support for NetworkManager), NM needs to be able to 
> > write to /sys/class/net/ib*/mode. audit2allow says:
> > 
> > allow NetworkManager_t sysfs_t:file write;
> 
> It seems we need a better way of labeling files under /sys.
> 
> genfscon only seems to work at the top level.
> 
> Allowing all domains to read sysfs_t does not seem like the correct
> solution, and allow NetworkManager to write anywhere on /sys is
> probably not good either.

Modern kernels support setfilecon()/setxattr() on sysfs nodes, so a
userspace program can set specific types on them.  That was added a
couple of years ago for libvirt.  Just specify the desired labels in
file_contexts and restorecon -R /sys at boot.

-- 
Stephen Smalley
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.