hotplug 0.030 not setting selinux permissions on /dev/tty*

hotplug 0.030 not setting selinux permissions on /dev/tty*

[Luke Kenneth Casson Leighton]

hi there,

i've got udev up-and-running, with an selinux kernel 2.6.7.

i've added se-linux temporary attributes to tmpfs in order for
the tmpfs /dev to "remember" the selinux settings that udev would
make (without the patch, it's guaranteed to fail).

[see http://hands.com/~lkcl/selinux/2.6.6]

the issue is that i am not seeing any execution of
/etc/dev.d/default/selinux.dev on /dev/tty[absolutelyanything].

so as a temporary hack i am going to have to do a manual restorecon
or a setfiles /etc/selinux/src/file_contexts/file_contexts /dev.

which defeats the object of having the /etc/dev.d/default/selinux.dev
stuff in the first place.

i really don't know enough about the operation of udev to say where
the creation of /dev/tty1, /dev/tty2 etc etc etc are coming from,
or why /etc/dev.d/default/selinux.dev would not be called.

does anyone know why?

what is going on: /dev/tty1...N are all in /dev/.udev.tdb, and
they are all created in /dev, so... why wouldn't they have the
permissions set?

could it be because.... they are copied from somewhere else?

e.g. the initrd scripts?

i am at a loss.

l.

-- 
-- 
Information I post is with honesty, integrity, and the expectation that
you will take full responsibility if acting on the information contained,
and that, should you find it to be flawed or even mildly useful, you
will act with both honesty and integrity in return - and tell me.
--
<a href="http://lkcl.net">      lkcl.net      </a> <br />
<a href="mailto:lkcl@lkcl.net"> lkcl@lkcl.net </a> <br />



-------------------------------------------------------
This SF.Net email is sponsored by OSTG. Have you noticed the changes on
Linux.com, ITManagersJournal and NewsForge in the past few weeks? Now,
one more big change to announce. We are now OSTG- Open Source Technology
Group. Come see the changes on the new OSTG site. www.ostg.com
_______________________________________________
Linux-hotplug-devel mailing list  http://linux-hotplug.sourceforge.net
Linux-hotplug-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/linux-hotplug-devel

Re: hotplug 0.030 not setting selinux permissions on /dev/tty*

[Luke Kenneth Casson Leighton]

GOT IT!  gotit,gotit,gotit.

watching stuff go by during boot-up, i observed the same
"matchpathcon cannot find file" error that i - fortunately -
observed earlier today.

the [unnamed] file it's searching for is of course
/etc/selinux/something/file_contexts/file_contexts

this file is on /usr/share/selinux and has a symlink to it from
/etc/selinux.

and, of course, i have /usr on a different partition.

so i am .... err.. buggered.

i suppose i could move the entire /usr/share/selinux/current/* into
/etc/selinux!!!

*sigh*.

okay, so it's nothing to do with udev per-se, but it _does_ mean that
if someone wants to use udev on se/linux, it's going to be a bit
awkward.

some changes in either matchpathcon or where the selinux contexts
are set up..

l.

On Sun, Aug 01, 2004 at 05:00:19PM +0100, Luke Kenneth Casson Leighton wrote:
> hi there,
> 
> i've got udev up-and-running, with an selinux kernel 2.6.7.
> 
> i've added se-linux temporary attributes to tmpfs in order for
> the tmpfs /dev to "remember" the selinux settings that udev would
> make (without the patch, it's guaranteed to fail).
> 
> [see http://hands.com/~lkcl/selinux/2.6.6]
> 
> the issue is that i am not seeing any execution of
> /etc/dev.d/default/selinux.dev on /dev/tty[absolutelyanything].
> 
> so as a temporary hack i am going to have to do a manual restorecon
> or a setfiles /etc/selinux/src/file_contexts/file_contexts /dev.
> 
> which defeats the object of having the /etc/dev.d/default/selinux.dev
> stuff in the first place.
> 
> i really don't know enough about the operation of udev to say where
> the creation of /dev/tty1, /dev/tty2 etc etc etc are coming from,
> or why /etc/dev.d/default/selinux.dev would not be called.
> 
> does anyone know why?
> 
> what is going on: /dev/tty1...N are all in /dev/.udev.tdb, and
> they are all created in /dev, so... why wouldn't they have the
> permissions set?
> 
> could it be because.... they are copied from somewhere else?
> 
> e.g. the initrd scripts?
> 
> i am at a loss.
> 
> l.
> 
> -- 
> -- 
> Information I post is with honesty, integrity, and the expectation that
> you will take full responsibility if acting on the information contained,
> and that, should you find it to be flawed or even mildly useful, you
> will act with both honesty and integrity in return - and tell me.
> --
> <a href="http://lkcl.net">      lkcl.net      </a> <br />
> <a href="mailto:lkcl@lkcl.net"> lkcl@lkcl.net </a> <br />
> 

-- 
-- 
Information I post is with honesty, integrity, and the expectation that
you will take full responsibility if acting on the information contained,
and that, should you find it to be flawed or even mildly useful, you
will act with both honesty and integrity in return - and tell me.
--
<a href="http://lkcl.net">      lkcl.net      </a> <br />
<a href="mailto:lkcl@lkcl.net"> lkcl@lkcl.net </a> <br />



-------------------------------------------------------
This SF.Net email is sponsored by OSTG. Have you noticed the changes on
Linux.com, ITManagersJournal and NewsForge in the past few weeks? Now,
one more big change to announce. We are now OSTG- Open Source Technology
Group. Come see the changes on the new OSTG site. www.ostg.com
_______________________________________________
Linux-hotplug-devel mailing list  http://linux-hotplug.sourceforge.net
Linux-hotplug-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/linux-hotplug-devel

Re: hotplug 0.030 not setting selinux permissions on /dev/tty*

[Erich Schubert]

Hi,

> i suppose i could move the entire /usr/share/selinux/current/* into
> /etc/selinux!!!

putting configuration files into /etc is a sane choice anyway...

Greetings,
Erich Schubert
-- 
   erich@(vitavonni.de|debian.org)    --    GPG Key ID: 4B3A135C    (o_
          There are only 10 types of people in the world:           //\
          Those who understand binary and those who don't           V_/_
    Zwei Freunde müssen sich im Herzen ähneln, in allem anderen
       können sie grundverschieden sein. --- Sully Prudhomme



-------------------------------------------------------
This SF.Net email is sponsored by OSTG. Have you noticed the changes on
Linux.com, ITManagersJournal and NewsForge in the past few weeks? Now,
one more big change to announce. We are now OSTG- Open Source Technology
Group. Come see the changes on the new OSTG site. www.ostg.com
_______________________________________________
Linux-hotplug-devel mailing list  http://linux-hotplug.sourceforge.net
Linux-hotplug-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/linux-hotplug-devel

Re: hotplug 0.030 not setting selinux permissions on /dev/tty*

[Russell Coker]

On Mon, 2 Aug 2004 02:44, Luke Kenneth Casson Leighton <lkcl@lkcl.net> wrote:
> GOT IT!  gotit,gotit,gotit.
>
> watching stuff go by during boot-up, i observed the same
> "matchpathcon cannot find file" error that i - fortunately -
> observed earlier today.
>
> the [unnamed] file it's searching for is of course
> /etc/selinux/something/file_contexts/file_contexts
>
> this file is on /usr/share/selinux and has a symlink to it from
> /etc/selinux.

Then your system is messed up.  It was on older versions of the 
selinux-policy-default package that /etc/selinux was a sym-link.  
Now /etc/selinux/src is a sym-link and /etc/selinux/./contexts/file_contexts 
is on the root file system.

-- 
http://www.coker.com.au/selinux/   My NSA Security Enhanced Linux packages
http://www.coker.com.au/bonnie++/  Bonnie++ hard drive benchmark
http://www.coker.com.au/postal/    Postal SMTP/POP benchmark
http://www.coker.com.au/~russell/  My home page


-------------------------------------------------------
This SF.Net email is sponsored by OSTG. Have you noticed the changes on
Linux.com, ITManagersJournal and NewsForge in the past few weeks? Now,
one more big change to announce. We are now OSTG- Open Source Technology
Group. Come see the changes on the new OSTG site. www.ostg.com
_______________________________________________
Linux-hotplug-devel mailing list  http://linux-hotplug.sourceforge.net
Linux-hotplug-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/linux-hotplug-devel