From: Eric Biggers <ebiggers@kernel.org>
To: Daniil Lunev <dlunev@chromium.org>
Cc: Zdenek Kabelac <zdenek.kabelac@gmail.com>,
Brian Geffon <bgeffon@google.com>,
Mike Snitzer <snitzer@kernel.org>,
linux-kernel@vger.kernel.org, dm-devel@redhat.com,
Mikulas Patocka <mpatocka@redhat.com>,
Alasdair Kergon <agk@redhat.com>
Subject: Re: [dm-devel] [PATCH 1/1] dm: add message command to disallow device open
Date: Wed, 3 Aug 2022 18:25:18 +0000 [thread overview]
Message-ID: <Yuq9jhxb+WgO55KJ@gmail.com> (raw)
In-Reply-To: <CAONX=-esLr5bGUks_a8wQBky37NnCawh2eOMemYg32HcPA7pmA@mail.gmail.com>
On Wed, Aug 03, 2022 at 02:29:40PM +1000, Daniil Lunev wrote:
> > This seems like an access control policy, which the Linux kernel already has a
> > lot of mechanisms for. Chrome OS already uses SELinux. Couldn't this be solved
> > by giving the device node an SELinux label that no one has permission to open?
> That would be the ideal solution, but there is a number of challenges
> that prevent
> us enabling enforcement on all SELinux domains unfortunately. While in the long
> run that would be a preferred option, in the short run this doesn't
> seem feasible. I
> would assume the problem of enabling full SELInux enforcement would plague
> any big project that didn't have them enabled from the get going.
> --Daniil
Have you also considered unlinking the device node (/dev/dm-$idx) from the
filesystem after it has been set up for swap?
- Eric
next prev parent reply other threads:[~2022-08-03 18:25 UTC|newest]
Thread overview: 16+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-07-04 0:02 [PATCH 0/1] Signal to disallow open of a dm device Daniil Lunev
2022-07-04 0:02 ` [PATCH 1/1] dm: add message command to disallow device open Daniil Lunev
2022-07-14 20:13 ` Mike Snitzer
2022-07-14 23:42 ` Daniil Lunev
2022-07-15 9:36 ` [dm-devel] " Mikulas Patocka
2022-07-15 19:38 ` Zdenek Kabelac
2022-07-18 23:42 ` Daniil Lunev
2022-08-03 4:12 ` Daniil Lunev
2022-08-03 4:23 ` Eric Biggers
2022-08-03 4:29 ` Daniil Lunev
2022-08-03 16:30 ` Mike Snitzer
2022-08-03 20:49 ` Daniil Lunev
2022-08-03 18:25 ` Eric Biggers [this message]
2022-08-03 20:44 ` [dm-devel] " Daniil Lunev
2022-08-03 21:49 ` Eric Biggers
2022-08-03 23:38 ` Daniil Lunev
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=Yuq9jhxb+WgO55KJ@gmail.com \
--to=ebiggers@kernel.org \
--cc=agk@redhat.com \
--cc=bgeffon@google.com \
--cc=dlunev@chromium.org \
--cc=dm-devel@redhat.com \
--cc=linux-kernel@vger.kernel.org \
--cc=mpatocka@redhat.com \
--cc=snitzer@kernel.org \
--cc=zdenek.kabelac@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox