From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([208.118.235.92]:45937) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1UCSeU-0002AD-GR for qemu-devel@nongnu.org; Mon, 04 Mar 2013 05:29:55 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1UCSeP-0003VI-Fz for qemu-devel@nongnu.org; Mon, 04 Mar 2013 05:29:50 -0500 Received: from mx1.redhat.com ([209.132.183.28]:34841) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1UCSeP-0003V6-93 for qemu-devel@nongnu.org; Mon, 04 Mar 2013 05:29:45 -0500 Date: Mon, 4 Mar 2013 10:29:37 +0000 From: "Daniel P. Berrange" Message-ID: <20130304102937.GB8123@redhat.com> References: <512FF819.7050505@redhat.com> <87k3pqzy2y.fsf@codemonkey.ws> <513110D3.5030503@linux.vnet.ibm.com> <87d2vig75m.fsf@codemonkey.ws> <51311A13.6030205@redhat.com> <87r4jy90wt.fsf@codemonkey.ws> <51313660.5010001@redhat.com> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline In-Reply-To: <51313660.5010001@redhat.com> Subject: Re: [Qemu-devel] virtio-rng and fd passing Reply-To: "Daniel P. Berrange" List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Eric Blake Cc: "qemu-devel@nongnu.org" , Anthony Liguori , Stefan Berger On Fri, Mar 01, 2013 at 04:14:40PM -0700, Eric Blake wrote: > > I understand the reason that fdsets exist (because NFS is stupid and > > doesn't support labeling). But we aren't doing dynamic labeling of > > /dev/random and I strongly suspect it's not on NFS anyway. > > > > So why are we trying to pass fds here? > > Consistency - how do you write a policy that allows open("/dev/random") > while forbidding open("/nfs/...")? It's much simpler to forbid open(), > even if /dev/random doesn't have any labeling issues. IIUC, it is actually pretty straightforward from a policy POV. Every filesystem has a unique type, and SELinux can make rules scoped to that filesystem type. That's how we have the 'virt_use_nfs' tunable already which only affects NFS. Daniel -- |: http://berrange.com -o- http://www.flickr.com/photos/dberrange/ :| |: http://libvirt.org -o- http://virt-manager.org :| |: http://autobuild.org -o- http://search.cpan.org/~danberr/ :| |: http://entangle-photo.org -o- http://live.gnome.org/gtk-vnc :|