PATCH: allow mount to write to all of its runtime files
Allow mount to write not only to /etc/mtab but also to the /etc/mtab~[0-9]{0,20} lock files (the number corresponds to the PID). Such files are still mistakenly being labelled as etc_t instead of etc_runtime_t (thus preventing the successful completion of the write operation and the accumulation of unremovable stale lock files over several operation attempts as in normal system reboots, for example).
Do the same with the standard mount temporary file /etc/mtab.tmp.
The above refers to mount from util-linux-2.21.2 from kernel.org. See mount -vvv for the location of such files.
--- policy/modules/kernel/files.fc | 3 +++ 1 file changed, 3 insertions(+)
policy/modules/kernel/files.fc +3 -0
@@ -54,6 +54,9 @@ ifdef(`distro_suse',` /etc/killpower -- gen_context(system_u:object_r:etc_runtime_t,s0) /etc/localtime -l gen_context(system_u:object_r:etc_t,s0) /etc/mtab -- gen_context(system_u:object_r:etc_runtime_t,s0) +/etc/mtab~ -- gen_context(system_u:object_r:etc_runtime_t,s0) +/etc/mtab~[0-9]+ -- gen_context(system_u:object_r:etc_runtime_t,s0) +/etc/mtab.tmp -- gen_context(system_u:object_r:etc_runtime_t,s0) /etc/mtab.fuselock -- gen_context(system_u:object_r:etc_runtime_t,s0) /etc/nohotplug -- gen_context(system_u:object_r:etc_runtime_t,s0) /etc/nologin.* -- gen_context(system_u:object_r:etc_runtime_t,s0)
Quoted 19 lines · Guido Trentalancia
Allow mount to write not only to
/etc/mtabbut also to the /etc/mtab~[0-9]{0,20} lock files (the number corresponds to the PID). Such files are still mistakenly being labelled asetc_tinstead ofetc_runtime_t(thus preventing the successful completion of the write operation and the accumulation of unremovable stale lock files over several operation attempts as in normal system reboots, for example).Do the same with the standard mount temporary file
/etc/mtab.tmp.The above refers to mount from util-linux-2.21.2 from kernel.org. See mount -vvv for the location of such files.
Signed-off-by Guido Trentalancia <[email protected]>--- policy/modules/kernel/files.fc | 3 +++ 1 file changed, 3 insertions(+)
policy/modules/kernel/files.fc ifdef(`distro_suse',` · line 58
Quoted 5 lines
policy/modules/kernel/files.fc +2
-0@@ -54,6 +54,9 @@ ifdef(`distro_suse',` /etc/killpower -- gen_context(system_u:object_r:etc_runtime_t,s0) /etc/localtime -l gen_context(system_u:object_r:etc_t,s0) /etc/mtab -- gen_context(system_u:object_r:etc_runtime_t,s0) +/etc/mtab~ -- gen_context(system_u:object_r:etc_runtime_t,s0) +/etc/mtab~[0-9]+ -- gen_context(system_u:object_r:etc_runtime_t,s0)
why not just merge these two lines into /etc/mtab~[0-9]* ?
Signature · 3 lines
Chris PeBenito Tresys Technology, LLC www.tresys.com | oss.tresys.com
PATCH v2 1/1 : allow mount to write to all of its runtime files
Quoted 1 line · Christopher J. PeBenito
On 06/15/12 12:35, Guido Trentalancia wrote:
[cut]
Quoted 10 lines
policy/modules/kernel/files.fc ifdef(`distro_suse',` · line 58
Quoted 8 lines
policy/modules/kernel/files.fc +2
-0@@ -54,6 +54,9 @@ ifdef(`distro_suse',` /etc/killpower -- gen_context(system_u:object_r:etc_runtime_t,s0) /etc/localtime -l gen_context(system_u:object_r:etc_t,s0) /etc/mtab -- gen_context(system_u:object_r:etc_runtime_t,s0) +/etc/mtab~ -- gen_context(system_u:object_r:etc_runtime_t,s0) +/etc/mtab~[0-9]+ -- gen_context(system_u:object_r:etc_runtime_t,s0)why not just merge these two lines into /etc/mtab~[0-9]* ?
Yes, sure, you're right, here it is:
Allow mount to write not only to /etc/mtab but also to the /etc/mtab~[0-9]\{0,20\} lock files (the number corresponds to the PID). Such files are still mistakenly being labelled as etc_t instead of etc_runtime_t (thus preventing the successful completion of the write operation and the accumulation of unremovable stale lock files over several operation attempts as in normal system reboots, for example).
Do the same with the standard mount temporary file /etc/mtab.tmp.
The above refers to mount from util-linux-2.21.2 from kernel.org. See mount -vvv for the location of such files.
--- policy/modules/kernel/files.fc | 2 ++ 1 file changed, 2 insertions(+)
policy/modules/kernel/files.fc +2 -0
@@ -54,6 +54,8 @@ ifdef(`distro_suse',` /etc/killpower -- gen_context(system_u:object_r:etc_runtime_t,s0) /etc/localtime -l gen_context(system_u:object_r:etc_t,s0) /etc/mtab -- gen_context(system_u:object_r:etc_runtime_t,s0) +/etc/mtab~[0-9]* -- gen_context(system_u:object_r:etc_runtime_t,s0) +/etc/mtab\.tmp -- gen_context(system_u:object_r:etc_runtime_t,s0) /etc/mtab\.fuselock -- gen_context(system_u:object_r:etc_runtime_t,s0) /etc/nohotplug -- gen_context(system_u:object_r:etc_runtime_t,s0) /etc/nologin.* -- gen_context(system_u:object_r:etc_runtime_t,s0)
PATCH v2 1/1 : allow mount to write to all of its runtime files
Quoted 38 lines · Guido Trentalancia
Quoted 1 line · Christopher J. PeBenito
On 06/15/12 12:35, Guido Trentalancia wrote:
[cut]
Quoted 10 lines
policy/modules/kernel/files.fc ifdef(`distro_suse',` · line 58
Quoted 8 lines
policy/modules/kernel/files.fc +2
-0@@ -54,6 +54,9 @@ ifdef(`distro_suse',` /etc/killpower -- gen_context(system_u:object_r:etc_runtime_t,s0) /etc/localtime -l gen_context(system_u:object_r:etc_t,s0) /etc/mtab -- gen_context(system_u:object_r:etc_runtime_t,s0) +/etc/mtab~ -- gen_context(system_u:object_r:etc_runtime_t,s0) +/etc/mtab~[0-9]+ -- gen_context(system_u:object_r:etc_runtime_t,s0)why not just merge these two lines into /etc/mtab~[0-9]* ?
Yes, sure, you're right, here it is:
Allow mount to write not only to
/etc/mtabbut also to the /etc/mtab~[0-9]\{0,20\} lock files (the number corresponds to the PID). Such files are still mistakenly being labelled asetc_tinstead ofetc_runtime_t(thus preventing the successful completion of the write operation and the accumulation of unremovable stale lock files over several operation attempts as in normal system reboots, for example).Do the same with the standard mount temporary file
/etc/mtab.tmp.The above refers to mount from util-linux-2.21.2 from kernel.org. See mount -vvv for the location of such files.
Signed-off-by Guido Trentalancia <[email protected]>--- policy/modules/kernel/files.fc | 2 ++ 1 file changed, 2 insertions(+)
policy/modules/kernel/files.fc ifdef(`distro_suse',` · line 61
Quoted 8 lines
policy/modules/kernel/files.fc +2
-0@@ -54,6 +54,8 @@ ifdef(`distro_suse',` /etc/killpower -- gen_context(system_u:object_r:etc_runtime_t,s0) /etc/localtime -l gen_context(system_u:object_r:etc_t,s0) /etc/mtab -- gen_context(system_u:object_r:etc_runtime_t,s0) + +/etc/mtab\.tmp -- gen_context(system_u:object_r:etc_runtime_t,s0) /etc/mtab\.fuselock -- gen_context(system_u:object_r:etc_runtime_t,s0) /etc/nohotplug -- gen_context(system_u:object_r:etc_runtime_t,s0) /etc/nologin.* -- gen_context(system_u:object_r:etc_runtime_t,s0)
Why not just do "/etc/mtab.* -- ..." and get it over with?
Anyways, seems nowadays /etc/mtab is a symlink to /?roc/mounts
Quoted 4 lines
_______________________________________________
refpolicy mailing list
refpolicy at oss.tresys.com
http://oss.tresys.com/mailman/listinfo/refpolicy
PATCH v2 1/1 : allow mount to write to all of its runtime files
Hello Dominick.
Quoted 14 lines · Dominick Grift
Quoted 13 lines · Guido Trentalancia
Quoted 1 line · Christopher J. PeBenito
On 06/15/12 12:35, Guido Trentalancia wrote:
[cut]
Quoted 8 lines
Quoted 8 lines
policy/modules/kernel/files.fc +2
-0@@ -54,6 +54,9 @@ ifdef(`distro_suse',` /etc/killpower -- gen_context(system_u:object_r:etc_runtime_t,s0) /etc/localtime -l gen_context(system_u:object_r:etc_t,s0) /etc/mtab -- gen_context(system_u:object_r:etc_runtime_t,s0) +/etc/mtab~ -- gen_context(system_u:object_r:etc_runtime_t,s0) +/etc/mtab~[0-9]+ -- gen_context(system_u:object_r:etc_runtime_t,s0)
[cut]
Quoted 3 lines
Why not just do "
/etc/mtab.*-- ..." and get it over with?Anyways, seems nowadays
/etc/mtabis a symlink to /?roc/mounts
They are not exactly the same thing.
And not all systems are necessarily using /proc/mounts.
Finally, the lock files are always created in /etc as /proc/mounts is just a kernel-generated substitute for /etc/mtab.
So, it should work both ways (for /etc/mtab) and it should support the lock files and the temporary file.
Regards,
Guido