Mark temporary block device as fixed_disk_device_t
PATCH 1/1 Mark temporary block device as fixed_disk_device_t
When udev creates the temporary block devices (such as /dev/.tmp-block-8:1) they get by default marked as device_t. However, in case of software raid devices, the mdadm application (running in mdadm_t) does not hold the proper privileges to access this for its auto-assembly of the raids.
Other block device applications, like blkid (running in fsadm_t) use these temporary block devices as well, but already hold the necessary privileges on device_t to continue their work.
By marking the temporary block device as a fixed_disk_device_t, all these block device handling applications (such as blkid, but also mdadm) now hold the proper privileges. Since udev is selinux-aware, the created files are immediately restorecon'ed before the rules are applied.
--- policy/modules/kernel/storage.fc | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-)
policy/modules/kernel/storage.fc +1 -1
@@ -1,4 +1,4 @@ - +/dev/\.tmp-block-.* -c gen_context(system_u:object_r:fixed_disk_device_t,mls_systemhigh) /dev/n?(raw)?[qr]ft[0-3] -c gen_context(system_u:object_r:tape_device_t,s0) /dev/n?[hs]t[0-9].* -c gen_context(system_u:object_r:tape_device_t,s0) /dev/n?z?qft[0-3] -c gen_context(system_u:object_r:tape_device_t,s0)
Signature · 1 line
1.7.3.4
PATCH 1/1 Mark temporary block device as fixed_disk_device_t
Quoted 5 lines · Sven Vermeulen
When udev creates the temporary block devices (such as
/dev/.tmp-block-8:1) they get by default marked asdevice_t. However, in case of software raid devices, the mdadm application (running inmdadm_t) does not hold the proper privileges to access this for its auto-assembly of the raids.
Quoted 8 lines
Other block device applications, like blkid (running in
fsadm_t) use these temporary block devices as well, but already hold the necessary privileges ondevice_tto continue their work.By marking the temporary block device as a
fixed_disk_device_t, all these block device handling applications (such as blkid, but also mdadm) now hold the proper privileges. Since udev is selinux-aware, the created files are immediately restorecon'ed before the rules are applied.
I'm conflicted on this. On one hand, I obviously want udev to apply the correct label, but I also don't want a restorecon/setfiles at a later date to change the label of what is clearly a temp file.
Quoted 15 lines
Signed-off-by Sven Vermeulen <[email protected]>--- policy/modules/kernel/storage.fc | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-)policy/modules/kernel/storage.fc +1
-1@@ -1,4 +1,4 @@ - +/dev/\.tmp-block-.* -c gen_context(system_u:object_r:fixed_disk_device_t,mls_systemhigh) /dev/n?(raw)?[qr]ft[0-3] -c gen_context(system_u:object_r:tape_device_t,s0) /dev/n?[hs]t[0-9].* -c gen_context(system_u:object_r:tape_device_t,s0) /dev/n?z?qft[0-3] -c gen_context(system_u:object_r:tape_device_t,s0)
Signature · 3 lines
Chris PeBenito Tresys Technology, LLC www.tresys.com | oss.tresys.com
PATCH 1/1 Mark temporary block device as fixed_disk_device_t
Quoted 1 line · Christopher J. PeBenito
I'm conflicted on this. ?On one hand, I obviously want udev to apply the correct label, but I also don't want a restorecon/setfiles at a later date to change the label of what is clearly a temp file.
It is, but it is also (re)moved quite fast as well. I don't think there's a restorecon/setfiles needed anywhere on this.
Wkr,
Sven Vermeulen
PATCH 1/1 Mark temporary block device as fixed_disk_device_t
In reply to Sven VermeulenQuoted 24 lines · Sven Vermeulen
When udev creates the temporary block devices (such as
/dev/.tmp-block-8:1) they get by default marked asdevice_t. However, in case of software raid devices, the mdadm application (running inmdadm_t) does not hold the proper privileges to access this for its auto-assembly of the raids.Other block device applications, like blkid (running in
fsadm_t) use these temporary block devices as well, but already hold the necessary privileges ondevice_tto continue their work.By marking the temporary block device as a
fixed_disk_device_t, all these block device handling applications (such as blkid, but also mdadm) now hold the proper privileges. Since udev is selinux-aware, the created files are immediately restorecon'ed before the rules are applied.Signed-off-by Sven Vermeulen <[email protected]>--- policy/modules/kernel/storage.fc | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-)policy/modules/kernel/storage.fc +0
-0
policy/modules/kernel/storage.fc line 4
Quoted 5 lines
policy/modules/kernel/storage.fc +1
-1@@ -1,4 +1,4 @@ - +/dev/\.tmp-block-.* -c gen_context(system_u:object_r:fixed_disk_device_t,mls_systemhigh) /dev/n?(raw)?[qr]ft[0-3] -c gen_context(system_u:object_r:tape_device_t,s0) /dev/n?[hs]t[0-9].* -c gen_context(system_u:object_r:tape_device_t,s0) /dev/n?z?qft[0-3] -c gen_context(system_u:object_r:tape_device_t,s0)
Merged.
Signature · 3 lines
Chris PeBenito Tresys Technology, LLC www.tresys.com | oss.tresys.com