Take virtio disks into account
Hi,
When using selinux in a virtualized system with virtio disks, the virtio devices (/dev/vd*) are not labelled correctly. This can be fixed by this one- liner, treating virtio disks just like any other disk (sata, ide, etc).
Without this patch, the booting grinds to a halt when selinux denies mounting the root fs (which has to reside on a virtio disk, of course).
Cheers,
Mika Pfl?ger
PATCH 1/1 Take virtio disks into account.
Signed-off-by Mika Pfl?ger <[email protected]>
--- policy/modules/kernel/storage.fc | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-)
policy/modules/kernel/storage.fc +1 -1
@@ -5,7 +5,7 @@ /dev/n?osst[0-3].* -c gen_context(system_u:object_r:tape_device_t,s0) /dev/n?pt[0-9]+ -c gen_context(system_u:object_r:tape_device_t,s0) /dev/n?tpqic[12].* -c gen_context(system_u:object_r:tape_device_t,s0) -/dev/[shmx]d[^/]* -b gen_context(system_u:object_r:fixed_disk_device_t,mls_systemhigh) +/dev/[shmxv]d[^/]* -b gen_context(system_u:object_r:fixed_disk_device_t,mls_systemhigh) /dev/aztcd -b gen_context(system_u:object_r:removable_device_t,s0) /dev/bpcd -b gen_context(system_u:object_r:removable_device_t,s0) /dev/bsg/.+ -c gen_context(system_u:object_r:scsi_generic_device_t,s0)
Signature · 1 line
1.7.1
PATCH 1/1 Take virtio disks into account.
Quoted 11 lines · Mika Pfl?ger
Signed-off-by Mika Pfl?ger<[email protected]>--- policy/modules/kernel/storage.fc | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-)policy/modules/kernel/storage.fc +0
-0
policy/modules/kernel/storage.fc line 11
Quoted 8 lines
policy/modules/kernel/storage.fc +1
-1@@ -5,7 +5,7 @@ /dev/n?osst[0-3].* -c gen_context(system_u:object_r:tape_device_t,s0) /dev/n?pt[0-9]+ -c gen_context(system_u:object_r:tape_device_t,s0) /dev/n?tpqic[12].* -c gen_context(system_u:object_r:tape_device_t,s0) -/dev/[shmx]d[^/]* -b gen_context(system_u:object_r:fixed_disk_device_t,mls_systemhigh) +/dev/[shmxv]d[^/]* -b gen_context(system_u:object_r:fixed_disk_device_t,mls_systemhigh) /dev/aztcd -b gen_context(system_u:object_r:removable_device_t,s0) /dev/bpcd -b gen_context(system_u:object_r:removable_device_t,s0) /dev/bsg/.+ -c gen_context(system_u:object_r:scsi_generic_device_t,s0)
Merged.
Signature · 3 lines
Chris PeBenito Tresys Technology, LLC www.tresys.com | oss.tresys.com