From: Ondrej Mosnacek <omosnace@redhat.com>
To: Petr Lautrbach <plautrba@redhat.com>
Cc: SElinux list <selinux@vger.kernel.org>,
Zdenek Pytela <zpytela@redhat.com>
Subject: Re: [PATCH userspace] fixfiles: do not exclude /dev and /run in -C mode
Date: Thu, 4 Mar 2021 16:02:16 +0100 [thread overview]
Message-ID: <CAFqZXNuzTSEok=x3ZyVyQvUK_DsBS6Ykfxk6DrUPLpnF+TQGRw@mail.gmail.com> (raw)
In-Reply-To: <871rcv9dww.fsf@redhat.com>
On Thu, Mar 4, 2021 at 3:44 PM Petr Lautrbach <plautrba@redhat.com> wrote:
> Ondrej Mosnacek <omosnace@redhat.com> writes:
>
> > I can't think of a good reason why they should be excluded. On the
> > contrary, excluding them can cause trouble very easily if some labeling
> > rules for these directories change. For example, we changed the label
> > for /dev/nvme* from nvme_device_t to fixed_disk_device_t in Fedora
> > (updating the allow rules accordingly) and after policy update they
> > ended up with an invalid context, causing denials.
>
> I guess that /dev/ is there in order to avoid relabeling tty devices and block
> the user from access:
>
> [root@localhost ~]# ls -Z /dev/tty1
> user_u:object_r:user_tty_device_t:s0 /dev/tty1
>
> [root@localhost ~]# matchpathcon /dev/tty1
> /dev/tty1 system_u:object_r:tty_device_t:s0
$ sudo chcon user_u:object_r:user_tty_device_t:s0 /dev/tty21
$ ll -Z /dev/tty21
crw--w----. 1 root tty user_u:object_r:user_tty_device_t:s0 4, 21 feb
26 15:13 /dev/tty21
$ sudo restorecon -v /dev/tty21
/dev/tty21 not reset as customized by admin to
user_u:object_r:user_tty_device_t:s0
$ ll -Z /dev/tty21
crw--w----. 1 root tty user_u:object_r:user_tty_device_t:s0 4, 21 feb
26 15:13 /dev/tty21
$ cat /etc/selinux/targeted/contexts/customizable_types
container_file_t
sandbox_file_t
svirt_image_t
svirt_home_t
svirt_sandbox_file_t
virt_content_t
httpd_user_htaccess_t
httpd_user_script_exec_t
httpd_user_rw_content_t
httpd_user_ra_content_t
httpd_user_content_t
git_session_content_t
home_bin_t
user_tty_device_t
restorecon also doesn't change the user portion of the label if I only
change that to user_u (leaving the type as tty_device_t).
--
Ondrej Mosnacek
Software Engineer, Linux Security - SELinux kernel
Red Hat, Inc.
next prev parent reply other threads:[~2021-03-04 15:05 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-03-01 17:19 [PATCH userspace] fixfiles: do not exclude /dev and /run in -C mode Ondrej Mosnacek
2021-03-04 14:44 ` Petr Lautrbach
2021-03-04 15:02 ` Ondrej Mosnacek [this message]
2021-03-04 15:24 ` Petr Lautrbach
2021-03-04 18:02 ` Dominick Grift
2021-05-07 12:21 ` Petr Lautrbach
2021-05-12 8:08 ` Petr Lautrbach
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='CAFqZXNuzTSEok=x3ZyVyQvUK_DsBS6Ykfxk6DrUPLpnF+TQGRw@mail.gmail.com' \
--to=omosnace@redhat.com \
--cc=plautrba@redhat.com \
--cc=selinux@vger.kernel.org \
--cc=zpytela@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.