[refpolicy] Take virtio disks into account

[refpolicy] Take virtio disks into account

[Mika Pflüger]

Hi,

When using selinux in a virtualized system with virtio disks, the virtio
devices (/dev/vd*) are not labelled correctly. This can be fixed by this one-
liner, treating virtio disks just like any other disk (sata, ide, etc).

Without this patch, the booting grinds to a halt when selinux denies mounting
the root fs (which has to reside on a virtio disk, of course).

Cheers,

Mika Pfl?ger

[refpolicy] [PATCH 1/1] Take virtio disks into account.

[Mika Pflüger]

Signed-off-by: Mika Pfl?ger <debian@mikapflueger.de>
---
 policy/modules/kernel/storage.fc |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/policy/modules/kernel/storage.fc b/policy/modules/kernel/storage.fc
index d819311..a9b8982 100644
--- a/policy/modules/kernel/storage.fc
+++ b/policy/modules/kernel/storage.fc
@@ -5,7 +5,7 @@
 /dev/n?osst[0-3].*	-c	gen_context(system_u:object_r:tape_device_t,s0)
 /dev/n?pt[0-9]+		-c	gen_context(system_u:object_r:tape_device_t,s0)
 /dev/n?tpqic[12].*	-c	gen_context(system_u:object_r:tape_device_t,s0)
-/dev/[shmx]d[^/]*	-b	gen_context(system_u:object_r:fixed_disk_device_t,mls_systemhigh)
+/dev/[shmxv]d[^/]*	-b	gen_context(system_u:object_r:fixed_disk_device_t,mls_systemhigh)
 /dev/aztcd		-b	gen_context(system_u:object_r:removable_device_t,s0)
 /dev/bpcd		-b	gen_context(system_u:object_r:removable_device_t,s0)
 /dev/bsg/.+		-c	gen_context(system_u:object_r:scsi_generic_device_t,s0)
-- 
1.7.1

[refpolicy] [PATCH 1/1] Take virtio disks into account.

[Christopher J. PeBenito]

On 07/23/10 09:40, Mika Pfl?ger wrote:
>
> Signed-off-by: Mika Pfl?ger<debian@mikapflueger.de>
> ---
>   policy/modules/kernel/storage.fc |    2 +-
>   1 files changed, 1 insertions(+), 1 deletions(-)
>
> diff --git a/policy/modules/kernel/storage.fc b/policy/modules/kernel/storage.fc
> index d819311..a9b8982 100644
> --- a/policy/modules/kernel/storage.fc
> +++ b/policy/modules/kernel/storage.fc
> @@ -5,7 +5,7 @@
>   /dev/n?osst[0-3].*	-c	gen_context(system_u:object_r:tape_device_t,s0)
>   /dev/n?pt[0-9]+		-c	gen_context(system_u:object_r:tape_device_t,s0)
>   /dev/n?tpqic[12].*	-c	gen_context(system_u:object_r:tape_device_t,s0)
> -/dev/[shmx]d[^/]*	-b	gen_context(system_u:object_r:fixed_disk_device_t,mls_systemhigh)
> +/dev/[shmxv]d[^/]*	-b	gen_context(system_u:object_r:fixed_disk_device_t,mls_systemhigh)
>   /dev/aztcd		-b	gen_context(system_u:object_r:removable_device_t,s0)
>   /dev/bpcd		-b	gen_context(system_u:object_r:removable_device_t,s0)
>   /dev/bsg/.+		-c	gen_context(system_u:object_r:scsi_generic_device_t,s0)

Merged.

-- 
Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com