/dev on tmpfs. How to label?

/dev on tmpfs. How to label?

[AlannY]

Hi there. I'm still trying to install SELinux on Archlinux. I've already done
step with /sbin/load_policy -i at initramfs. But now have another difficult to
solve problem.

Archlinux at boot time (at /etc/rc.sysinit) mount /dev at tmpfs so:

    /bin/mount -n -t tmpfs none /dev -o mode=0755

As you can see, nodes at /dev never have correct context, because they
are temporary created and at shutdown deleted.

I see there are 2 ways to solve:

  1. recrack Archlinux boot process and make not mount /dev at tmpfs.
  2. Somehow relabel all nodes created at boot.

What do you think about it? Is there any distro, which mounts /dev at tmpfs and have working SELinux?

Thanks for patience.
-- 
   )\._.,--....,'``.
  /,   _.. \   _\  (`._ ,.
 `._.-(,_..'--(,_..'`-.;.' 

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: /dev on tmpfs. How to label?

[Stephen Smalley]

On Thu, 2010-01-28 at 14:56 +0300, AlannY wrote:
> Hi there. I'm still trying to install SELinux on Archlinux. I've already done
> step with /sbin/load_policy -i at initramfs. But now have another difficult to
> solve problem.
> 
> Archlinux at boot time (at /etc/rc.sysinit) mount /dev at tmpfs so:
> 
>     /bin/mount -n -t tmpfs none /dev -o mode=0755
> 
> As you can see, nodes at /dev never have correct context, because they
> are temporary created and at shutdown deleted.
> 
> I see there are 2 ways to solve:
> 
>   1. recrack Archlinux boot process and make not mount /dev at tmpfs.
>   2. Somehow relabel all nodes created at boot.
> 
> What do you think about it? Is there any distro, which mounts /dev at tmpfs and have working SELinux?

Most distros do that these days, and it works fine in Fedora, for
example.

The technique used in Fedora is to run restorecon -R /dev from
rc.sysinit to set the contexts on the /dev nodes set up before the
policy load, and udev is already SELinux-aware (if built with SELinux
support enabled) and should label any dynamically created nodes
appropriately once SELinux policy has loaded.

-- 
Stephen Smalley
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: /dev on tmpfs. How to label?

[AlannY]

On Thu, Jan 28, 2010 at 08:29:18AM -0500, Stephen Smalley wrote:
> Most distros do that these days, and it works fine in Fedora, for
> example.
> 
> The technique used in Fedora is to run restorecon -R /dev from
> rc.sysinit to set the contexts on the /dev nodes set up before the
> policy load, and udev is already SELinux-aware (if built with SELinux
> support enabled) and should label any dynamically created nodes
> appropriately once SELinux policy has loaded.

Ok. I've built udev --with-selinux and it seems now I have a good context (or maybe right?).

Well, my Controlling term: user_u:object_r:user_tty_device_t:s0. Is it normal?

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: /dev on tmpfs. How to label?

[Stephen Smalley]

On Thu, 2010-01-28 at 16:55 +0300, AlannY wrote:
> On Thu, Jan 28, 2010 at 08:29:18AM -0500, Stephen Smalley wrote:
> > Most distros do that these days, and it works fine in Fedora, for
> > example.
> > 
> > The technique used in Fedora is to run restorecon -R /dev from
> > rc.sysinit to set the contexts on the /dev nodes set up before the
> > policy load, and udev is already SELinux-aware (if built with SELinux
> > support enabled) and should label any dynamically created nodes
> > appropriately once SELinux policy has loaded.
> 
> Ok. I've built udev --with-selinux and it seems now I have a good context (or maybe right?).
> 
> Well, my Controlling term: user_u:object_r:user_tty_device_t:s0. Is it normal?

Yes.  user_tty_device_t for a tty, user_devpts_t for a pty.

-- 
Stephen Smalley
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.