[refpolicy] kernel_storage.patch

[refpolicy] kernel_storage.patch

[Daniel J Walsh]

http://people.fedoraproject.org/~dwalsh/SELinux/F12/kernel_storage.patch

add /dev/mtd*

Fix a couple of interfaces

[refpolicy] kernel_storage.patch

[Christopher J. PeBenito]

On Thu, 2009-11-12 at 16:04 -0500, Daniel J Walsh wrote:
> http://people.fedoraproject.org/~dwalsh/SELinux/F12/kernel_storage.patch
> 
> add /dev/mtd*
> 
> Fix a couple of interfaces

I don't understand why there would be a relabelto fixed_disk_device_t.
That implies the program is SELinux-aware, so this sounds like a bug
somewhere else.  Otherwise merged.


-- 
Chris PeBenito
Tresys Technology, LLC
(410) 290-1411 x150

[refpolicy] kernel_storage.patch

[Daniel J Walsh]

On 11/19/2009 09:03 AM, Christopher J. PeBenito wrote:
> On Thu, 2009-11-12 at 16:04 -0500, Daniel J Walsh wrote:
>> http://people.fedoraproject.org/~dwalsh/SELinux/F12/kernel_storage.patch
>>
>> add /dev/mtd*
>>
>> Fix a couple of interfaces
> 
> I don't understand why there would be a relabelto fixed_disk_device_t.
> That implies the program is SELinux-aware, so this sounds like a bug
> somewhere else.  Otherwise merged.
> 
> 
I believe the app is doing a mknod and then running restorecon which would cause this?

[refpolicy] kernel_storage.patch

[Christopher J. PeBenito]

On Thu, 2009-11-19 at 09:19 -0500, Daniel J Walsh wrote:
> On 11/19/2009 09:03 AM, Christopher J. PeBenito wrote:
> > On Thu, 2009-11-12 at 16:04 -0500, Daniel J Walsh wrote:
> >> http://people.fedoraproject.org/~dwalsh/SELinux/F12/kernel_storage.patch
> >>
> >> add /dev/mtd*
> >>
> >> Fix a couple of interfaces
> > 
> > I don't understand why there would be a relabelto fixed_disk_device_t.
> > That implies the program is SELinux-aware, so this sounds like a bug
> > somewhere else.  Otherwise merged.
> > 
> > 
> I believe the app is doing a mknod and then running restorecon which would cause this?

But mknod would result in a device node, not a symlink, which is what is
being dontaudited for relabelto.

-- 
Chris PeBenito
Tresys Technology, LLC
(410) 290-1411 x150

[refpolicy] kernel_storage.patch

[Daniel J Walsh]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

http://people.fedoraproject.org/~dwalsh/SELinux/F14/kernel_storage.patch

Add mknod to interface for creating fixed disk

Allow reading of fixed_disk link files
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.16 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/

iEYEARECAAYFAkx29qkACgkQrlYvE4MpobMQXACeJfDs4K/2nlGwXMyYWfMkUrkg
zWEAn0DcgjDEKmQAOZoKyV+EWgGN995J
=qxGH
-----END PGP SIGNATURE-----

[refpolicy] kernel_storage.patch

[Daniel J Walsh]

http://people.fedoraproject.org/~dwalsh/SELinux/F14/kernel_storage.patch

Add /dev/hwcdrom

[refpolicy] kernel_storage.patch

[Christopher J. PeBenito]

On Wed, 2010-06-02 at 16:26 -0400, Daniel J Walsh wrote:
> http://people.fedoraproject.org/~dwalsh/SELinux/F14/kernel_storage.patch
> 
> Add /dev/hwcdrom

Merged.

-- 
Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com

[refpolicy] kernel_storage.patch

[Daniel J Walsh]

http://people.fedoraproject.org/~dwalsh/SELinux/F13/kernel_storage.patch

Add files context for /dev/etherd

Dontaudit attempts to relable lnk_files.

[refpolicy] kernel_storage.patch

[Christopher J. PeBenito]

On Tue, 2010-02-23 at 14:36 -0500, Daniel J Walsh wrote:
> http://people.fedoraproject.org/~dwalsh/SELinux/F13/kernel_storage.patch
> 
> Add files context for /dev/etherd

Merged.

> Dontaudit attempts to relable lnk_files.

Not so sure about this; it doesn't seem like it would be a general
problem, rather, a broken behavior of a particular program.  Since
relabeling means there is some SELinux awareness, it shouldn't be tough
to track this down.

-- 
Chris PeBenito
Tresys Technology, LLC
(410) 290-1411 x150

[refpolicy] kernel_storage.patch

[Daniel J Walsh]

On 03/04/2010 02:23 PM, Christopher J. PeBenito wrote:
> On Tue, 2010-02-23 at 14:36 -0500, Daniel J Walsh wrote:
>    
>> http://people.fedoraproject.org/~dwalsh/SELinux/F13/kernel_storage.patch
>>
>> Add files context for /dev/etherd
>>      
> Merged.
>
>    
>> Dontaudit attempts to relable lnk_files.
>>      
> Not so sure about this; it doesn't seem like it would be a general
> problem, rather, a broken behavior of a particular program.  Since
> relabeling means there is some SELinux awareness, it shouldn't be tough
> to track this down.
>
>    
I think some of these are caused by the cp command.

./services/virt.te:storage_relabel_fixed_disk(virtd_t)
./system/lvm.te:storage_relabel_fixed_disk(clvmd_t)
./system/lvm.te:storage_relabel_fixed_disk(lvm_t)

If you execute cp -p it causes this AVC to happen when it tries to set 
the context.

[refpolicy] kernel_storage.patch

[Daniel J Walsh]

On 03/04/2010 02:23 PM, Christopher J. PeBenito wrote:
> On Tue, 2010-02-23 at 14:36 -0500, Daniel J Walsh wrote:
>    
>> http://people.fedoraproject.org/~dwalsh/SELinux/F13/kernel_storage.patch
>>
>> Add files context for /dev/etherd
>>      
> Merged.
>
>    
>> Dontaudit attempts to relable lnk_files.
>>      
> Not so sure about this; it doesn't seem like it would be a general
> problem, rather, a broken behavior of a particular program.  Since
> relabeling means there is some SELinux awareness, it shouldn't be tough
> to track this down.
>
>    
https://bugzilla.redhat.com/show_bug.cgi?id=525119

[refpolicy] kernel_storage.patch

[Christopher J. PeBenito]

On Fri, 2010-03-05 at 11:06 -0500, Daniel J Walsh wrote:
> On 03/04/2010 02:23 PM, Christopher J. PeBenito wrote:
> > On Tue, 2010-02-23 at 14:36 -0500, Daniel J Walsh wrote:
> >    
> >> http://people.fedoraproject.org/~dwalsh/SELinux/F13/kernel_storage.patch
> >>
> >> Add files context for /dev/etherd
> >>      
> > Merged.
> >
> >    
> >> Dontaudit attempts to relable lnk_files.
> >>      
> > Not so sure about this; it doesn't seem like it would be a general
> > problem, rather, a broken behavior of a particular program.  Since
> > relabeling means there is some SELinux awareness, it shouldn't be tough
> > to track this down.
> >
> >    
> https://bugzilla.redhat.com/show_bug.cgi?id=525119

In the last comment, it says that the bug went away in F12, so it sounds
like that the dontaudit can be dropped.

-- 
Chris PeBenito
Tresys Technology, LLC
(410) 290-1411 x150

[refpolicy] kernel_storage.patch

[Daniel J Walsh]

http://people.fedoraproject.org/~dwalsh/SELinux/F11/kernel_storage.patch

/dev/fuse should be s0 not mls_high

[refpolicy] kernel_storage.patch

[Christopher J. PeBenito]

On Thu, 2009-05-21 at 11:28 -0400, Daniel J Walsh wrote:
> http://people.fedoraproject.org/~dwalsh/SELinux/F11/kernel_storage.patch
> 
> /dev/fuse should be s0 not mls_high

>From my understanding of the FUSE website, the data from the userland FS
is transferred through this device.  Since the data may go up to system
high, I believe the device should still be system high.

-- 
Chris PeBenito
Tresys Technology, LLC
(410) 290-1411 x150

[refpolicy] kernel_storage.patch

[Daniel J Walsh]

On 06/08/2009 01:17 PM, Christopher J. PeBenito wrote:
> On Thu, 2009-05-21 at 11:28 -0400, Daniel J Walsh wrote:
>> http://people.fedoraproject.org/~dwalsh/SELinux/F11/kernel_storage.patch
>>
>> /dev/fuse should be s0 not mls_high
>
>> From my understanding of the FUSE website, the data from the userland FS
> is transferred through this device.  Since the data may go up to system
> high, I believe the device should still be system high.
>
Making it systemhigh will generate lots of AVC messages on every login 
at X Since fusefs is mounted at ~/.gfs.  It will also make it unusable I 
believe on an MLS machine.  Mostly I have seen fusefs used for remote 
access to data.  sshfs for example.

[refpolicy] kernel_storage.patch

[Daniel J Walsh]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

http://people.fedoraproject.org/~dwalsh/SELinux/F11/kernel_storage.patch

Additonal file context

Allow management of fixed_disk_device_t chr_file

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org

iEYEARECAAYFAkmu86YACgkQrlYvE4MpobNkUgCfQTTagZy4JCtoLM4/yCAFAq/t
P1gAoMt8zPO41q0BrQZXnZWmdDa32iJ/
=xZHs
-----END PGP SIGNATURE-----

[refpolicy] kernel_storage.patch

[Christopher J. PeBenito]

On Wed, 2009-03-04 at 16:33 -0500, Daniel J Walsh wrote:
> http://people.fedoraproject.org/~dwalsh/SELinux/F11/kernel_storage.patch
> 
> Additonal file context
> 
> Allow management of fixed_disk_device_t chr_file

Are you sure about the MLS change of the FUSE device to system low, from
system high?

Otherwise merged.

-- 
Chris PeBenito
Tresys Technology, LLC
(410) 290-1411 x150

[refpolicy] kernel_storage.patch

[Daniel J Walsh]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Christopher J. PeBenito wrote:
> On Wed, 2009-03-04 at 16:33 -0500, Daniel J Walsh wrote:
>> http://people.fedoraproject.org/~dwalsh/SELinux/F11/kernel_storage.patch
>>
>> Additonal file context
>>
>> Allow management of fixed_disk_device_t chr_file
> 
> Are you sure about the MLS change of the FUSE device to system low, from
> system high?
> 
> Otherwise merged.
> 
fuse file systems are mounted on users home directories by default in
F10/F11 so a MLS login as a user will only work if this is SystemLow.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org

iEYEARECAAYFAkmwC78ACgkQrlYvE4MpobOE1ACfUUhjqh5NEwdTvc/brUd7Lq+m
OHYAn0gq/dCrp14b3cUtkGuogza/qt/i
=gxs+
-----END PGP SIGNATURE-----

[refpolicy] kernel_storage.patch

[Christopher J. PeBenito]

On Thu, 2009-03-05 at 12:28 -0500, Daniel J Walsh wrote:
> Christopher J. PeBenito wrote:
> > On Wed, 2009-03-04 at 16:33 -0500, Daniel J Walsh wrote:
> >> http://people.fedoraproject.org/~dwalsh/SELinux/F11/kernel_storage.patch
> >>
> >> Additonal file context
> >>
> >> Allow management of fixed_disk_device_t chr_file
> > 
> > Are you sure about the MLS change of the FUSE device to system low, from
> > system high?
> > 
> > Otherwise merged.
> > 
> fuse file systems are mounted on users home directories by default in
> F10/F11 so a MLS login as a user will only work if this is SystemLow.

Can you describe more fully what the scenario is?  I'm having trouble
seeing where the MLS issue is.  It seems like mount should be able to
handle this fine.

-- 
Chris PeBenito
Tresys Technology, LLC
(410) 290-1411 x150

[refpolicy] kernel_storage.patch

[Daniel J Walsh]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Christopher J. PeBenito wrote:
> On Thu, 2009-03-05 at 12:28 -0500, Daniel J Walsh wrote:
>> Christopher J. PeBenito wrote:
>>> On Wed, 2009-03-04 at 16:33 -0500, Daniel J Walsh wrote:
>>>> http://people.fedoraproject.org/~dwalsh/SELinux/F11/kernel_storage.patch
>>>>
>>>> Additonal file context
>>>>
>>>> Allow management of fixed_disk_device_t chr_file
>>> Are you sure about the MLS change of the FUSE device to system low, from
>>> system high?
>>>
>>> Otherwise merged.
>>>
>> fuse file systems are mounted on users home directories by default in
>> F10/F11 so a MLS login as a user will only work if this is SystemLow.
> 
> Can you describe more fully what the scenario is?  I'm having trouble
> seeing where the MLS issue is.  It seems like mount should be able to
> handle this fine.
> 
I am not logged in as MLS right now so, I can't regenerate.  It could be
that some app during the login was not running ranged and could not
execute a ranged mount.

Hold off on the label, and I will see try MLS on my laptop again and see
if I can get more info.


-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org

iEYEARECAAYFAkmwJVUACgkQrlYvE4MpobPHBgCfShVtHRF3AhaUDLR/vPzH82TC
KCkAmwf16O5oxKiZvPBU+uRYhElOOdH8
=NYUV
-----END PGP SIGNATURE-----

[refpolicy] kernel_storage.patch

[Daniel J Walsh]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

http://people.fedoraproject.org/~dwalsh/SELinux/F11/kernel_storage.patch

rawctl has moved

+/dev/(raw/)?rawctl
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org

iEYEARECAAYFAkksc2cACgkQrlYvE4MpobNBxwCgzsAksfWF9hqMJOYc/mGiD4TY
0hAAnj9ct+R/oj/XQ+fhpz127M/Il2mX
=KHHg
-----END PGP SIGNATURE-----

[refpolicy] kernel_storage.patch

[Daniel J Walsh]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

http://people.fedoraproject.org/~dwalsh/SELinux/F10/kernel_storage.patch

Add patch for /dev/mspblk.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org

iEYEARECAAYFAkjaqJEACgkQrlYvE4MpobPGFwCeJPs1xSHjAKOIROxS1WrbtAm0
uAEAn2tv8sDIbMvamC5z6fIaNDMz4qv0
=6lVt
-----END PGP SIGNATURE-----

[refpolicy] kernel_storage.patch

[Christopher J. PeBenito]

On Wed, 2008-09-24 at 16:52 -0400, Daniel J Walsh wrote:
> http://people.fedoraproject.org/~dwalsh/SELinux/F10/kernel_storage.patch
> 
> Add patch for /dev/mspblk.

Merged.

-- 
Chris PeBenito
Tresys Technology, LLC
(410) 290-1411 x150