2010-07-23 13:40:38

by debian

Subject: [refpolicy] Take virtio disks into account

Hi,

When using selinux in a virtualized system with virtio disks, the virtio
devices (/dev/vd*) are not labelled correctly. This can be fixed by this one-
liner, treating virtio disks just like any other disk (sata, ide, etc).

Without this patch, the booting grinds to a halt when selinux denies mounting
the root fs (which has to reside on a virtio disk, of course).

Cheers,

Mika Pfl?ger

2010-07-23 13:40:39

by debian

Subject: [refpolicy] [PATCH 1/1] Take virtio disks into account.

Signed-off-by: Mika Pfl?ger <[email protected]>
---
policy/modules/kernel/storage.fc | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/policy/modules/kernel/storage.fc b/policy/modules/kernel/storage.fc
index d819311..a9b8982 100644
--- a/policy/modules/kernel/storage.fc
+++ b/policy/modules/kernel/storage.fc
@@ -5,7 +5,7 @@
/dev/n?osst[0-3].* -c gen_context(system_u:object_r:tape_device_t,s0)
/dev/n?pt[0-9]+ -c gen_context(system_u:object_r:tape_device_t,s0)
/dev/n?tpqic[12].* -c gen_context(system_u:object_r:tape_device_t,s0)
-/dev/[shmx]d[^/]* -b gen_context(system_u:object_r:fixed_disk_device_t,mls_systemhigh)
+/dev/[shmxv]d[^/]* -b gen_context(system_u:object_r:fixed_disk_device_t,mls_systemhigh)
/dev/aztcd -b gen_context(system_u:object_r:removable_device_t,s0)
/dev/bpcd -b gen_context(system_u:object_r:removable_device_t,s0)
/dev/bsg/.+ -c gen_context(system_u:object_r:scsi_generic_device_t,s0)
--
1.7.1

2010-08-02 12:34:05

by cpebenito

Subject: [refpolicy] [PATCH 1/1] Take virtio disks into account.

On 07/23/10 09:40, Mika Pfl?ger wrote:
>
> Signed-off-by: Mika Pfl?ger<[email protected]>
> ---
> policy/modules/kernel/storage.fc | 2 +-
> 1 files changed, 1 insertions(+), 1 deletions(-)
>
> diff --git a/policy/modules/kernel/storage.fc b/policy/modules/kernel/storage.fc
> index d819311..a9b8982 100644
> --- a/policy/modules/kernel/storage.fc
> +++ b/policy/modules/kernel/storage.fc
> @@ -5,7 +5,7 @@
> /dev/n?osst[0-3].* -c gen_context(system_u:object_r:tape_device_t,s0)
> /dev/n?pt[0-9]+ -c gen_context(system_u:object_r:tape_device_t,s0)
> /dev/n?tpqic[12].* -c gen_context(system_u:object_r:tape_device_t,s0)
> -/dev/[shmx]d[^/]* -b gen_context(system_u:object_r:fixed_disk_device_t,mls_systemhigh)
> +/dev/[shmxv]d[^/]* -b gen_context(system_u:object_r:fixed_disk_device_t,mls_systemhigh)
> /dev/aztcd -b gen_context(system_u:object_r:removable_device_t,s0)
> /dev/bpcd -b gen_context(system_u:object_r:removable_device_t,s0)
> /dev/bsg/.+ -c gen_context(system_u:object_r:scsi_generic_device_t,s0)

Merged.

--
Chris PeBenito
Tresys Technology, LLC
http://www.tresys.com | oss.tresys.com