On Fri, Mar 01, 2013 at 04:14:40PM -0700, Eric Blake wrote:
> > I understand the reason that fdsets exist (because NFS is stupid and
> > doesn't support labeling). But we aren't doing dynamic labeling of
> > /dev/random and I strongly suspect it's not on NFS anyway.
> >
> > So why are we trying to pass fds here?
>
> Consistency - how do you write a policy that allows open("/dev/random")
> while forbidding open("/nfs/...")? It's much simpler to forbid open(),
> even if /dev/random doesn't have any labeling issues.
IIUC, it is actually pretty straightforward from a policy POV. Every
filesystem has a unique type, and SELinux can make rules scoped to that
filesystem type. That's how we have the 'virt_use_nfs' tunable already
which only affects NFS.
Daniel
--
|: http://berrange.com -o- http://www.flickr.com/photos/dberrange/ :|
|: http://libvirt.org -o- http://virt-manager.org :|
|: http://autobuild.org -o- http://search.cpan.org/~danberr/ :|
|: http://entangle-photo.org -o- http://live.gnome.org/gtk-vnc :|
