lkml.org 
[lkml]   [2010]   [Aug]   [30]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    SubjectRe: selinux vs devtmpfs (vs udev)
    From
    Date
    On Sat, 2010-08-28 at 11:57 +0200, Kay Sievers wrote:
    > On Sat, Aug 28, 2010 at 01:00, Eric Paris <eparis@redhat.com> wrote:

    > > In the new new days of devtmpfs things aren't as nice. The kernel is
    > > magically creating files in /dev. These are getting created with the
    > > 'default' SELinux context. So herein lies the problem.
    > >
    > > The first program that tries to access these files get denied by
    > > SELinux. Now udev actually has logic in it to fix the label on any
    > > closed device file, so udev will at that point swoop in, fix the label,
    > > and the next program that tries to use the file will work just fine. Oh
    > > fun!

    > Udev should still label all device nodes, even when they are created
    > by the kernel. Devtmpfs or not should not make a difference here.
    >
    > I guess it's a udev bug introduced with:
    > http://git.kernel.org/?p=linux/hotplug/udev.git;a=commitdiff;h=578cc8a8085a47c963b5940459e475ac5f07219c
    >
    > and we just need to fix that.

    Looks like the likely cause. I see a note in one of the bugzillas that
    says:

    Aug 30 14:03:09 pippin udevd-work[347]: preserve file '/dev/dri/card0',
    because it has correct dev_t

    Which is certainly the part of code in question. Do you have a quick
    fix in mind that you plan to push upstream or should I ask the RH udev
    guy to come up with something?

    -Eric



    \
     
     \ /
      Last update: 2010-08-31 01:19    [W:0.023 / U:0.352 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site