Re: temporary hack to use udev in selinux

On Thu, 2004-07-29 at 09:53, Luke Kenneth Casson Leighton wrote:
> i don't know what the default is.

Unless there is a file_type_auto_trans() rule, the default is to inherit the type from the parent directory, i.e. device_t. Access to device_t:{chr_file blk_file} should be quite restricted, so this should be safe.

> so, when that matchpathcon() and setfscreatecon() is called,
> does it:
>
> a ) guarantee that the device node "to be created" will be set with
> the correct se/linux permissions

Yes. setfscreatecon() tells the kernel to create new files in a given security context, as opposed to having to relabel afterward.

-- 
Stephen Smalley <sds@epoch.ncsc.mil>
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.