Re: [libvirt] [ANNOUNCE][RFC] sVirt: Integrating SELinux and Linux-based virtualization
On Tue, 12 Aug 2008, Daniel P. Berrange wrote:
Do we instead add the info the udev rules, so when /dev is
populated at boot time by udev the device nodes get the desired
initial labelling ? Or do we manually chcon() the device
at the time we boot the VM ?
Dan Walsh has mentioned wanting to label the device at VM launch so that
MCS labels can be dynamically assigned. This raises some other possible
issues such as revoking any existing access (Linux doesn't have general
revocation) and having the security of the system depend on whatever is
performing the relabel (although we can enforce relabelfrom/relabelto
permissions).
I wonder if existing work/concepts related to MLS device allocation would
be useful here.
See:
http://sourceforge.net/projects/devallocator/
- James
--
James Morris
<jmorris(a)namei.org>