<div>Hi All-</div>Wonderful information and good thread. Thanks! <div><br></div><div>We have a piece of vendor code that is replicating several fiber attached LUNs. We believe there is a software has a mis-configuration causing /dev/sda vs /dev/sdaa (one of the many LUNS) to have its MBR zeroed. </div>
<div><br></div><div>SELinux seems like an appropriate tool to at least monitor access if not allow full blocking.</div><div><br></div><div>Write protection is not an option as its a PERC controller and /dev/sda is the boot mirror (unless there are known alternatives)?</div>
<div><br></div><div>Thanks again all,</div><div><br></div><div>George</div><div><br></div><div><br></div><div><br><div class="gmail_quote">On Tue, Sep 6, 2011 at 10:06 AM, Mr Dash Four <span dir="ltr"><<a href="mailto:mr.dash.four@googlemail.com">mr.dash.four@googlemail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;"><div class="im"><br>
> Now if you have a app/admin user process that needs to have full<br>
> access to the system but want to make sure he does not modify the MBR<br>
> you will have a difficult time writing policy for this.<br>
><br>
</div>Not to mention that there are some tools - parted being one - which need<br>
access (rw) to that sector of the hdd, regardless of who runs these tools.<br>
<font color="#888888"><br>
--<br>
</font><div><div></div><div class="h5">selinux mailing list<br>
<a href="mailto:selinux@lists.fedoraproject.org">selinux@lists.fedoraproject.org</a><br>
<a href="https://admin.fedoraproject.org/mailman/listinfo/selinux" target="_blank">https://admin.fedoraproject.org/mailman/listinfo/selinux</a><br>
</div></div></blockquote></div><br></div>