[[e-mail]]

[Bill Nottingham]

Some questions from the upstream udev maintainer... from reading
it, the media  stuff is because CDROMs, etc. have a different file
type, and the defaultfile context needs set in everything that
creates devices. Is that correct?

Bill

----- Forwarded message from Kay Sievers <kay.sievers(a)vrfy.org&gt; -----

Date: Sat, 4 Feb 2006 05:10:04 +0100
From: Kay Sievers <kay.sievers(a)vrfy.org&gt;
To: Bill Nottingham <notting(a)redhat.com&gt;

...
Can't we move the selinux_init() called from every event process
to the single main daemon init? I don't know how expensive that is,
nor do I know if selinux is fine with that, but if we can make that
faster it would be better...

And the get_media() in udev_selinux.c for every block device seems
a bit weird. Do you know if this really needed? What about scsi then?
I've added the IDE stuff to sysfs in 2.6.15, so we should at least
use the file there...

Care to ask one of your selinux guys or forward the questions?

Cheers,
Kay

----- End forwarded message -----

[Stephen Smalley]

On Mon, 2006-02-06 at 10:46 -0500, Bill Nottingham wrote:
>  Some questions from the upstream udev maintainer... from reading
>  it, the media  stuff is because CDROMs, etc. have a different file
>  type, and the defaultfile context needs set in everything that
>  creates devices. Is that correct? 
Dan Walsh wrote the original udev SELinux support, so take this with a
grain of salt, but I think that you are correct.  The usual file
contexts approach of labeling based on pathname regex wasn't sufficient
for removable media, so Dan introduced the specialized media handling.  

On Kay's selinux_init question:

>  Can't we move the selinux_init() called from every event process
>  to the single main daemon init? I don't know how expensive that is,
>  nor do I know if selinux is fine with that, but if we can make that
>  faster it would be better... 
The expensive part of selinux_init is matchpathcon_init, but that should
be somewhat alleviated by the introduction of matchpathcon_init_prefix
so that only the necessary file_contexts entries are processed and the
libselinux changes to perform lazy canonicalization of the security
contexts.

The matchpathcon_init has to be done in the process that performs the
subsequent matchpathcon calls, as it populates an in-memory data
structure used by matchpathcon.  Conceivably, both the
matchpathcon_init_prefix and the later matchpathcon calls could be done
in the parent daemon and the children could receive the appropriate
context info from the parent via a pipe or commandline argument, but
someone would have to work out the details there.

The rest of selinux_init is just saving the old file creation context
(if one was previously set) so that it can be restored later.  In
practice, I suspect that this is always NULL for udev, and we could
"optimize" this away, but it is safer to always save-and-restore it, and
that isn't the expensive part.

>  And the get_media() in udev_selinux.c for every block device seems
>  a bit weird. Do you know if this really needed? What about scsi then?
>  I've added the IDE stuff to sysfs in 2.6.15, so we should at least
>  use the file there... 
Not sure - I'll defer to Dan on this.

-- 
Stephen Smalley
National Security Agency

[Daniel J Walsh]

Stephen Smalley wrote:
>  On Mon, 2006-02-06 at 10:46 -0500, Bill Nottingham wrote:
>    
> > Some questions from the upstream udev maintainer... from reading
> > it, the media  stuff is because CDROMs, etc. have a different file
> > type, and the defaultfile context needs set in everything that
> > creates devices. Is that correct?
> >     
>
>  Dan Walsh wrote the original udev SELinux support, so take this with a
>  grain of salt, but I think that you are correct.  The usual file
>  contexts approach of labeling based on pathname regex wasn't sufficient
>  for removable media, so Dan introduced the specialized media handling.  
>
>  On Kay's selinux_init question:
>
>    
> > Can't we move the selinux_init() called from every event process
> > to the single main daemon init? I don't know how expensive that is,
> > nor do I know if selinux is fine with that, but if we can make that
> > faster it would be better...
> >     
>
>  The expensive part of selinux_init is matchpathcon_init, but that should
>  be somewhat alleviated by the introduction of matchpathcon_init_prefix
>  so that only the necessary file_contexts entries are processed and the
>  libselinux changes to perform lazy canonicalization of the security
>  contexts.
>
>  The matchpathcon_init has to be done in the process that performs the
>  subsequent matchpathcon calls, as it populates an in-memory data
>  structure used by matchpathcon.  Conceivably, both the
>  matchpathcon_init_prefix and the later matchpathcon calls could be done
>  in the parent daemon and the children could receive the appropriate
>  context info from the parent via a pipe or commandline argument, but
>  someone would have to work out the details there.
>
>  The rest of selinux_init is just saving the old file creation context
>  (if one was previously set) so that it can be restored later.  In
>  practice, I suspect that this is always NULL for udev, and we could
>  "optimize" this away, but it is safer to always save-and-restore it, and
>  that isn't the expensive part.
>
>    
> > And the get_media() in udev_selinux.c for every block device seems
> > a bit weird. Do you know if this really needed? What about scsi then?
> > I've added the IDE stuff to sysfs in 2.6.15, so we should at least
> > use the file there...
> >     
>
>  Not sure - I'll defer to Dan on this.
>
>     
How about if we changed the call to
        if ( mode & S_IFBLK ) {
            media = get_media(devname, mode);
            if (media) {
                ret = matchmediacon(media, &scontext);
                free(media);
            }
        }

[Stephen Smalley]

On Mon, 2006-02-06 at 13:15 -0500, Daniel J Walsh wrote:
>  How about if we changed the call to
>          if ( mode & S_IFBLK ) {
>              media = get_media(devname, mode);
>              if (media) {
>                  ret = matchmediacon(media, &scontext);
>                  free(media);
>              }
>          } 
You already have a test of (mode & S_IFBLK) on entry to get_media, so I
don't see what that buys you.  Still limited to ide devices by get_media
only checking /proc/ide.  I don't think her concern with the media
support was performance, just generality and use of sysfs.  Performance
concern was with selinux_init.

On the performance overhead issue, only real improvement would be to
move all matchpathcon_init+matchpathcon processing into the daemon and
have the daemon pass the required contexts to the event commands on the
command line or via pipe.  

-- 
Stephen Smalley
National Security Agency