xen, selinux, FC5

[Stephen Smalley]

On Fri, 2006-10-13 at 17:12 +0100, Robin Bowes wrote:
> Stephen Smalley wrote:
> > 
> > The assertion is to prevent accidental granting of read access to a
> > raw disk device.  Is that truly required here?
> 
> Probably - the root disk of the guest O/S instance is an lvm partition,
> e.g. /dev/vg01/lv_guest
> 
> > To allow it, you need to use the interface for it, e.g. 
> > storage_raw_read_fixed_disk(xm_t) That interface is defined in
> > kernel/storage.if. In addition to allowing the permission, it adds a
> > type attribute to the type that excludes from the assertion.
> 
> So, what would that look like in the policy file?

If you build using the devel makefile (e.g. make
-f /usr/share/selinux/devel/Makefile or copy it over to where you are
working on your module), then you can use the interface as I described,
i.e. just put
	storage_raw_read_fixed_disk(xm_t)
in your .te file.

That Makefile will pull in the headers and expand it properly.
Should handle the checkmodule and semodule_package side of things,
leaving you with just running semodule -i to install it once built.

-- 
Stephen Smalley
National Security Agency