[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <923f87a1-1871-479e-832e-db67b5ae87fd@redhat.com>
Date: Mon, 23 Oct 2023 09:28:57 +0200
From: Maxime Coquelin <maxime.coquelin@...hat.com>
To: Casey Schaufler <casey@...aufler-ca.com>, mst@...hat.com,
jasowang@...hat.com, xuanzhuo@...ux.alibaba.com,
paul@...l-moore.com, jmorris@...ei.org, serge@...lyn.com,
stephen.smalley.work@...il.com, eparis@...isplace.org,
xieyongji@...edance.com, virtualization@...ts.linux-foundation.org,
linux-kernel@...r.kernel.org,
linux-security-module@...r.kernel.org, selinux@...r.kernel.org,
david.marchand@...hat.com, lulu@...hat.com
Subject: Re: [PATCH v4 4/4] vduse: Add LSM hooks to check Virtio device type
On 10/21/23 00:20, Casey Schaufler wrote:
> On 10/20/2023 8:58 AM, Maxime Coquelin wrote:
>> This patch introduces LSM hooks for devices creation,
>> destruction and opening operations, checking the
>> application is allowed to perform these operations for
>> the Virtio device type.
>
> Why do you think that there needs to be a special LSM check for virtio
> devices? What can't existing device attributes be used?
Michael asked for a way for SELinux to allow/prevent the creation of
some types of devices [0].
A device is created using ioctl() on VDUSE control chardev. Its type is
specified via a field in the structure passed in argument.
I didn't see other way than adding dedicated LSM hooks to achieve this,
but it is possible that their is a better way to do it?
Thanks,
Maxime
[0]:
https://lore.kernel.org/all/20230829130430-mutt-send-email-mst@kernel.org/
Powered by blists - more mailing lists