Re: [Qemu-devel] virtio-rng and fd passing

[Daniel P. Berrange]

On Fri, Mar 01, 2013 at 04:14:40PM -0700, Eric Blake wrote:
> > I understand the reason that fdsets exist (because NFS is stupid and
> > doesn't support labeling).  But we aren't doing dynamic labeling of
> > /dev/random and I strongly suspect it's not on NFS anyway.
> > 
> > So why are we trying to pass fds here?
> 
> Consistency - how do you write a policy that allows open("/dev/random")
> while forbidding open("/nfs/...")?  It's much simpler to forbid open(),
> even if /dev/random doesn't have any labeling issues.

IIUC, it is actually pretty straightforward from a policy POV. Every
filesystem has a unique type, and SELinux can make rules scoped to that
filesystem type. That's how we have the 'virt_use_nfs' tunable already
which only affects NFS.

Daniel
-- 
|: http://berrange.com      -o-    http://www.flickr.com/photos/dberrange/ :|
|: http://libvirt.org              -o-             http://virt-manager.org :|
|: http://autobuild.org       -o-         http://search.cpan.org/~danberr/ :|
|: http://entangle-photo.org       -o-       http://live.gnome.org/gtk-vnc :|