[libvirt] [ANNOUNCE][RFC] sVirt: Integrating SELinux and Linux-based virtualization
James Morris
jmorris at namei.org
Tue Aug 12 11:25:51 UTC 2008
On Tue, 12 Aug 2008, Daniel P. Berrange wrote:
> Do we instead add the info the udev rules, so when /dev is
> populated at boot time by udev the device nodes get the desired
> initial labelling ? Or do we manually chcon() the device
> at the time we boot the VM ?
Dan Walsh has mentioned wanting to label the device at VM launch so that
MCS labels can be dynamically assigned. This raises some other possible
issues such as revoking any existing access (Linux doesn't have general
revocation) and having the security of the system depend on whatever is
performing the relabel (although we can enforce relabelfrom/relabelto
permissions).
I wonder if existing work/concepts related to MLS device allocation would
be useful here.
See:
http://sourceforge.net/projects/devallocator/
- James
--
James Morris
<jmorris at namei.org>
More information about the libvir-list
mailing list