[redhat-lspp] dev_allocator, udev and import/export requirements

[Janak Desai]

Hi all,

I have been looking at udev and TCS dev_allocator and I have some
questions.

udev, and selinux enhancements to it, allow assignment of security
attributes to device nodes based on policy (/etc/selinux/*/contexts
/files). TCS dev_allocator allows allocation and deallocation of
"user accessible" devices. dev_allocator maintains its own
configuration file with sensitivity label ranges (among other
attributes) for different devices. What I am confused about is how
does dev_allocator work with udev? That is, if udev assigns a
security context to a device as its /dev entry is created,
does the label range of the device have any interaction/relation
with its dev_allocator entry?

The dev_allocator patch implements creation and maintenance
of device attributes in dev_allocator.conf file. Who uses
these device records? Are there patches to CUPS, login, star,
etc that enforce the sensitivity label ranges stored in
the dev_allocator.conf file? Am I totally off on the use
of dev_allocator?

LSPP requires that the TOE contain a mechanism by which an
admin can assign security attributes to devices (single level
or a range in case of multi-level). These attributes are
then used in the enforcement of MAC policy when users/programs
use these devices. I am trying to get a handle on what we
have to patch in order to satisfy LSPP import/export
requirements with respect to terminals, printers and removable
devices.

Thanks.

-Janak