Re: [PATCH 1/1] [bug556972-srivasta]: Explicitly allow /selinux and /sys as FHS exceptions
On Sat, Nov 21 2009, Kees Cook wrote:
> Hi,
>
> On Fri, Nov 20, 2009 at 12:33:50PM -0600, Manoj Srivastava wrote:
>> The report #556972 was filed about a FHS violation in mounting
>> selinuxfs on /selinux, which is accurate. Additionally, /sys does not
>> appear in the FHS either, and is thus in a similar situation.
>>
>> Now, I can move the mount point in libselinux1, perhals to
>> /lib/sellinux, but that would make us incompatible with other
>> installations, and cause a large number of needless conflict with
>> currently installed SELinux. Here is the backgound:
>
> Do the userspace tools use /selinux unconditionally or do they examine
> /proc/mounts? I'm not familiar with that portion of SELinux.
Most userspace tools use libselinux to look at things in
selinuxfs, and there is only on place where /selinux is hardcoded (and
only as a fallback if /proc/mounts is not available or does not know
about selinuxfs). Everything else will examine /proc/mounts.
manoj
--
Join the army, see the world, meet interesting, exciting people, and
kill them.
Manoj Srivastava <srivasta@debian.org> <http://www.debian.org/~srivasta/>
1024D/BF24424C print 4966 F272 D093 B493 410B 924B 21BA DABB BF24 424C
Reply to: