[gentoo-hardened] selinux & udev

[antoine]

Hi,

I've got a system which I am migrating to use selinux, so I had to
switch to udev. I followed all the instructions, rebooted, udevd is
running but /dev is mounted as ramfs (which does not support labelling
AFAIK) instead of tmpfs. I tried to find where it is being mounted, but
that isn't very clear (not in fstab, not in /etc/rc). Is it part
of /sbin/init now?
How do I switch to tmpfs for /dev?
(obviously, I rebuilt a kernel with devfs not mounted automatically -
would devfs show up as ramfs anyway?)

A lot of the services are chrooted at the moment, I ended up having to
change a lot of the .fc files to add "(/chroot/[myservice])?" in front
of the file definitions. Is there any reason not to have this merged?
(I know the benefit of having chroot is moot when you have selinux
enabled - but when you're in between...)

Portage triggers some policy violations that would be fixed by:
allow portage_fetch_t portage_tmp_t:dir search;
allow portage_fetch_t portage_tmp_t:file { getattr read };
allow portage_t tmpfs_t:filesystem getattr;
Am i the only one seeing this? I see no reason not to merge them into
portage.te.

I've noticed that a lot of the services which can be used with a mysql
backend (ie: spamd, postfix, etc) do not include policy for this since
it is a package option (+mysql). Is there any way we can have this
included in the .te files but conditional? 
Not necessarily using an "ifdef(`mysqld.te', `" (which would include it
as soon as mysql is installed) but maybe a combination of the above + a
flag?

Is there any interest in merging the policies I have started building?
Using mainly audit2allow (and a bit of thinking, and retro-fitting the
macros which is the hard part), I have made policies for: amavis,
setiathome, mdadm, saslauth, java, tomcat, fetchmail, psad, etc.


Thanks
Antoine


-- 
gentoo-hardened@g.o mailing list