Re: [libvirt] [ANNOUNCE][RFC] sVirt: Integrating SELinux and Linux-based virtualization

[James Morris <jmorris namei org>]

On Tue, 12 Aug 2008, Daniel P. Berrange wrote:

>         Do we instead add the info the udev rules, so when /dev is
>         populated at boot time by udev the device nodes get the desired
>         initial labelling ?  Or do we manually  chcon() the device
>         at the time we boot the VM ?

Dan Walsh has mentioned wanting to label the device at VM launch so that 
MCS labels can be dynamically assigned.  This raises some other possible 
issues such as revoking any existing access (Linux doesn't have general 
revocation) and having the security of the system depend on whatever is 
performing the relabel (although we can enforce relabelfrom/relabelto 
permissions).

I wonder if existing work/concepts related to MLS device allocation would 
be useful here.

See:
http://sourceforge.net/projects/devallocator/


- James
-- 
James Morris
<jmorris namei org>