Understanding udev's SELinux integration
The udev device manager is responsible for handling device files inside the /dev/ structure whenever changes occur. As many device files have different contexts, without any SELinux awareness, the udev policy would need to be enhanced with many, many named file transitions. Such a named file transition, for a device /dev/mydevice towards the mydevice_t type, would look like the following code:
dev_filetrans(udev_t, mydevice_t, chr_file, "mydevice")
However, when /dev/mydevice1, /dev/mydevice2, and so on need to be labeled as well, then each possible name would need to be iterated in the policy (named file transitions do not support regular expressions). Luckily, udev is SELinux-aware, making it unnecessary to create policy enhancements for every device file.
This recipe shows us when additional policy enhancements are needed and when not.
How to do it…
To understand how udev's SELinux integration works, the following decision criteria can be followed:
Whenever...
