<html><head><meta http-equiv="Content-Type" content="text/html charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><br><div>
<span class="Apple-style-span" style="border-collapse: separate; color: rgb(0, 0, 0); font-family: Helvetica; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; border-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; font-size: medium; "><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">Michael Demeter<br>Staff Security Engineer<br>Open Source Technology Center - SSG<br>Intel Corporation<br><br><br></div></span>
</div>
<br><div><div>On Oct 14, 2013, at 4:10 PM, Kay Sievers <<a href="mailto:kay@vrfy.org">kay@vrfy.org</a>> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite">On Tue, Oct 15, 2013 at 12:59 AM, Michael Demeter<br><<a href="mailto:michael.demeter@intel.com">michael.demeter@intel.com</a>> wrote:<br><blockquote type="cite">Yes is is very specific to Smack.<br></blockquote><br>Sure.<br><br><blockquote type="cite">Yes this has been tested here.<br></blockquote><br>It looks to me like *everything* will have that label now. This is an<br>unconditional rule.<br></blockquote><br>Yes. Without it nothing can use the /dev devices except systemd</div><div><br><blockquote type="cite"><br><blockquote type="cite">It is not included as a policy file when the image is built if Smack is not<br>enabled.. So will not affect anyone not using smack.<br></blockquote><br>That's not the point, the point is is if *belongs* into the systemd<br>repo, not if it's *enabled* by default or not. From what I see, it's</blockquote><blockquote type="cite">nothing really we should ship upstream.<br></blockquote><div><br></div><div>If Smack is enabled in systemd it starts very early and all of the special </div><div>devices need to be labeled properly for correct operation </div><br><blockquote type="cite"><br>Also, it should not repeat the primary permissions settings from the<br>default rules, that is just not right.<br></blockquote><div><br></div><div>This was done at Auke's request since the rule is adding the SECLABEL</div><div>for debugability to have the original rule present was desirable.</div><br><blockquote type="cite"><br>Kay<br></blockquote></div><br></body></html>