Hi,
I help maintain libgpod upstream and in Fedora. We install a hal
callout¹ to handle newer iPods, which make some very useful and
required information accessible only via a SCSI query of the iPod.
The callout is meant to make the needed query and store the
information retrieved (which is is an XML file) on the iPod where it
can subsequently be read by a normal user.
To do this, the callout mounts the iPod to a temporary location,
queries the device, saves the XML, and unmounts. This causes a number
of denials which I will attach. I'd like to get some help in
determining what things need fixed in the callout code and what things
need policy changes. If I need to, I can package a policy module in
libgpod, though having it in the main selinux policy would be
preferable I think.
The libgpod callout code is in:
https://gtkpod.svn.sourceforge.net/svnroot/gtkpod/libgpod/trunk/tools/
Most of the interesting code is in hal-callout.c, but the other files
are probably worth a look as well.
FWIW, the callout currently uses /tmp/ipodXXXXXX (via mkdtemp) as the
temporary mount point. I did try moving that to /media to see if that
worked any better, but AFAICT, it caused the same denials. Moving the
temp mount out of /tmp is not a problem (and is probably a good idea
anyway).
Any help will be much appreciated.
¹
http://people.freedesktop.org/~david/hal-spec/hal-spec.html#device-proper...
--
Todd OpenPGP -> KeyID: 0xBEAF0CE3 | URL:
www.pobox.com/~tmz/pgp
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
We can't be so fixated on our desire to preserve the rights of
ordinary Americans.
-- William Jefferson Clinton (USA TODAY, 11 March 1993, page 2A)