Archaic wrote:
This is preliminary. I'm still working through the rest of the rules.
This covers the first 3 sections of the current 25-lfs.rules file.

**NOTE** Due to the size of this email, PLEASE make heavy use of
trimming (like stripping my comments and keeping just the rule you are
replying to) so the thread stays readable.


----------------------------------------------------------------------------
# Changed all modes of 0xxx to just xxx and I didn't list that as a change in
# the individual rules' notes. Otherwise, any changes I make will be listed and
# differences to CLFS will be noted (except last_rule).
#
# When referring to "all others" or "other distros", I'm referring to the rules
# in the udev-092 tarball which are debian, frugalware, gentoo, redhat,
# slackware, and SuSe.
# # The last_rule line will show any of the above listed distros known to use
# that option for the given device(s).

# Core kernel devices

KERNEL=="mem",          MODE="640", GROUP="kmem"
# No change
# (clfs) NAME="%k" is unneeded
# last_rule - redhat

KERNEL=="kmem",         MODE="640", GROUP="kmem"
# No change
# (clfs) NAME="%k" is unneeded
# last_rule - redhat

KERNEL=="null",         MODE="666"
# No change
# (clfs) NAME="%k" is unneeded
# last_rule - redhat

KERNEL=="port",         MODE="640", GROUP="kmem"
# No change
# (clfs) NAME="%k" is unneeded
# last_rule - redhat

KERNEL=="zero",         MODE="666"
# No change
# (clfs) NAME="%k" is unneeded
# last_rule - redhat

KERNEL=="full",         MODE="666"
# No change
# (clfs) NAME="%k" is unneeded
# (clfs) 622 (SuSe-specific. All others use 666)
# last_rule - redhat

KERNEL=="random",       MODE="664"
# Changed from 444
# (clfs) NAME="%k" is unneeded
# (clfs) 666 is too lax
# last_rule - redhat

KERNEL=="urandom",      MODE="664"
# Changed from 444
# (clfs) NAME="%k" is unneeded
# (clfs) 644 (but 664 facilitates someone adding a group assignment later)
# last_rule - redhat

#KERNEL=="aio",          MODE="444"
# Commented out (not found in any other distro and requires a kernel patch)

#KERNEL=="kmsg",         MODE="600"
# Commented out (not found in any other distro and 660 root:root is fine)

KERNEL=="rtc",          MODE="664"
# Changed from 666. The distros disagree on mode, but none allow world write.
# (clfs) Uses default perms (660) and audio group.
# last_rule - none

# TTY devices (both communications and terminal types)

SUBSYSTEM=="tty",                   GROUP="dialout"
# Added
# This rule is a catchall that replaces many of the rules in lfs/clfs. Any later
# rule that matches tty subsystem devices will override (or modify) this generic
# rule. For example, some tty subsystem need a different group, mode, or name,
# or need a symlink.
# (clfs) doesn't have this rule.
# Never use last_rule on this

KERNEL=="ptmx",         MODE="666", GROUP="tty"
# No change
# (clfs) NAME="%k" is unneeded
# last_rule - redhat

KERNEL=="pty[p-za-e]*", MODE="666", GROUP="tty"
KERNEL=="tty[p-za-e]*",             GROUP="tty"
# Added
# (clfs) uses a different match pattern and makes the tty part 666, but 660 is
# preferred. When the tty is in use, pt_chown will set the needed perms.
# last_rule - debian, gentoo, redhat, suse

KERNEL=="capi",                                  NAME="capi20", 
SYMLINK+="isdn/capi20"
# Changed SYMLINK= to SYMLINK+=. All this does is allow for multiple symlinks
# should the admin want to add another. It's the generally preferred syntax for
# SYMLINK now.
# (clfs) doesn't have this rule.
# last_rule - none

KERNEL=="capi*",                                 NAME="capi/%n"
# Changed the [0-9]* regex to the more simple and equally matching *.
# (clfs) doesn't have this rule.
# last_rule - none

KERNEL=="tty",          MODE="666", GROUP="tty"
# No change
# (clfs) NAME="%k" is unneeded
# last_rule - debian, gentoo, redhat, suse

KERNEL=="tty[0-9]*",    MODE="620"  GROUP="tty"
# Changed from 666 (too lax). Need to ensure this doesn't break anything. A live
# debian box shows 620, but the rules show 666.
# (clfs) NAME="%k" is unneeded
# last_rule - debian, gentoo, redhat, suse

KERNEL=="vcs*",                     GROUP="tty"
# Changed from 600 to default
# (clfs) NAME="%k" is unneeded and 620 is suse-specific. All others use default.
# last_rule - gentoo, redhat, suse

KERNEL=="console",      MODE="600"  GROUP="tty"
# Changed from 622
# (clfs) NAME="%k" is unneeded
# last_rule - debian, redhat, suse
----------------------------------------------------------------------------


%k is probably not needed, but was needed at one time, it can probably be removed in the clfs rules, but since it hasn't been tested.

The "vcs*" should catch all of the vcs devices no need to have a separate one just for vcs. Why duplicate the effort.

As far as the difference on the permissions it depends on the builder. If we were building a High Security System, a lot of things would be different. There is no right/wrong way, it's a SWAG at best.

But not bad for a base ruleset.



--
http://linuxfromscratch.org/mailman/listinfo/lfs-dev
FAQ: http://www.linuxfromscratch.org/faq/
Unsubscribe: See the above information page

Reply via email to