fix dontaudit interface that was allowing instead of dontauditing; thanks to karl for pointing this out.

policy/modules/kernel/devices.if

@@ -181,6 +181,24 @@ interface(`dev_relabel_generic_dev_dirs',`
 	allow $1 device_t:dir { r_dir_perms relabelfrom relabelto };
 ')
 
+########################################
+## <summary>
+##	dontaudit getattr generic files in /dev.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain to not audit.
+##	</summary>
+## </param>
+#
+interface(`dev_dontaudit_getattr_generic_files',`
+	gen_require(`
+		type device_t;
+	')
+
+	dontaudit $1 device_t:file getattr;
+')
+
 ########################################
 ## <summary>
 ##	Read and write generic files in /dev.
@@ -3230,23 +3248,3 @@ interface(`dev_unconfined',`
 
 	typeattribute $1 devices_unconfined_type;
 ')
-
-########################################
-## <summary>
-##	dontaudit getattr generic files in /dev.
-## </summary>
-## <param name="domain">
-##	<summary>
-##	Domain to not audit.
-##	</summary>
-## </param>
-#
-interface(`dev_dontaudit_getattr_generic_files',`
-	gen_require(`
-		type device_t;
-	')
-
-	allow $1 device_t:dir search;
-	dontaudit $1 device_t:file getattr;
-')
-

policy/modules/kernel/devices.te

@@ -1,5 +1,5 @@
 
-policy_module(devices,1.2.2)
+policy_module(devices,1.2.3)
 
 ########################################
 #

policy/modules/kernel/terminal.if

@@ -636,8 +636,6 @@ interface(`term_dontaudit_getattr_all_user_ptys',`
 		attribute ptynode;
 	')
 
-	dev_list_all_dev_nodes($1)
-	allow $1 devpts_t:dir r_dir_perms;
 	dontaudit $1 ptynode:chr_file getattr;
 ')
 

policy/modules/kernel/terminal.te

@@ -1,5 +1,5 @@
 
-policy_module(terminal,1.2.1)
+policy_module(terminal,1.2.2)
 
 ########################################
 #