RepoMirrors/selinux
1
0
Fork 0
mirror of https://github.com/SELinuxProject/selinux synced 2024-12-24 06:52:12 +00:00
Code Issues Packages Projects Releases Wiki Activity

fixfiles: do not exclude /dev and /run in -C mode

Browse Source 
I can't think of a good reason why they should be excluded. On the
contrary, excluding them can cause trouble very easily if some labeling
rules for these directories change. For example, we changed the label
for /dev/nvme* from nvme_device_t to fixed_disk_device_t in Fedora
(updating the allow rules accordingly) and after policy update they
ended up with an invalid context, causing denials.

Thus, remove /dev and /run from the excludes. While there, also add
/root to the basic excludes to match the regex that excludes fc rules
(that should be effectively no functional change).

I did a sanity check on my system by running `restorecon -nv /dev /run`
and it didn't report any label differences.

Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Acked-by: Petr Lautrbach <plautrba@redhat.com>
This commit is contained in:
Ondrej Mosnacek 2021-03-01 18:19:22 +01:00 committed by Petr Lautrbach
parent f1bc162cc2
commit 26a4c19ecf
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
policycoreutils/scripts/fixfiles
View File

@ -162,7 +162,7 @@ newer() {
# #
diff_filecontext() { diff_filecontext() {
EXCLUDEDIRS="`exclude_dirs_from_relabelling`" EXCLUDEDIRS="`exclude_dirs_from_relabelling`"
for i in /sys /proc /dev /run /mnt /var/tmp /var/lib/BackupPC /home /tmp /dev; do for i in /sys /proc /mnt /var/tmp /var/lib/BackupPC /home /root /tmp; do
[ -e $i ] && EXCLUDEDIRS="${EXCLUDEDIRS} -e $i"; [ -e $i ] && EXCLUDEDIRS="${EXCLUDEDIRS} -e $i";
done done
LogExcluded LogExcluded
@ -175,7 +175,7 @@ if [ -f ${PREFC} -a -x /usr/bin/diff ]; then
sed -r -e 's,:s0, ,g' $FC | sort -u | \ sed -r -e 's,:s0, ,g' $FC | sort -u | \
/usr/bin/diff -b ${PREFCTEMPFILE} - | \ /usr/bin/diff -b ${PREFCTEMPFILE} - | \
grep '^[<>]'|cut -c3-| grep ^/ | \ grep '^[<>]'|cut -c3-| grep ^/ | \
egrep -v '(^/home|^/root|^/tmp|^/dev)' |\ egrep -v '(^/home|^/root|^/tmp)' |\
sed -r -e 's,[[:blank:]].*,,g' \ sed -r -e 's,[[:blank:]].*,,g' \
-e 's|\(([/[:alnum:]]+)\)\?|{\1,}|g' \ -e 's|\(([/[:alnum:]]+)\)\?|{\1,}|g' \
-e 's|([/[:alnum:]])\?|{\1,}|g' \ -e 's|([/[:alnum:]])\?|{\1,}|g' \