selinux-refpolicy/policy/modules/kernel/terminal.te
Nicolas Iooss via refpolicy 69d400af3b terminal: /dev/pts exists in /dev filesystem
systemd tries to create /dev/pts directly with its context type
"devpts_t", but this is not allowed:

    avc:  denied  { associate } for  pid=1 comm="systemd" name="pts"
    scontext=system_u:object_r:devpts_t
    tcontext=system_u:object_r:device_t
    tclass=filesystem permissive=1
2017-09-08 11:43:48 -04:00

63 lines
1.2 KiB
Plaintext

policy_module(terminal, 1.17.0)
########################################
#
# Declarations
#
attribute ttynode;
attribute ptynode;
attribute server_ptynode;
attribute serial_device;
#
# bsdpty_device_t is the type of /dev/[tp]ty[abcdepqrstuvwxyz][0-9a-f]
type bsdpty_device_t;
dev_node(bsdpty_device_t)
#
# console_device_t is the type of /dev/console.
#
type console_device_t;
dev_node(console_device_t)
#
# devpts_t is the type of the devpts file system and
# the type of the root directory of the file system.
#
type devpts_t;
dev_associate(devpts_t)
files_mountpoint(devpts_t)
fs_associate_tmpfs(devpts_t)
fs_xattr_type(devpts_t)
fs_use_trans devpts gen_context(system_u:object_r:devpts_t,s0);
#
# devtty_t is the type of /dev/tty.
#
type devtty_t;
dev_node(devtty_t)
mls_trusted_object(devtty_t)
#
# ptmx_t is the type for /dev/ptmx.
#
type ptmx_t;
dev_node(ptmx_t)
mls_trusted_object(ptmx_t)
allow ptmx_t devpts_t:filesystem associate;
#
# tty_device_t is the type of /dev/*tty*
#
type tty_device_t, serial_device;
dev_node(tty_device_t)
#
# usbtty_device_t is the type of /dev/usr/tty*
#
type usbtty_device_t, serial_device;
dev_node(usbtty_device_t)
type virtio_device_t, serial_device;
dev_node(virtio_device_t)