Ondrej Mosnacek <omosnace@xxxxxxxxxx> writes:
> I can't think of a good reason why they should be excluded. On the
> contrary, excluding them can cause trouble very easily if some labeling
> rules for these directories change. For example, we changed the label
> for /dev/nvme* from nvme_device_t to fixed_disk_device_t in Fedora
> (updating the allow rules accordingly) and after policy update they
> ended up with an invalid context, causing denials.
I guess that /dev/ is there in order to avoid relabeling tty devices and block
the user from access:
[root@localhost ~]# ls -Z /dev/tty1
user_u:object_r:user_tty_device_t:s0 /dev/tty1
[root@localhost ~]# matchpathcon /dev/tty1
/dev/tty1 system_u:object_r:tty_device_t:s0
> Thus, remove /dev and /run from the excludes. While there, also add
> /root to the basic excludes to match the regex that excludes fc rules
> (that should be effectively no functional change).
>
> I did a sanity check on my system by running `restorecon -nv /dev /run`
> and it didn't report any label differences.
>
> Signed-off-by: Ondrej Mosnacek <omosnace@xxxxxxxxxx>
> ---
> policycoreutils/scripts/fixfiles | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/policycoreutils/scripts/fixfiles b/policycoreutils/scripts/fixfiles
> index 30dadb4f..6fb12e04 100755
> --- a/policycoreutils/scripts/fixfiles
> +++ b/policycoreutils/scripts/fixfiles
> @@ -162,7 +162,7 @@ newer() {
> #
> diff_filecontext() {
> EXCLUDEDIRS="`exclude_dirs_from_relabelling`"
> -for i in /sys /proc /dev /run /mnt /var/tmp /var/lib/BackupPC /home /tmp /dev; do
> +for i in /sys /proc /mnt /var/tmp /var/lib/BackupPC /home /root /tmp; do
> [ -e $i ] && EXCLUDEDIRS="${EXCLUDEDIRS} -e $i";
> done
> LogExcluded
> @@ -175,7 +175,7 @@ if [ -f ${PREFC} -a -x /usr/bin/diff ]; then
> sed -r -e 's,:s0, ,g' $FC | sort -u | \
> /usr/bin/diff -b ${PREFCTEMPFILE} - | \
> grep '^[<>]'|cut -c3-| grep ^/ | \
> - egrep -v '(^/home|^/root|^/tmp|^/dev)' |\
> + egrep -v '(^/home|^/root|^/tmp)' |\
> sed -r -e 's,[[:blank:]].*,,g' \
> -e 's|\(([/[:alnum:]]+)\)\?|{\1,}|g' \
> -e 's|([/[:alnum:]])\?|{\1,}|g' \
> --
> 2.29.2
