Petr Lautrbach <plautrba@xxxxxxxxxx> writes:
> Ondrej Mosnacek <omosnace@xxxxxxxxxx> writes:
>
>> I can't think of a good reason why they should be excluded. On the
>> contrary, excluding them can cause trouble very easily if some labeling
>> rules for these directories change. For example, we changed the label
>> for /dev/nvme* from nvme_device_t to fixed_disk_device_t in Fedora
>> (updating the allow rules accordingly) and after policy update they
>> ended up with an invalid context, causing denials.
>>
>> Thus, remove /dev and /run from the excludes. While there, also add
>> /root to the basic excludes to match the regex that excludes fc rules
>> (that should be effectively no functional change).
>>
>> I did a sanity check on my system by running `restorecon -nv /dev /run`
>> and it didn't report any label differences.
>>
>> Signed-off-by: Ondrej Mosnacek <omosnace@xxxxxxxxxx>
>>
>
> Acked-by: Petr Lautrbach <plautrba@xxxxxxxxxx>
>
Merged
>
>> ---
>> policycoreutils/scripts/fixfiles | 4 ++--
>> 1 file changed, 2 insertions(+), 2 deletions(-)
>>
>> diff --git a/policycoreutils/scripts/fixfiles b/policycoreutils/scripts/fixfiles
>> index 30dadb4f..6fb12e04 100755
>> --- a/policycoreutils/scripts/fixfiles
>> +++ b/policycoreutils/scripts/fixfiles
>> @@ -162,7 +162,7 @@ newer() {
>> #
>> diff_filecontext() {
>> EXCLUDEDIRS="`exclude_dirs_from_relabelling`"
>> -for i in /sys /proc /dev /run /mnt /var/tmp /var/lib/BackupPC /home /tmp /dev; do
>> +for i in /sys /proc /mnt /var/tmp /var/lib/BackupPC /home /root /tmp; do
>> [ -e $i ] && EXCLUDEDIRS="${EXCLUDEDIRS} -e $i";
>> done
>> LogExcluded
>> @@ -175,7 +175,7 @@ if [ -f ${PREFC} -a -x /usr/bin/diff ]; then
>> sed -r -e 's,:s0, ,g' $FC | sort -u | \
>> /usr/bin/diff -b ${PREFCTEMPFILE} - | \
>> grep '^[<>]'|cut -c3-| grep ^/ | \
>> - egrep -v '(^/home|^/root|^/tmp|^/dev)' |\
>> + egrep -v '(^/home|^/root|^/tmp)' |\
>> sed -r -e 's,[[:blank:]].*,,g' \
>> -e 's|\(([/[:alnum:]]+)\)\?|{\1,}|g' \
>> -e 's|([/[:alnum:]])\?|{\1,}|g' \
>> --
>> 2.29.2
