Re: [PATCH userspace] fixfiles: do not exclude /dev and /run in -C mode

From: Petr Lautrbach <plautrba@redhat.com>
To: Ondrej Mosnacek <omosnace@redhat.com>, selinux@vger.kernel.org
Cc: Zdenek Pytela <zpytela@redhat.com>
Subject: Re: [PATCH userspace] fixfiles: do not exclude /dev and /run in -C mode
Date: Wed, 12 May 2021 10:08:04 +0200	[thread overview]
Message-ID: <871racidcr.fsf@redhat.com> (raw)
In-Reply-To: <87bl9mhgzn.fsf@redhat.com>

Petr Lautrbach <plautrba@redhat.com> writes:

> Ondrej Mosnacek <omosnace@redhat.com> writes:
>
>> I can't think of a good reason why they should be excluded. On the
>> contrary, excluding them can cause trouble very easily if some labeling
>> rules for these directories change. For example, we changed the label
>> for /dev/nvme* from nvme_device_t to fixed_disk_device_t in Fedora
>> (updating the allow rules accordingly) and after policy update they
>> ended up with an invalid context, causing denials.
>>
>> Thus, remove /dev and /run from the excludes. While there, also add
>> /root to the basic excludes to match the regex that excludes fc rules
>> (that should be effectively no functional change).
>>
>> I did a sanity check on my system by running `restorecon -nv /dev /run`
>> and it didn't report any label differences.
>>
>> Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
>>
>
> Acked-by: Petr Lautrbach <plautrba@redhat.com>
>

Merged

>
>> ---
>>  policycoreutils/scripts/fixfiles | 4 ++--
>>  1 file changed, 2 insertions(+), 2 deletions(-)
>>
>> diff --git a/policycoreutils/scripts/fixfiles b/policycoreutils/scripts/fixfiles
>> index 30dadb4f..6fb12e04 100755
>> --- a/policycoreutils/scripts/fixfiles
>> +++ b/policycoreutils/scripts/fixfiles
>> @@ -162,7 +162,7 @@ newer() {
>>  #
>>  diff_filecontext() {
>>  EXCLUDEDIRS="`exclude_dirs_from_relabelling`"
>> -for i in /sys /proc /dev /run /mnt /var/tmp /var/lib/BackupPC /home /tmp /dev; do
>> +for i in /sys /proc /mnt /var/tmp /var/lib/BackupPC /home /root /tmp; do
>>      [ -e $i ]  && EXCLUDEDIRS="${EXCLUDEDIRS} -e $i";
>>  done
>>  LogExcluded
>> @@ -175,7 +175,7 @@ if [ -f ${PREFC} -a -x /usr/bin/diff ]; then
>>  	sed -r -e 's,:s0, ,g' $FC | sort -u | \
>>  	/usr/bin/diff -b ${PREFCTEMPFILE} - | \
>>  	    grep '^[<>]'|cut -c3-| grep ^/ | \
>> -	    egrep -v '(^/home|^/root|^/tmp|^/dev)' |\
>> +	    egrep -v '(^/home|^/root|^/tmp)' |\
>>  	sed -r -e 's,[[:blank:]].*,,g' \
>>  	       -e 's|\(([/[:alnum:]]+)\)\?|{\1,}|g' \
>>  	       -e 's|([/[:alnum:]])\?|{\1,}|g' \
>> -- 
>> 2.29.2