/dev/mpt*ctl

/dev/mpt*ctl

[Russell Coker]

policy/modules/kernel/storage.fc:/dev/mpt[23]?ctl	-c	
gen_context(system_u:object_r:fixed_disk_device_t,mls_systemhigh)
policy/modules/kernel/devices.fc:/dev/mpt[2-9]*ctl       -c      
gen_context(system_u:object_r:mptctl_device_t,s0)

How did this get in?

Also the mptctl_device_t type doesn't have any specific rules to allow access 
to it.  As opposed to the following:

allow amanda_t fixed_disk_device_t:chr_file { ioctl lock open read };
allow blkmapd_t fixed_disk_device_t:chr_file { getattr ioctl lock open read };
allow bootloader_t fixed_disk_device_t:chr_file { append ioctl lock open read 
write };
allow container_engine_t fixed_disk_device_t:chr_file { append ioctl lock open 
read write };
allow crio_t fixed_disk_device_t:chr_file { append ioctl lock open read write 
};
allow devicekit_disk_t fixed_disk_device_t:chr_file { append ioctl lock open 
read write };
allow devices_unconfined_type device_node:chr_file { append create execmod 
execute getattr ioctl link lock map mounton open quotaon read relabelfrom 
relabelto rename setattr unlink watch watch_mount watch_reads watch_sb 
watch_with_perm write };
allow dockerd_t fixed_disk_device_t:chr_file { append ioctl lock open read 
write };
allow dockerd_user_t fixed_disk_device_t:chr_file { append ioctl lock open 
read write };
allow drbd_t fixed_disk_device_t:chr_file { getattr ioctl lock open read };
allow fsadm_t fixed_disk_device_t:chr_file { append create ioctl link lock 
open read rename setattr unlink write };
allow fsdaemon_t fixed_disk_device_t:chr_file { append getattr ioctl lock open 
read write };
allow fwupd_t fixed_disk_device_t:chr_file { append getattr ioctl lock open 
read write };
allow hddtemp_t fixed_disk_device_t:chr_file { getattr ioctl lock open read };
allow hypervvssd_t fixed_disk_device_t:chr_file { getattr ioctl lock open read 
};
allow kdumpctl_t device_node:chr_file { append create getattr ioctl link lock 
open read relabelfrom relabelto rename setattr unlink watch write };
allow lvm_t fixed_disk_device_t:chr_file { append create getattr ioctl link 
lock open read rename setattr unlink write };
allow mdadm_t fixed_disk_device_t:chr_file { append create getattr ioctl link 
lock open read rename setattr unlink write };
allow mkinitramfs_t fixed_disk_device_t:chr_file { getattr ioctl lock open 
read };
allow mon_local_test_t fixed_disk_device_t:chr_file { getattr ioctl lock open 
read };
allow mount_t fixed_disk_device_t:chr_file { append getattr ioctl lock open 
read write };
allow nagios_checkdisk_plugin_t fixed_disk_device_t:chr_file { getattr ioctl 
lock open read };
allow podman_t fixed_disk_device_t:chr_file { append ioctl lock open read 
write };
allow podman_user_t fixed_disk_device_t:chr_file { append ioctl lock open read 
write };
allow quota_t fixed_disk_device_t:chr_file { ioctl lock open read };
allow sanlock_t fixed_disk_device_t:chr_file { append getattr ioctl lock open 
read write };
allow sblim_gatherd_t fixed_disk_device_t:chr_file { getattr ioctl lock open 
read };
allow smbmount_t fixed_disk_device_t:chr_file { append getattr ioctl lock open 
read write };
allow systemd_generator_t fixed_disk_device_t:chr_file { append getattr ioctl 
lock open read write };
allow systemd_homework_t fixed_disk_device_t:chr_file { append getattr ioctl 
lock open read write };
allow systemd_logind_t fixed_disk_device_t:chr_file { getattr ioctl lock open 
read }; [ systemd_logind_get_bootloader ]:True
allow systemd_tmpfiles_t device_node:chr_file { append create getattr ioctl 
link lock open read relabelfrom relabelto rename setattr unlink watch write };
allow tgtd_t fixed_disk_device_t:chr_file { append create getattr ioctl link 
lock open read rename setattr unlink write };
allow udev_t device_node:chr_file { append create getattr ioctl link lock open 
read relabelfrom relabelto rename setattr unlink watch write };
allow virsh_t fixed_disk_device_t:chr_file { getattr ioctl lock open read };
allow virtd_lxc_t fixed_disk_device_t:chr_file { append create ioctl link lock 
open read rename setattr unlink write };
allow virtd_t fixed_disk_device_t:chr_file { append create ioctl link lock 
open read rename setattr unlink write };
allow xm_t fixed_disk_device_t:chr_file { getattr ioctl lock open read };

-- 
My Main Blog         http://etbe.coker.com.au/
My Documents Blog    http://doc.coker.com.au/