From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.sws.net.au (smtp.sws.net.au [144.76.186.9]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E41CE189F43 for ; Wed, 15 Jul 2026 14:58:21 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=144.76.186.9 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784127504; cv=none; b=gG4W3O+fncGEMSNVJQTpma5ilgmYUlxgY0yoq3X7RLfdI9HG+gyv63g4B68PR+UBuxF8cRl9w1prtNpOuMcAduQ3b3r0ThcbcjXdSUY8gyuOmylJz6HF6UM0cK04jV04ULtFArKGlUCwiHaN2osETiGu+FmDFBuz6pbpoC6I9a4= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784127504; c=relaxed/simple; bh=aRxJt9Bid2mklJe0SFGjzd2AqWyyOEDIbB2160HJY2M=; h=From:To:Subject:Date:Message-ID:MIME-Version:Content-Type; b=i12T8nEzk1wnH1OrT79qUstIOacYjA5L9jny0ODQ4yfn4+uKoINfEFFoVtP+usJB47CPnbqXOpfypOf7o5zhUDEwiCoVJl4AtaqBt5GGlJkAoVxxEK0HTQhCneFIM0eNyWUANV+PvDUd/QLG7QmbpR4LBES3EvDDLdd65/MvudA= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=coker.com.au; spf=pass smtp.mailfrom=coker.com.au; dkim=pass (1024-bit key) header.d=coker.com.au header.i=@coker.com.au header.b=3JWTMUOD; arc=none smtp.client-ip=144.76.186.9 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=coker.com.au Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=coker.com.au Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=coker.com.au header.i=@coker.com.au header.b="3JWTMUOD" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=coker.com.au; s=2008; t=1784127494; bh=1itmV+baES9k5ZaWHRXqQIAbS8YIm4LhIVI7cI+KTtA=; l=4380; h=From:To:Reply-To:Subject:Date:From; b=3JWTMUODbRPk0Y4f2nZ3XvJI2nQbZq6RVbGzwY7xwSDwH7MLsbPkXwolOzlkYlOCt BbVLsXuryeUwJlny7sL87aFw8odZCa6ZRJI8RHN9jO5k4J6hbNen7PEDuu0vT4k5Kb VKDn+EZ8CIJAcRzG73YU83wPYKTU3noAaEh1wvjQ= Received: from xev.localnet (unknown [61.68.253.40]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature ECDSA (prime256v1) server-digest SHA256) (No client certificate requested) (Authenticated sender: russell@coker.com.au) by smtp.sws.net.au (Postfix) with ESMTPSA id 947681A2B8 for ; Thu, 16 Jul 2026 00:58:13 +1000 (AEST) From: Russell Coker To: selinux-refpolicy@vger.kernel.org Reply-To: russell@coker.com.au Subject: /dev/mpt*ctl Date: Thu, 16 Jul 2026 00:58:10 +1000 Message-ID: <5712949.CZNHGQPT7h@xev> Precedence: bulk X-Mailing-List: selinux-refpolicy@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 7Bit Content-Type: text/plain; charset="utf-8" policy/modules/kernel/storage.fc:/dev/mpt[23]?ctl -c gen_context(system_u:object_r:fixed_disk_device_t,mls_systemhigh) policy/modules/kernel/devices.fc:/dev/mpt[2-9]*ctl -c gen_context(system_u:object_r:mptctl_device_t,s0) How did this get in? Also the mptctl_device_t type doesn't have any specific rules to allow access to it. As opposed to the following: allow amanda_t fixed_disk_device_t:chr_file { ioctl lock open read }; allow blkmapd_t fixed_disk_device_t:chr_file { getattr ioctl lock open read }; allow bootloader_t fixed_disk_device_t:chr_file { append ioctl lock open read write }; allow container_engine_t fixed_disk_device_t:chr_file { append ioctl lock open read write }; allow crio_t fixed_disk_device_t:chr_file { append ioctl lock open read write }; allow devicekit_disk_t fixed_disk_device_t:chr_file { append ioctl lock open read write }; allow devices_unconfined_type device_node:chr_file { append create execmod execute getattr ioctl link lock map mounton open quotaon read relabelfrom relabelto rename setattr unlink watch watch_mount watch_reads watch_sb watch_with_perm write }; allow dockerd_t fixed_disk_device_t:chr_file { append ioctl lock open read write }; allow dockerd_user_t fixed_disk_device_t:chr_file { append ioctl lock open read write }; allow drbd_t fixed_disk_device_t:chr_file { getattr ioctl lock open read }; allow fsadm_t fixed_disk_device_t:chr_file { append create ioctl link lock open read rename setattr unlink write }; allow fsdaemon_t fixed_disk_device_t:chr_file { append getattr ioctl lock open read write }; allow fwupd_t fixed_disk_device_t:chr_file { append getattr ioctl lock open read write }; allow hddtemp_t fixed_disk_device_t:chr_file { getattr ioctl lock open read }; allow hypervvssd_t fixed_disk_device_t:chr_file { getattr ioctl lock open read }; allow kdumpctl_t device_node:chr_file { append create getattr ioctl link lock open read relabelfrom relabelto rename setattr unlink watch write }; allow lvm_t fixed_disk_device_t:chr_file { append create getattr ioctl link lock open read rename setattr unlink write }; allow mdadm_t fixed_disk_device_t:chr_file { append create getattr ioctl link lock open read rename setattr unlink write }; allow mkinitramfs_t fixed_disk_device_t:chr_file { getattr ioctl lock open read }; allow mon_local_test_t fixed_disk_device_t:chr_file { getattr ioctl lock open read }; allow mount_t fixed_disk_device_t:chr_file { append getattr ioctl lock open read write }; allow nagios_checkdisk_plugin_t fixed_disk_device_t:chr_file { getattr ioctl lock open read }; allow podman_t fixed_disk_device_t:chr_file { append ioctl lock open read write }; allow podman_user_t fixed_disk_device_t:chr_file { append ioctl lock open read write }; allow quota_t fixed_disk_device_t:chr_file { ioctl lock open read }; allow sanlock_t fixed_disk_device_t:chr_file { append getattr ioctl lock open read write }; allow sblim_gatherd_t fixed_disk_device_t:chr_file { getattr ioctl lock open read }; allow smbmount_t fixed_disk_device_t:chr_file { append getattr ioctl lock open read write }; allow systemd_generator_t fixed_disk_device_t:chr_file { append getattr ioctl lock open read write }; allow systemd_homework_t fixed_disk_device_t:chr_file { append getattr ioctl lock open read write }; allow systemd_logind_t fixed_disk_device_t:chr_file { getattr ioctl lock open read }; [ systemd_logind_get_bootloader ]:True allow systemd_tmpfiles_t device_node:chr_file { append create getattr ioctl link lock open read relabelfrom relabelto rename setattr unlink watch write }; allow tgtd_t fixed_disk_device_t:chr_file { append create getattr ioctl link lock open read rename setattr unlink write }; allow udev_t device_node:chr_file { append create getattr ioctl link lock open read relabelfrom relabelto rename setattr unlink watch write }; allow virsh_t fixed_disk_device_t:chr_file { getattr ioctl lock open read }; allow virtd_lxc_t fixed_disk_device_t:chr_file { append create ioctl link lock open read rename setattr unlink write }; allow virtd_t fixed_disk_device_t:chr_file { append create ioctl link lock open read rename setattr unlink write }; allow xm_t fixed_disk_device_t:chr_file { getattr ioctl lock open read }; -- My Main Blog http://etbe.coker.com.au/ My Documents Blog http://doc.coker.com.au/