Re: [PATCH userspace] fixfiles: do not exclude /dev and /run in -C mode

[Petr Lautrbach <plautrba@redhat.com>]

Ondrej Mosnacek <omosnace@redhat.com> writes:

> I can't think of a good reason why they should be excluded. On the
> contrary, excluding them can cause trouble very easily if some labeling
> rules for these directories change. For example, we changed the label
> for /dev/nvme* from nvme_device_t to fixed_disk_device_t in Fedora
> (updating the allow rules accordingly) and after policy update they
> ended up with an invalid context, causing denials.
>
> Thus, remove /dev and /run from the excludes. While there, also add
> /root to the basic excludes to match the regex that excludes fc rules
> (that should be effectively no functional change).
>
> I did a sanity check on my system by running `restorecon -nv /dev /run`
> and it didn't report any label differences.
>
> Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
>

Acked-by: Petr Lautrbach <plautrba@redhat.com>


> ---
>  policycoreutils/scripts/fixfiles | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/policycoreutils/scripts/fixfiles b/policycoreutils/scripts/fixfiles
> index 30dadb4f..6fb12e04 100755
> --- a/policycoreutils/scripts/fixfiles
> +++ b/policycoreutils/scripts/fixfiles
> @@ -162,7 +162,7 @@ newer() {
>  #
>  diff_filecontext() {
>  EXCLUDEDIRS="`exclude_dirs_from_relabelling`"
> -for i in /sys /proc /dev /run /mnt /var/tmp /var/lib/BackupPC /home /tmp /dev; do
> +for i in /sys /proc /mnt /var/tmp /var/lib/BackupPC /home /root /tmp; do
>      [ -e $i ]  && EXCLUDEDIRS="${EXCLUDEDIRS} -e $i";
>  done
>  LogExcluded
> @@ -175,7 +175,7 @@ if [ -f ${PREFC} -a -x /usr/bin/diff ]; then
>  	sed -r -e 's,:s0, ,g' $FC | sort -u | \
>  	/usr/bin/diff -b ${PREFCTEMPFILE} - | \
>  	    grep '^[<>]'|cut -c3-| grep ^/ | \
> -	    egrep -v '(^/home|^/root|^/tmp|^/dev)' |\
> +	    egrep -v '(^/home|^/root|^/tmp)' |\
>  	sed -r -e 's,[[:blank:]].*,,g' \
>  	       -e 's|\(([/[:alnum:]]+)\)\?|{\1,}|g' \
>  	       -e 's|([/[:alnum:]])\?|{\1,}|g' \
> -- 
> 2.29.2