Red Hat Bugzilla – Bug 504719
/dev/pts/ptmx created with improper SELinux context....
Last modified: 2011-10-12 13:50:44 EDT
Description of problem:
[root@tlondon etc]# restorecon -v -R -n /dev
restorecon reset /dev/pts/ptmx context system_u:object_r:devpts_t:s0->system_u:object_r:ptmx_t:s0
Version-Release number of selected component (if applicable):
Steps to Reproduce:
This bug appears to have been reported against 'rawhide' during the Fedora 11 development cycle.
Changing version to '11'.
More information and reason for this action is here:
I'm not seeing this with the same version of MAKEDEV. I believe the problem existed in selinux-policy-targeted, though, and that has since been updated. If you are still experiencing problems with the latest policy packages installed, feel free to reopen this bug report.
I'm seeing this on a real box (x86_64) running Fedora 15, as well as on two virtual machines (i686 and x86_64) running Rawhide. On Fedora 15, I have:
and the Rawhide machines are updated daily.
Jerry how are you getting this to happen?
I have no idea. After booting my machines, I see the incorrect label. I have the following machines:
1. Host: x86_64. Originally installed F-14 on it, then upgraded it to F-15 using the DVD.
2. Guest 1: x86_64. Originally installed F-15 Beta, then upgraded it to Rawhide with yum + package-cleanup when F-15 was released.
3. Guest 2: i686. Otherwise identical to guest 1.
All 3 machines are updated with yum each weekday. I need to check whether this happens on my home machine, which was a clean install of F-15 (x86_64). I'll try to remember to do that tonight.
Ok I see this on my machine also running rawhide.
I think this might be a kernel issue, if the kernel is creating the device.
Eric ptmx gets created with the /dev/pts file system is mounted. The problem is the device gets created with the wrong label.
kernel_t device_t :chr_file ptmx_t
kernel_t devpts_t :chr_file ptmx_t
sysadm_t device_t :chr_file ptmx_t
sysadm_t devpts_t :chr_file ptmx_t
unconfined_t device_t :chr_file ptmx_t
unconfined_t devpts_t :chr_file ptmx_t
Is written in policy.
Since a few days ago, restorecon in Rawhide thinks that /dev/pts/ptmx should have type devpts_t. Is that right? The ptmx_t definition is still in /usr/share/selinux/devel/include/kernel/terminal.if.
In any case, I still see the wrong label on my F-15 host machine on bootup.
Yes we have changed it to devpts_t since we can not seem to get it to be labeled as ptmx_t, and we are not even sure it should be.
Have not back ported this fix to F15. But it really does not matter. Since nothing should be being denied.
Fixed in the current release of selinux-policy on F16/F17