/dev/shm - tmpfs_t or device_t ?

[Tom London]

Running latest Rawhide, targeted/enforcing.

I notice that if I run 'restorecon -v -R -n /dev' I get:
[root@localhost ~]# restorecon -v -R -n /dev
restorecon reset /dev/shm context
system_u:object_r:tmpfs_t:s0->system_u:object_r:device_t:s0
[root@localhost ~]#

but
[root@localhost ~]# ls -ldZ /dev/shm
drwxrwxrwt  root root system_u:object_r:tmpfs_t        /dev/shm
[root@localhost ~]#

Seems funny to me....  Is that right?

tom
-- 
Tom London

[NZzi]

Tom London wrote:
>  Running latest Rawhide, targeted/enforcing.
>  
>  I notice that if I run 'restorecon -v -R -n /dev' I get:
>  [root@localhost ~]# restorecon -v -R -n /dev
>  restorecon reset /dev/shm context
>  system_u:object_r:tmpfs_t:s0->system_u:object_r:device_t:s0
>  [root@localhost ~]#
>  
>  but
>  [root@localhost ~]# ls -ldZ /dev/shm
>  drwxrwxrwt  root root system_u:object_r:tmpfs_t        /dev/shm
>  [root@localhost ~]#
>  
>  Seems funny to me....  Is that right? 
i found your resorecon command run with "-n", that option means:

-n     don't change any file labels.

additionally, i found there are not any label in file_contexts,
so i think if there no type_transition rules in policy, the file
label should be inherited from his containing dir, i.e. device_t


>  
>  tom

[Daniel J Walsh]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Tom London wrote:
>  Running latest Rawhide, targeted/enforcing.
>  
>  I notice that if I run 'restorecon -v -R -n /dev' I get:
>  [root@localhost ~]# restorecon -v -R -n /dev
>  restorecon reset /dev/shm context
>  system_u:object_r:tmpfs_t:s0->system_u:object_r:device_t:s0
>  [root@localhost ~]#
>  
>  but
>  [root@localhost ~]# ls -ldZ /dev/shm
>  drwxrwxrwt  root root system_u:object_r:tmpfs_t        /dev/shm
>  [root@localhost ~]#
>  
>  Seems funny to me....  Is that right?
>  
>  tom 
Steven would be better at answering this then me.  But restorecon is
looking at the what matchpathcon tells it and it is tmpfs_t, but there
is actually a tmpfs_t file system moujnted here.  So we probably could
change the file context of the /dev/shm to tmpfs_t to stop restorecon
from trying to change it.
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.7 (GNU/Linux)
> Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org
>
> iD8DBQFGz/CErlYvE4MpobMRAqTUAJsHHXMdcSAO2bwJBxo0w/8uMb7pMgCfVkPm
> oZSX/oBX27YlNtnYgkaBVgs=
> =22pn
> -----END PGP SIGNATURE-----