diff --git a/policy/modules/kernel/devices.te b/policy/modules/kernel/devices.te index c4c843bd..757f11ed 100644 --- a/policy/modules/kernel/devices.te +++ b/policy/modules/kernel/devices.te @@ -291,13 +291,13 @@ mls_trusted_object(zero_device_t) # Rules for all device nodes # +allow device_node device_t:filesystem associate; + fs_associate(device_node) fs_associate_tmpfs(device_node) files_associate_tmp(device_node) -allow device_node device_t:filesystem associate; - ######################################## # # Unconfined access to this module diff --git a/policy/modules/system/mount.te b/policy/modules/system/mount.te index 280a5341..b302d6f7 100644 --- a/policy/modules/system/mount.te +++ b/policy/modules/system/mount.te @@ -59,7 +59,6 @@ dev_rw_lvm_control(mount_t) dev_dontaudit_getattr_all_chr_files(mount_t) dev_dontaudit_getattr_memory_dev(mount_t) dev_getattr_sound_dev(mount_t) - # Early devtmpfs, before udev relabel dev_dontaudit_rw_generic_chr_files(mount_t)