Gentoo Archives: gentoo-hardened

From: Mike Edenfield <kutulu@××××××.org>
To: gentoo-hardened@l.g.o
Subject: Re: [gentoo-hardened] SELinux policy problems -> no policy for "/dev/console", "/dev/tty0", etc...
Date: Sun, 29 Mar 2009 14:31:00
Message-Id: 49CF861E.3040300@kutulu.org
In Reply to: [gentoo-hardened] SELinux policy problems -> no policy for "/dev/console", "/dev/tty0", etc... by "Dominik J. Fischer"
1 Dominik J. Fischer wrote:
2
3 > Obviously, the SELinux base policy even does not provide rules for those
4 > devices initialized at bootup.
5
6 Assuming these are *only* happening when you first boot up,
7 and don't continue to happen, these errors are mostly harmless.
8
9 They are happening during the boot process, prior to having
10 udev up and the /dev partition populated correctly. Before
11 that, your /dev nodes are mislabeled, so the boot scripts
12 attempts to write to /dev/console, /dev/null, etc. are
13 generating errors. The only device *needed* for Gentoo to
14 boot before udev is running is /dev/null, which you can fix
15 by doing this:
16
17 # mkdir /mnt/fakeroot
18 # mount -o bind / /fakeroot
19 # cd /fakeroot/dev
20 # setfiles -r /fakeroot \
21 /etc/selinux/strict/contexts/files/file_contexts \
22 .
23 # cd /
24 # umount /fakeroot
25
26 You will probably still get a few audit messages (about
27 /dev/console) but its nothing that is required for Gentoo to
28 boot.
29
30 --Mike