initscripts/devpts.sh: fix context for /dev/pts

From: Wenzong Fan <[email protected]>

devpts use file_use_trans to allocate security contexts. As there are no range_trans rules for initrc_t mounting devpts, the security level of mountpoint will be derived from the initrc process, to be systemhigh (s15:c0.c1023), instead of expected systemlow(s0).

This will block login shells to search PTYs, so use restorecon to fix this.

The following changes since commit 368f65a475069ed384d82be09c2515fb765e22ec:

initscripts/checkroot.sh: restore file contexts for /run (2014-05-09 08:59:54 -0400)

are available in the git repository at:

git://git.pokylinux.org/poky-contrib wenzong/fix-pts
http://git.pokylinux.org/cgit.cgi/poky-contrib/log/?h=wenzong/fix-pts

Wenzong Fan (2):
initscripts: add a local copy of devpts.sh
initscripts/devpts.sh: fix context for /dev/pts

 recipes-core/initscripts/initscripts/devpts.sh    |   29 +++++++++++++++++++++
 recipes-core/initscripts/initscripts_1.0.bbappend |    2 ++
 2 files changed, 31 insertions(+)
 create mode 100755 recipes-core/initscripts/initscripts/devpts.sh

1.7.9.5

From: Wenzong Fan <[email protected]>

Start point to make SELinux specific changes in devpts.sh, copied from oe-core layer.

---
 recipes-core/initscripts/initscripts/devpts.sh    |   28 +++++++++++++++++++++
 recipes-core/initscripts/initscripts_1.0.bbappend |    2 ++
 2 files changed, 30 insertions(+)
 create mode 100755 recipes-core/initscripts/initscripts/devpts.sh

new file mode 100755
index 0000000..c6043fb
@@ -0,0 +1,28 @@
+#!/bin/sh
+### BEGIN INIT INFO
+# Provides:          devpts
+# Required-Start: udev
+# Required-Stop:
+# Default-Start:     S
+# Default-Stop:
+# Short-Description: Mount /dev/pts file systems.
+### END INIT INFO
+
+. /etc/default/devpts
+
+if grep -q devpts /proc/filesystems
+then
+	#
+	#	Create multiplexor device.
+	#
+	test -c /dev/ptmx || mknod -m 666 /dev/ptmx c 5 2
+
+	#
+	#	Mount /dev/pts if needed.
+	#
+	if ! grep -q devpts /proc/mounts
+	then
+		mkdir -p /dev/pts
+		mount -t devpts devpts /dev/pts -ogid=${TTYGRP},mode=${TTYMODE}
+	fi
+fi

index 367cd6b..462db6f 100644
@@ -1,5 +1,7 @@
 PR .= ".3"
 
+FILESEXTRAPATHS_prepend := "${THISDIR}/${PN}:"
+
 do_install_append () {
 	cat <<-EOF >> ${D}${sysconfdir}/init.d/populate-volatile.sh
 touch /var/log/lastlog

1.7.9.5

From: Wenzong Fan <[email protected]>

devpts use file_use_trans to allocate security contexts. As there are no range_trans rules for initrc_t mounting devpts, the security level of mountpoint will be derived from the initrc process, to be systemhigh (s15:c0.c1023), instead of expected systemlow(s0).

This will block login shells to search PTYs, so use restorecon to fix this.

---
 recipes-core/initscripts/initscripts/devpts.sh |    1 +
 1 file changed, 1 insertion(+)

index c6043fb..a0b037f 100755
@@ -24,5 +24,6 @@ then
 	then
 		mkdir -p /dev/pts
 		mount -t devpts devpts /dev/pts -ogid=${TTYGRP},mode=${TTYMODE}
+		test ! -x /sbin/restorecon || /sbin/restorecon -F /dev/pts
 	fi
 fi

1.7.9.5

Merged, thanks. :)

- Pascal