# [SOLVED] SELinux -> Relabel /dev don't work

## InteRadek

When I relabel /dev according to the Handbook:

```
# mkdir /mnt/gentoo

# mount -o bind / /mnt/gentoo

# setfiles -r /mnt/gentoo /etc/selinux/{strict,targeted}/contexts/files/file_contexts /mnt/gentoo/dev

# umount /mnt/gentoo

```

after mount dev is relabeled properly at /mnt/gentoo/dev , but remains unlabeled_t at / , so after umount /mnt/gentoo it is unlabeled. After second mount /mnt/gentoo/dev is still properly labeled with device_t.

At boot I get a lot of messages:

```
restorecon set context /dev/xxx->system_u:object_r:device_t failed:'Operation not supported'

udev-work[xxxx]: setfilecon /dev/xxx failed: Operation not supported
```

Is there any other way to relabel /dev ?

Another strange thing is line:

```
FEATURES variable contains unknown value(s): loadpolicy
```

at any use of emerge.Last edited by InteRadek on Thu Jan 27, 2011 12:23 pm; edited 1 time in total

----------

## InteRadek

It seems, that only Gentoo doesn't see /dev labeling. After mounting EXT3 partition in OpenSUSE, /dev partition in labeled properly.

emerge --info

 *Quote:*   

> Portage 2.1.9.25 (selinux/2007.0/amd64, gcc-4.4.4, glibc-2.11.2-r3, 2.6.36-gentoo-r5 x86_64)
> 
> =================================================================
> 
> System uname: Linux-2.6.36-gentoo-r5-x86_64-Intel-R-_Core-TM-_i3_CPU_M_350_@_2.27GHz-with-gentoo-1.12.14
> ...

 

----------

## tcbounce

I see the same regarding gentoo and the loadpolicy feature being no longer available.

It appears the targeted profile doesn't work in Gentoo. I'm using newer ebuilds for selinux. The reference policy is ancient on Gentoo.

I'm using the latest reference policy from treosys which are *meant* to maintain it to support gentoo.

Fedora seems to do selinux best but I'm a gentoo nutter since way back. I'm going to get into this more as I gear up my selinux for production.

I suggest you add the hardeded-development overlay using layman -a hardened-development and start working at least with that.

There is another private overlay you can add manually too which has some improvements.

It's work in progress for me too. Keep sharing your thoughts  :Smile: 

----------

## InteRadek

Finally I found a solution by comparing kernel config with my other computer, which has SELinux working for about a year.

Problem was in "Device Drivers ---> Generic Driver Options ---> Maintain a devtmpfs filesystem to mount at /dev":

```
CONFIG_DEVTMPFS=y
```

after changing to:

```
CONFIG_DEVTPMFS is not set
```

problem is gone. [SOLVED]

----------

