you mean on /dev, i presume?
yep, or /udev (configured in the udev config file)
well i had to patch selinux/hooks.c to allow this [on a tmpfs] by relaxing the criteria of the "fscontext=" option for mount.
if its tmpfs, this would void the requirement of passing a mount option fscontext, udev would set the correct context when started up (a check could also be added to do this only if the mount point is /dev and its tmpfs... *shrug*)
otherwise it's not _possible_ t set the context on /dev as it is mounted [on a tmpfs].
[if /dev was a persistent filesystem everything would be hunky-dory and this wouldn't be an issue].
*nod*
with that in mind, it's more that because you're putting device inodes into a non-persistent filesystem, you end up getting the "default" rules and so you must "restore" the contexts, or you must patch udev to "understand" the contents of /etc/selinux/src/file_contexts/file_contexts (using matchpathcon() and setfscreatecon() from libselinux) such that it will create inodes with the right file context.
I applied the patch to tmpfs to make it store xattr attributes which i found on the mailing list, seems your patch forgets xattr.h?
I also applied the patch which adds "matchpathcon()" & "setfscreatecon()" support, and modified udev to set the correct context of its root_path on startup.
... but that's not how udev works: it deletes and creates inodes on demand; nothing exists at boot-time, it's all created on-demand.
at boot time i have about 5 devices in /dev with correct contexts set, udev them mounts tmpfs over this, WorksForMe(tm)
so in actual fact we do need matchpathcon() & setfscreatecon(), if its a persistent or non-persistent filesystem
so, not only must udev be patched to restore contexts but also the policies and various hacks added to "cope" with /dev being incredibly basic at startup - prior to udev running.
i have a simple persistent /dev which is used before udev runs, udev is then initialized, mounts a tmpfs over /dev (and restores its context) just after sysctl -p is run in my initscripts so its basically one of the first things to run. Seeing as my initial /dev is on a persistent filesystem i don't have a problem with pre-udev stuff running.
_including_ dealing with getting the contexts correct on entries in /.dev [the old /dev remounted with mount --rbind]
l.