tmpfs_t

[Russell Coker <russell@coker.com.au>]

I have been looking into using tmpfs as /tmp .

Currently tmpfs is labeled tmpfs_t and there is no policy for allowing file 
creation under it.  So I have experimented with labelling it as tmp_t and 
changing the tmp_domain() macro to have the following rule:
allow $1_tmp_t tmp_t:filesystem associate;

To do this properly I would also have to change every
allow whatever fs_t:filesystem getattr;
to:
allow whatever { fs_t tmp_t }:filesystem getattr;

Or should I instead leave the tmpfs filesystem labelled as tmpfs_t and add 
appropriate file_type_auto_trans() rules for it?

-- 
http://www.coker.com.au/selinux/   My NSA Security Enhanced Linux packages
http://www.coker.com.au/bonnie++/  Bonnie++ hard drive benchmark
http://www.coker.com.au/postal/    Postal SMTP/POP benchmark
http://www.coker.com.au/~russell/  My home page


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.