Re: tmpfs_t

[Russell Coker <russell@coker.com.au>]

On Mon, 27 Jan 2003 14:20, Stephen D. Smalley wrote:
> The problem is that tmpfs is also used for the kernel internal mount
> for System V shared memory and shared anonymous mappings.  The current
> fs_use configuration and the existing $1_tmpfs_t types and rules are
> oriented toward that usage of tmpfs.  Distinguishing different instances
> of tmpfs mounts and providing different labeling behaviors and contexts
> for those different instances would require further changes to SELinux.

I believe that changes are required.

For UML and busy Apache servers using tmpfs as /tmp is common practise.  The 
current SE Linux setup will force many of the people who run big servers to 
change their operation in a way that will hurt performance to support running 
SE Linux.

I've experimented with using chcon to set the type after mounting which seems 
to work OK.

I believe that the best option is to label the root inode of tmpfs as 
system_u:object_r:tmp_t via initial_sid_contexts.  I've been looking at the 
kernel code, is superblock_doinit() the right place to do a change?

-- 
http://www.coker.com.au/selinux/   My NSA Security Enhanced Linux packages
http://www.coker.com.au/bonnie++/  Bonnie++ hard drive benchmark
http://www.coker.com.au/postal/    Postal SMTP/POP benchmark
http://www.coker.com.au/~russell/  My home page


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.