I would like to propose some kind of consolidation of tmpfs_t and tmp_t

[Daniel J Walsh <dwalsh@redhat.com>]

[-- Attachment #1: Type: text/plain, Size: 1171 bytes --]

We are seeing a growing amount of bug reports on using the /tmp 
directory as a tmpfs_t file system.  Do we need to have
two separate types? Can I make the following change?
diff --exclude-from=exclude -N -u -r nsapolicy/macros/global_macros.te 
policy-1.23.4/macros/global_macros.te
--- nsapolicy/macros/global_macros.te   2005-03-24 08:58:29.000000000 -0500
+++ policy-1.23.4/macros/global_macros.te       2005-03-23 
12:36:36.000000000 -0500
@@ -418,8 +418,8 @@
 define(`tmp_domain', `
 type $1_tmp_t, file_type, sysadmfile, tmpfile $2;
 ifelse($3, `',
-`file_type_auto_trans($1_t, tmp_t, $1_tmp_t, `{ file dir }')',
-`file_type_auto_trans($1_t, tmp_t, $1_tmp_t, `$3')')
+`file_type_auto_trans($1_t, { tmpfs_t tmp_t }, $1_tmp_t, `{ file dir }')',
+`file_type_auto_trans($1_t, { tmpfs_t tmp_t }, $1_tmp_t, `$3')')
 ')

There are a few places where this conflicts such as apache where it 
calls tmpfs_domain.  But that looks
like
+`file_type_auto_trans($1_t, tmpfs_t, $1_tmpfs_t, `$3')')
Is there anything significant about this differenct.  Or can we just 
eliminate $1_tmpfs_t stuff?

Using mount -fscontext=tmp_t does not work because of other problems.


Dan

-- 



[-- Attachment #2: Re: using tmpfs for /tmp and selinux --]
[-- Type: message/rfc822, Size: 4919 bytes --]

From: Stephen Smalley <sds@tycho.nsa.gov>
To: "Fedora SELinux support list for users &amp;  developers." <fedora-selinux-list@redhat.com>
Subject: Re: using tmpfs for /tmp and selinux
Date: Thu, 24 Mar 2005 08:17:27 -0500
Message-ID: <1111670247.12486.5.camel@moss-spartans.epoch.ncsc.mil>

On Thu, 2005-03-24 at 08:43 +0100, dragoran wrote:
> doesn't seem to work:
> Mar 24 08:35:28 chello062178124144 kernel: audit(1111649728.433:0): 
> avc:  denied  { associate } for  pid=4574 exe=/usr/bin/gdm-binary 
> name=.ICE-unix scontext=user_u:object_r:tmp_t 
> tcontext=system_u:object_r:tmp_t tclass=filesystem
> Mar 24 08:35:28 chello062178124144 kernel: audit(1111649728.433:0): 
> avc:  denied  { associate } for  pid=4574 exe=/usr/bin/gdm-binary 
> name=.X11-unix scontext=user_u:object_r:tmp_t 
> tcontext=system_u:object_r:tmp_t tclass=filesystem
> Mar 24 08:35:28 chello062178124144 kernel: audit(1111649728.433:0): 
> avc:  denied  { associate } for  pid=4574 exe=/usr/bin/gdm-binary 
> name=.X11-unix scontext=user_u:object_r:tmp_t 
> tcontext=system_u:object_r:tmp_t tclass=filesystem
> Mar 24 08:35:31 chello062178124144 kernel: audit(1111649731.447:0): 
> avc:  denied  { associate } for  pid=5340 exe=/usr/X11R6/bin/Xorg 
> name=.tX0-lock scontext=user_u:object_r:tmp_t 
> tcontext=system_u:object_r:tmp_t tclass=filesystem

Ah, yes - you would need policy changes as well, e.g.
	allow tmpfile tmp_t:filesystem associate;

-- 
Stephen Smalley <sds@tycho.nsa.gov>
National Security Agency

--
fedora-selinux-list mailing list
fedora-selinux-list@redhat.com
http://www.redhat.com/mailman/listinfo/fedora-selinux-list