problems with tmpfs and relabeling
Bill Nottingham
notting at redhat.com
Fri Apr 21 16:54:18 UTC 2006
Stephen Smalley (sds at tycho.nsa.gov) said:
> > > Do you expect them to follow the traditional
> > > inherit-from-parent-directory behavior you get from ext3?
> >
> > Yes.
>
> Yes, and that's ok. I think we just need to adjust policy to allow
> restorecon to fix the label on the root directory, and (on the separate
> issue of policy),
OK.
> we need a rw mount on /etc/selinux separate from the
> rest of root so that we can perform policy module operations.
I'm not as sure about this now that I understand how semodule
is supposed to work. If you're running a read-only system,
you shouldn't need to add or remove modules at runtime - that's
something you do when preparing the image to run read-only. That
only leaves listing modules, which I presume can be fixed to not
need write access?
Bill
More information about the fedora-selinux-list
mailing list