problems with tmpfs and relabeling

Bill Nottingham notting at
Fri Apr 21 16:54:18 UTC 2006

Stephen Smalley (sds at said: 
> > > Do you expect them to follow the traditional
> > > inherit-from-parent-directory behavior you get from ext3?  
> > 
> > Yes.
> Yes, and that's ok.  I think we just need to adjust policy to allow
> restorecon to fix the label on the root directory, and (on the separate
> issue of policy),


> we need a rw mount on /etc/selinux separate from the
> rest of root so that we can perform policy module operations.

I'm not as sure about this now that I understand how semodule
is supposed to work. If you're running a read-only system,
you shouldn't need to add or remove modules at runtime - that's
something you do when preparing the image to run read-only. That
only leaves listing modules, which I presume can be fixed to not
need write access?


More information about the fedora-selinux-list mailing list