problems with tmpfs and relabeling
Bill Nottingham
notting at redhat.com
Tue Apr 18 18:41:34 UTC 2006
Stephen Smalley (sds at tycho.nsa.gov) said:
> > However, relabeling the files then fails - for each type that I'm
> > putting on tmpfs, I need to add:
> >
> > allow <type> tmpfs_t:filesystem associate;
> >
> > before relabelling works.
> >
> > This seems strange - is this something that should be fixed in
> > the stock policy, or should I just carry this in my own module?
>
> One option is to use a fscontext= mount option to change the security
> context associated with the filesystem/superblock object to match your
> usage, e.g. making it fs_t like a conventional filesystem rather than
> tmpfs_t. e.g.
> mount -o fscontext=system_u:object_r:fs_t:s0 ...
Considering this is scratch space that will be used just like
the 'stock' filesystem for various things (/var, /etc state
files, etc.), this seems to be the right solution. I'll try
this.
Bill
More information about the fedora-selinux-list
mailing list