Tmpfs

[Ivan Gyurdiev]

What's the situation with tmpfs? I have /tmp on tmpfs and I get lots of
denials. Tmpfs doesn't seem to support xattrs, however..

SELinux: initialized (dev tmpfs, type tmpfs), uses transition SIDs
SELinux: initialized (dev tmpfs, type tmpfs), uses transition SIDs
SELinux: initialized (dev tmpfs, type tmpfs), uses transition SIDs

Is /tmp on tmpfs something that should work, or is this not supported?
What about /dev on tmpfs (or /udev)?

[Russell Coker]

On Tue, 6 Jul 2004 11:50, Ivan Gyurdiev <ivg2(a)cornell.edu&gt; wrote:
>  What's the situation with tmpfs? I have /tmp on tmpfs and I get
> lots of
>  denials. Tmpfs doesn't seem to support xattrs, however..
>
>  SELinux: initialized (dev tmpfs, type tmpfs), uses transition SIDs
>  SELinux: initialized (dev tmpfs, type tmpfs), uses transition SIDs
>  SELinux: initialized (dev tmpfs, type tmpfs), uses transition SIDs
>
>  Is /tmp on tmpfs something that should work, or is this not supported?
>  What about /dev on tmpfs (or /udev)? 
Making /dev on tmpfs should work.  /tmp on tmpfs will not work properly 
because it's labelled as tmpfs_t (which is also used for SysV shared memory).
See the following URL for more discussion of this issue:

http://marc.theaimsgroup.com/?l=selinux&m=104438419029394&w=2

-- 
http://www.coker.com.au/selinux/   My NSA Security Enhanced Linux packages
http://www.coker.com.au/bonnie++/  Bonnie++ hard drive benchmark
http://www.coker.com.au/postal/    Postal SMTP/POP benchmark
http://www.coker.com.au/~russell/  My home page

[Stephen Smalley]

On Mon, 2004-07-05 at 21:50, Ivan Gyurdiev wrote:
>  What's the situation with tmpfs? I have /tmp on tmpfs and I get
> lots of
>  denials. Tmpfs doesn't seem to support xattrs, however..
>  
>  SELinux: initialized (dev tmpfs, type tmpfs), uses transition SIDs
>  SELinux: initialized (dev tmpfs, type tmpfs), uses transition SIDs
>  SELinux: initialized (dev tmpfs, type tmpfs), uses transition SIDs
>  
>  Is /tmp on tmpfs something that should work, or is this not supported?
>  What about /dev on tmpfs (or /udev)? 
tmpfs lacks a fake xattr handler at present, unlike devpts, so userspace
cannot get or set contexts on tmpfs.  However, transition SIDs should be
fine for tmp file creation in most cases, but this requires policy
changes, and introduces a problem if you want to be able to distinguish
the tmpfs mount used for shared memory from your /tmp tmpfs mount.  You
can use the context= mount option to assign a single context for a given
mount and override the default behavior, but that doesn't really help
here.

-- 
Stephen Smalley <sds(a)epoch.ncsc.mil&gt;
National Security Agency