Relocate directories (e.g. tmp): how?

[S P Arif Sahari Wibowo]

Hi!

Is there any generic and straighforward way to adjust SELinux to 
allow a functional directories replaced by a symlink to other 
location?

For example, I have always been relocate the tmp and var 
directories in one separate volume (rapid changing content). 
Usually the volume will be mounted on /var and /tmp is a symlink 
to var/tmp. This arrangement has been working well for me until 
RHEL / CentOS 4. Then when I tried Fedora 8, this setup stop 
working: SELinux stop some program - e.g. Xorg and dhcp client - 
to work with this tmp symlink.

Is there a mechanism to tell SELinux to treat everything under 
/var/tmp the same as under /tmp?

Thanks!

-- 
                              (stephan paul) Arif Sahari Wibowo
    _____  _____  _____  _____
   /____  /____/ /____/ /____
  _____/ /      /    / _____/      http://www.arifsaha.com/

Xinnian Kuaile! 新年快樂 Gongxi Facai 恭喜發財

[Chris Adams]

Once upon a time, S P Arif Sahari Wibowo <arifsaha(a)yahoo.com&gt; said:
>  For example, I have always been relocate the tmp and var 
>  directories in one separate volume (rapid changing content). 
>  Usually the volume will be mounted on /var and /tmp is a symlink 
>  to var/tmp. This arrangement has been working well for me until 
>  RHEL / CentOS 4. Then when I tried Fedora 8, this setup stop 
>  working: SELinux stop some program - e.g. Xorg and dhcp client - 
>  to work with this tmp symlink. 
I hit this too; my solution was to bind mount /tmp onto /var/tmp.  My
/etc/fstab has:

/tmp	/var/tmp	none	bind

-- 
Chris Adams <cmadams(a)hiwaay.net&gt;
Systems and Network Administrator - HiWAAY Internet Services
I don't speak for anybody but myself - that's enough trouble.

[S P Arif Sahari Wibowo]

On Mon, 18 Feb 2008, Chris Adams wrote:
>  I hit this too; my solution was to bind mount /tmp onto 
>  /var/tmp.  My /etc/fstab has:
>  /tmp	/var/tmp	none	bind 
Thanks! I was thinking about this before but somehow my fstab 
configuration was incorrect. I copy yours and now it works 
nicely.

That said, I still interested in "SELinux solution". This one 
seems to be a work-around and SELinux may actually block it in 
the future.

Furthermore, there is a small inconvenience that if I boot from 
rescue CD, the tmp directory probably won't be mounted.

-- 
                              (stephan paul) Arif Sahari Wibowo
    _____  _____  _____  _____
   /____  /____/ /____/ /____
  _____/ /      /    / _____/      http://www.arifsaha.com/

Xinnian Kuaile! 新年快樂 Gongxi Facai 恭喜發財

[Daniel J Walsh]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

S P Arif Sahari Wibowo wrote:
>  On Mon, 18 Feb 2008, Chris Adams wrote:
> > I hit this too; my solution was to bind mount /tmp onto /var/tmp.  My
> > /etc/fstab has:
> > /tmp    /var/tmp    none    bind
>  
>  Thanks! I was thinking about this before but somehow my fstab
>  configuration was incorrect. I copy yours and now it works nicely.
>  
>  That said, I still interested in "SELinux solution". This one seems to
>  be a work-around and SELinux may actually block it in the future.
>  
>  Furthermore, there is a small inconvenience that if I boot from rescue
>  CD, the tmp directory probably won't be mounted.
>  
You can set up alternate labeling on directories using semanage fcontext

# semanage fcontext -a -t tmp_t '/mytmp(/.*)?'



>  
>  ------------------------------------------------------------------------
>  
>  --
>  fedora-selinux-list mailing list
>  fedora-selinux-list(a)redhat.com
>  https://www.redhat.com/mailman/listinfo/fedora-selinux-list 
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.8 (GNU/Linux)
> Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org
>
> iEYEARECAAYFAke8KOEACgkQrlYvE4MpobP11gCgs7wJUGhsYuZJjJUByQ4MYfaJ
> dukAmwU9uPq140jWVW/vTe9jBtIxETTc
> =RWCe
> -----END PGP SIGNATURE-----