[HEADS-UP] Moving /var/run and /var/lock to tmpfs in Rawhide
Daniel J Walsh
dwalsh at redhat.com
Tue Nov 23 21:41:10 UTC 2010
-----BEGIN PGP SIGNED MESSAGE-----
On 11/23/2010 04:26 PM, Lennart Poettering wrote:
> On Tue, 23.11.10 21:19, Paul Howarth (paul at city-fan.org) wrote:
>> On Tue, 23 Nov 2010 21:48:30 +0100
>> Lennart Poettering <mzerqung at 0pointer.de> wrote:
>>> - In some cases daemons might want to create more than one file/dir
>>> below /var/run which are supposed to be labelled differently. In
>>> this case the daemon can either be modified to fix its labels up
>>> itself, or a drop-in file in /etc/tmpfiles.d/ might help (see below).
>> Given that the tmpfiles.d format doesn't mention SELinux contexts, I
>> assume that the files/directories will be set up to have whatever their
>> default context would be under the running policy, as restorecon would
>> set it?
> Yes, SELinux contexts are exclusively configured in the policy, we do
> not spread that around in other ocnfiguration files.
> The tmpfiles stuff includes an implicit restorecon, basically.
And we do not want these labels leaking out into config files. Since
there are multiple policies. For example.
/var/run/BLAH might have different labels in MLS policy versus Targeted.
And some of our partners ship their own policies.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
-----END PGP SIGNATURE-----
More information about the devel