Red Hat Bugzilla – Bug 160276
fontconfig global user cache should be in its own directory
Last modified: 2007-11-30 17:11:07 EST
From Bugzilla Helper: User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.8) Gecko/20050524 Fedora/1.0.4-4 Firefox/1.0.4 Description of problem: The font cache is creating problems on a SElinux strict system, since it is located at $HOME. Since the file is created in the libfontconfig library, it is difficult to label properly without placing SELinux code in the library, which is not desirable. So, can the font cache on Fedora please be moved to $HOME/.fonts/auto or somewhere else, where it is in a directory by itself. We can then create that directory ahead of time by some mechanism, label it properly, and it will work fine on a SELinux strict system. Currently we create a bunch of those directories with a profile script, but that's an ugly solution, and we'll likely change that. One way or the other, however, the font cache should be moved to its own directory - it should not clutter up $HOME. Please see <cache> in fonts.conf. Version-Release number of selected component (if applicable): fontconfig-2.2.3-13 How reproducible: Didn't try Additional info:
By font cache I am referring to the per user cache, automatically managed by libfontconfig.
What is the status of this bug? SELinux strict policy currently requires that the font cache be moved to work properly. Without this change, programs are not allowed to read or write the font cache.
Ivan, would it be enough to add <cache>~/.fonts/local.cache</cache> to /etc/fonts/fonts.conf ?
It needs to be a directory by itself, or it can't get auto-labeled properly. If you put it in .fonts, SElinux can't tell it apart from other files in there (fonts?). If it goes in a subdirectory, we can create the subdirectory ahead of time, and label it as the font cache directory. Then programs can be granted the right to write to the font cache directory, but not the right to write to fonts. Steven, does this sound right? I'm not sure if it's okay or not to let programs write to .fonts, but I'm pretty sure we don't want to let random programs write to $HOME just to make use of this cache.
Okay so we'll just need to create a ~/.fc-cache or something and throw it there.
Hi Ivan, This should be fixed in tomorrow's rawhide, I think. It is now stored in ~/.rh-fontconfig/fonts.cache-2