Description of problem: fixfiles can do a number of operations, including deleting content in /tmp and relabeling files in /var/tmp. Unfortunately the tool is not polyinstantiation aware, which causes issues when used in that context: - /tmp-inst (or similar, as configured in /etc/security/namespace.conf) is not cleaned up fullrelabel() { echo "Cleaning out /tmp" find /tmp/ -mindepth 1 -delete restore Relabel } - /var/tmp/tmp-inst (or similar) is not relabeled properly find /var/tmp \( -context "*:${UNLABELED}*" -o -context "*:${UNDEFINED}*" \) -exec chcon --no-dereference --reference /var/tmp {} \; Please implement this functionality. Note that the target directories (/tmp-inst and /var/tmp/tmp-inst) are to be read from /etc/security/namespace.conf (and /etc/security/namespace.d/*) and not hardcoded. Version-Release number of selected component (if applicable): policycoreutils-2.9-9.el8.x86_64
(In reply to Renaud Métrich from comment #0) > Description of problem: > > fixfiles can do a number of operations, including deleting content in /tmp > and relabeling files in /var/tmp. > Unfortunately the tool is not polyinstantiation aware, which causes issues > when used in that content: > - /tmp-inst (or similar, as configured in /etc/security/namespace.conf) is > not cleaned up > > fullrelabel() { > echo "Cleaning out /tmp" > find /tmp/ -mindepth 1 -delete > restore Relabel > } > > > - /var/tmp/tmp-inst (or similar) is not relabeled properly > > find /var/tmp \( -context "*:${UNLABELED}*" -o -context > "*:${UNDEFINED}*" \) -exec chcon --no-dereference --reference /var/tmp {} \; > There's an inconsistency between policy and default namespace.conf https://bugzilla.redhat.com/show_bug.cgi?id=1934444 For non-standard directories, I'd suggest to use equivalence to avoid unlabeled files: # semanage fcontext -a -e /var/tmp /var/tmp-inst > Please implement this functionality. Note that the target directories > (/tmp-inst and /var/tmp/tmp-inst) are to be read from > /etc/security/namespace.conf (and /etc/security/namespace.d/*) and not > hardcoded. > It would mean to implement parser of namespace.conf and also pam configuration parses to detect whether pam_namespace is in use. If it's possible please consider using tmpfiles.d - Configuration for creation, deletion and cleaning of volatile and temporary files, see 'man tmpfiles.d' for cleaning tmp directories. > Version-Release number of selected component (if applicable): > > policycoreutils-2.9-9.el8.x86_64