A TOCTOU (Time-of-Check-Time-of-Use) race condition was found in the fixfiles script in the policycoreutils package. The vulnerable code used 'find' to locate unlabeled files under /tmp, /var/tmp, /var/run, and /var/lib/debug, then passed those pathnames to 'chcon' to change their SELinux context. Between the time 'find' identified a file and 'chcon' operated on it, a local attacker could use renameat2(RENAME_EXCHANGE) to atomically swap a directory component with a symlink pointing to a sensitive system directory (e.g., /etc). This caused 'chcon' to resolve the path through the symlink and modify SELinux labels on arbitrary files, such as relabeling /etc/shadow to tmp_t.

The vulnerable code was in the restore() function's default case block (case "*)"), which executed during both 'fixfiles relabel' and 'fixfiles restore' commands. The find commands searched for files with unlabeled_t or undefined context types and invoked 'chcon --no-dereference --reference /tmp' on their pathnames. The --no-dereference flag only prevents dereferencing of the final path component; intermediate symlinks in the path are still followed by the kernel during resolution.

The fix removes the entire /tmp cleanup code path, as the upstream maintainer determined it was unnecessary on modern systems where /tmp is typically a tmpfs that cannot have lingering unlabeled files from a prior SELinux-disabled boot.

Upstream fix commit: a556538c2d5d2583273e025b45c02651fef47679 (merged July 16, 2026).

Reported by Stephen Smalley (upstream SELinux maintainer).