Description of problem: Why is this using /tmp rather then /var/run/devkit for its temporary files? Users can much around in /tmp they can not in /var/run So tempfiles should be created in /var/run allow devicekit_disk_t tmp_t:dir { search read create mounton write getattr rmdir remove_name add_name }; allow devicekit_disk_t tmp_t:file { read write create unlink open }; Created a partition with palimsest to create these avc messages.
Should be fixed in DeviceKit-disks-004
While I did fix this "bug" please note that devkit-disks-daemon will spawn a number of tools (depending of file system type) etc. that in turn may use /tmp. What I'm trying to say is that it is extremely optimistic to think that denying access to /tmp is going to work. While it may work for simple tests it's just going to break some corner case either now or in the future.
That is fine, and I will give devicekit the ability to create files in /tmp, but we should not do this by default.