Received-SPF: pass (google.com: best guess record for domain of selinux-refpolicy-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
From:   Henrik Grindal Bakken <hgb@ifi.uio.no>
To:     <selinux-refpolicy@vger.kernel.org>
Subject: Re: [RFC] files: Make files_{relabel,manage}_non_security_types work on all file types
Organization: Sierra Fan Club
References: <20200117231500.59904-1-hgb@ifi.uio.no>
Date:   Sat, 18 Jan 2020 08:11:02 +0100
In-Reply-To: <20200117231500.59904-1-hgb@ifi.uio.no> (Henrik Grindal Bakken's
        message of "Sat, 18 Jan 2020 00:15:00 +0100")
Message-ID: <87v9p99r3t.fsf@cisco.com>
User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/26.2 (gnu/linux)
MIME-Version: 1.0
Content-Type: text/plain
Sender: selinux-refpolicy-owner@vger.kernel.org
Precedence: bulk

Henrik Grindal Bakken <hgb@ifi.uio.no> writes:

> From: Henrik Grindal Bakken <henribak@cisco.com>
>
> This is the same behavious as files_*_non_auth_types have.

The rationale for changing this is that the systemd-tmpfiles rules use
files_manage_non_security_files() (and ..._relabel_...), which doesn't
work well if you use tmpfiles for somewhat more exotic paths that the
standard setup.

An alternative to this approach is to change the rules in systemd.te for
systemd_tmpfiles_t, but it seems to me like this change would be more in
line with what's done for the similar interfaces.

-- 
Henrik Grindal Bakken <hgb@ifi.uio.no>
PGP ID: 8D436E52
Fingerprint: 131D 9590 F0CF 47EF 7963  02AF 9236 D25A 8D43 6E52