Skip to content

Commit 307c929

Browse files
committed
packaging: restore default label of /tmp/snap-private-tmp after instaling the selinux policy package
Signed-off-by: Maciej Borzecki <maciej.borzecki@canonical.com>
1 parent 3dabc4d commit 307c929

2 files changed

Lines changed: 8 additions & 0 deletions

File tree

packaging/fedora/snapd.spec

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1009,6 +1009,10 @@ fi
10091009
%post selinux
10101010
%selinux_modules_install %{_datadir}/selinux/packages/snappy.pp.bz2
10111011
%selinux_relabel_post
1012+
# Ensure the private tmp directory for snap-confine exists and has the correct
1013+
# SELinux label now that the policy module is loaded
1014+
install -d -m 0700 /tmp/snap-private-tmp
1015+
restorecon /tmp/snap-private-tmp || :
10121016

10131017
%posttrans selinux
10141018
%selinux_relabel_post

packaging/opensuse/snapd.spec

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -514,6 +514,10 @@ fi
514514

515515
%post selinux
516516
%selinux_modules_install -s %{selinuxtype} %{_datadir}/selinux/packages/snappy.pp.bz2
517+
# Ensure the private tmp directory for snap-confine exists and has the correct
518+
# SELinux label now that the policy module is loaded
519+
install -d -m 0700 /tmp/snap-private-tmp
520+
restorecon /tmp/snap-private-tmp || :
517521

518522
%preun selinux
519523
%selinux_relabel_pre -s %{selinuxtype}

0 commit comments

Comments
 (0)