From 190a184feaeacf94a527c2a49babbf1ae8015e65 Mon Sep 17 00:00:00 2001 From: Maciej Borzecki Date: Thu, 23 Jul 2026 17:00:59 +0200 Subject: [PATCH 1/3] data/selinux: assign a default label for /tmp/snap-private-tmp Signed-off-by: Maciej Borzecki --- data/selinux/snappy.fc | 2 ++ 1 file changed, 2 insertions(+) diff --git a/data/selinux/snappy.fc b/data/selinux/snappy.fc index 2924894d1fb..957980f5c0a 100644 --- a/data/selinux/snappy.fc +++ b/data/selinux/snappy.fc @@ -44,6 +44,8 @@ ifdef(`distro_debian',` /lib/systemd/system/snapd.* -- gen_context(system_u:object_r:snappy_unit_file_t,s0) ') +/tmp/snap-private-tmp -d gen_context(system_u:object_r:snappy_tmp_t,s0) + /var/run/snapd(/.*)? gen_context(system_u:object_r:snappy_var_run_t,s0) /var/run/snapd\.socket -s gen_context(system_u:object_r:snappy_var_run_t,s0) /var/run/snapd-snap\.socket -s gen_context(system_u:object_r:snappy_var_run_t,s0) From ad77936edcad43bd11e9e33cc59f1d4862b8b72b Mon Sep 17 00:00:00 2001 From: Maciej Borzecki Date: Thu, 23 Jul 2026 17:01:22 +0200 Subject: [PATCH 2/3] packaging: restore default label of /tmp/snap-private-tmp after instaling the selinux policy package Signed-off-by: Maciej Borzecki --- packaging/fedora/snapd.spec | 4 ++++ packaging/opensuse/snapd.spec | 4 ++++ 2 files changed, 8 insertions(+) diff --git a/packaging/fedora/snapd.spec b/packaging/fedora/snapd.spec index e6f4321f9da..573438174cd 100644 --- a/packaging/fedora/snapd.spec +++ b/packaging/fedora/snapd.spec @@ -1009,6 +1009,10 @@ fi %post selinux %selinux_modules_install %{_datadir}/selinux/packages/snappy.pp.bz2 %selinux_relabel_post +# Ensure the private tmp directory for snap-confine exists and has the correct +# SELinux label now that the policy module is loaded +install -d -m 0700 /tmp/snap-private-tmp +restorecon /tmp/snap-private-tmp || : %posttrans selinux %selinux_relabel_post diff --git a/packaging/opensuse/snapd.spec b/packaging/opensuse/snapd.spec index b9b0b3c6d99..88ba7bc9fb0 100644 --- a/packaging/opensuse/snapd.spec +++ b/packaging/opensuse/snapd.spec @@ -514,6 +514,10 @@ fi %post selinux %selinux_modules_install -s %{selinuxtype} %{_datadir}/selinux/packages/snappy.pp.bz2 +# Ensure the private tmp directory for snap-confine exists and has the correct +# SELinux label now that the policy module is loaded +install -d -m 0700 /tmp/snap-private-tmp +restorecon /tmp/snap-private-tmp || : %preun selinux %selinux_relabel_pre -s %{selinuxtype} From 299a253dce20036cfb1f408e6409d186f5f071fa Mon Sep 17 00:00:00 2001 From: Maciej Borzecki Date: Thu, 23 Jul 2026 17:13:20 +0200 Subject: [PATCH 3/3] data/selinux: allow the snap command to probe for /tmp/snap-private-tmp presence Signed-off-by: Maciej Borzecki --- data/selinux/snappy.te | 2 ++ 1 file changed, 2 insertions(+) diff --git a/data/selinux/snappy.te b/data/selinux/snappy.te index ccf81cfb9be..93860ce82ce 100644 --- a/data/selinux/snappy.te +++ b/data/selinux/snappy.te @@ -873,6 +873,8 @@ snappy_stream_connect(snappy_cli_t) userdom_search_user_tmp_dirs(snappy_cli_t) # create /run/user//snap. directories userdom_manage_tmp_dirs(snappy_cli_t) +# the snap command probes for /tmp/snap-private-tmp presence +allow snappy_cli_t snappy_tmp_t:dir getattr; # allow snappy_cli_t to exec() into the snapd binary which implements # snap CLI handler and other internal snapd tools