Spurious writes to /tmp

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hello,

I'm in the process of setting up a CentOS 5 installation, which ships
with a tightened SELinux policy. APC is installed and working well,
however I notice that on any access to a PHP script - or, confusingly,
any CGI script also - these warnings are generated:

avc: denied { read, write } for comm="test.sh" dev=dm-0 egid=48 euid=48
exe="/bin/bash" exit=0 fsgid=48 fsuid=48 gid=48 items=0
name=".apc.ZEAkwD"

Elaborated by sealert:

Source Context                user_u:system_r:httpd_sys_script_t
Target Context                user_u:object_r:httpd_tmp_t
Target Objects                /tmp/.apc.Yv21vf (deleted) [ file ]

The "error" occurs because SELinux is configured to disallow CGI scripts
write access to /tmp, which is fine - I can fix that if it's desirable
later. Two questions:

1) Why are these files created? My apc.ini specifies this:
    apc.mmap_file_mask=/var/cache/apc/apc.XXXXXX

   I assume mkstemp() is directing something towards /tmp but I'm not
   sure why. If there's a need to generate temporary files then that's
   fine, but it would be really nice to have an option to redirect them
   elsewhere. Giving CGI scripts access to /tmp makes a lot of generic
   exploits that bit more likely to succeed.

2) Why is APC being invoked for CGI scripts that don't use PHP?

Many thanks if you can shed some light on this. APC's a neat little bit
of software and if I can get this resolved, it'll play ball with CentOS
5 (and by extension RHEL 5)!

(Apologies if you receive this twice. Finding and getting onto this list
was really difficult - the mailing list archive site is down, the news
server hasn't/isn't going to forward my post and someone's created this
highly hidden apc-dev list instead of the PECL one!)

- --
Jay L. T. Cornwall, http://www.esuna.co.uk/~jay/
PhD Student
Imperial College London
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFGPfH9oHnC75cy2zgRAlEMAJ9VcOe9nhfdjh8zBEHQFq5JA3iArgCdHwxE
A3+1Ejg1hKMWPOujAxzhV2w=
=A0kD
-----END PGP SIGNATURE-----