Re: fs_rw_tmpfs_files(fwupd_t)

On 6/12/26 10:27 AM, Russell Coker wrote:
> The below ausearch output is from a system running Debian/Trixie (the current
> stable release) with kernel 6.12.88+deb13-amd64.  The same thing happens with
> Debian/Unstable and kernel 7.0.10+deb14-amd64 but I expect people here are
> more interested in results from stable releases.
>
> What would this be about?
>   
> for  pid=160767 comm=fwupdmgr path=/memfd:fwupd (deleted) dev="tmpfs"
> ino=575756 scontext=system_u:system_r:fwupd_t:s0
> tcontext=system_u:object_r:tmpfs_t:s0 tclass=file permissive=0

This is from a memfd. See memfd_create(2). It uses a tmpfs shm segment 
to back the anonymous inode. A fs_tmpfs_filetrans() will work for the 
domain that creates the memfd.

See https://github.com/SELinuxProject/refpolicy/pull/1141 for a recent 
merge for a memfd.

-- 
Chris PeBenito