Re: [PATCH] policycoreutils/scripts/fixfiles: drop /tmp cleanup

On Thu, Jul 16, 2026 at 2:49 PM Stephen Smalley
<[email protected]> wrote:
>
> The /tmp/{gconfd-*,pulse-*,orbit-*} directories are no longer
> created/used by those daemons so we can drop the old commands removing
> them.
>
> The find commands used to find unlabeled files under /tmp and other
> directories and then invoke chcon on their pathnames will re-lookup
> the full path each time and is therefore subject to TOCTOU issues.
> Since some of these directories are tmpfs on modern Linux systems,
> they can't have any lingering unlabeled files anyway from a prior
> SELinux-disabled boot and we can't restorecon at least some of these
> directories because they have <<none>> in file_contexts. Just drop
> this /tmp cleanup altogether - it is unsafe and shouldn't be needed
> anymore.
>
> Signed-off-by: Stephen Smalley <[email protected]>

Merged.

> ---
>  policycoreutils/scripts/fixfiles | 10 ----------
>  1 file changed, 10 deletions(-)
>
> diff --git a/policycoreutils/scripts/fixfiles b/policycoreutils/scripts/fixfiles
> index b7cd765c..b5f193e1 100755
> --- a/policycoreutils/scripts/fixfiles
> +++ b/policycoreutils/scripts/fixfiles
> @@ -288,16 +288,6 @@ case "$RESTORE_MODE" in
>         if [ ${OPTION} != "Relabel" ]; then
>             return
>         fi
> -       echo "Cleaning up labels on /tmp"
> -       rm -rf /tmp/gconfd-* /tmp/pulse-* /tmp/orbit-*
> -
> -       UNDEFINED=`get_undefined_type` || exit $?
> -       UNLABELED=`get_unlabeled_type` || exit $?
> -       find /tmp \( -context "*:${UNLABELED}*" -o -context "*:${UNDEFINED}*" \) \( -type s -o -type p \) -delete
> -       find /tmp \( -context "*:${UNLABELED}*" -o -context "*:${UNDEFINED}*" \) -exec chcon --no-dereference --reference /tmp {} \;
> -       find /var/tmp \( -context "*:${UNLABELED}*" -o -context "*:${UNDEFINED}*" \) -exec chcon --no-dereference --reference /var/tmp {} \;
> -       find /var/run \( -context "*:${UNLABELED}*" -o -context "*:${UNDEFINED}*" \) -exec chcon --no-dereference --reference /var/run {} \;
> -       [ ! -e /var/lib/debug ] || find /var/lib/debug \( -context "*:${UNLABELED}*" -o -context "*:${UNDEFINED}*" \) -exec chcon --no-dereference --reference /lib {} \;
>      ;;
>  esac
>  }
> --
> 2.55.0
>