On Mon, 2011-11-07 at 15:42 -0500, Daniel J Walsh wrote: > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > On 11/07/2011 03:38 PM, Matej Cepl wrote: > > Dne 7.11.2011 20:50, Daniel J Walsh napsal(a): > >> systemd as of Fedora 16 has the ability to run system services > >> with private /tmp and /var/tmp. I would like to propose that we > >> make this the default in Fedora 17, or at least open a bugzilla > >> on all system services that we know of that use /tmp and /var/tmp > >> to make them use private /tmp and /var/tmp. > > > > I am afraid, the proper way how to propose new Feature in Fedora is > > described on http://fedoraproject.org/wiki/Features/Policy . > > Throwing it on fedora-devel is I am afraid most likely a waste of > > time. > > > > Matěj > > > > I know I just opened a couple of other features on Fedora 17. I just > wanted to open discussion on this about what would be the best way to > do this. > > * Make it default in systemd > * Open bugzillas on apps that SELinux discovers uses /tmp and ask them > to change. > * Maybe a bad idea. Since admins might get confused by different /tmp(s). > * Reasonable reasons for service apps to use /tmp. Why not simply open bugs to have apps use /var/run/<name> ? I did something similar patching samba long ago to not export the winbindd pipes in /tmp and sounds cleaner and avoid confusion. The main issue with moving /tmp to /var/run or something is if you *really* need to allow random users to write in it. Because in that case you risk local DoS if users fill up the space (not necessarily out of malice). Not that filling /tmp is not a problem. and with /var/run baing a tmpfs perhaps not a too bid deal either, at least users are not eating into / or /var Simo. Simo. -- Simo Sorce * Red Hat, Inc * New York -- devel mailing list devel@xxxxxxxxxxxxxxxxxxxxxxx https://admin.fedoraproject.org/mailman/listinfo/devel
