SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

tmpfiles, man: Add xattr support to tmpfiles

Browse Source 
This patch makes it possible to set extended attributes on files created
by tmpfiles. This can be especially used to set SMACK security labels on
volatile files and directories.

It is done by adding new line of type "t". Such line should contain
attributes in Argument field, using following format:

name=value

All other fields are ignored.

If value contains spaces, then it must be surrounded by quotation marks.
User can also put quotation mark in value by escaping it with backslash.

Example:
D /var/run/cups - - - -
t /var/run/cups - - - - security.SMACK64=printing
This commit is contained in:
Maciej Wereski
2014-12-04 20:21:45 +01:00
committed by Lennart Poettering
parent 1cb636d92d
commit ebf4e8013b
2 changed files with 155 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files
man/tmpfiles.d.xml
+26 -6
View File
@@ -343,6 +343,25 @@ L /tmp/foobar - - - - /dev/null</programlisting>
normal path
names.</para></listitem>
</varlistentry>
<varlistentry>
<term><varname>t</varname></term>
<listitem><para>Set extended
attributes on item. It may be
used in conjunction with other
types (only <varname>d</varname>,
<varname>D</varname>, <varname>f</varname>,
<varname>F</varname>, <varname>L</varname>,
<varname>p</varname>, <varname>c</varname>,
<varname>b</varname>, makes sense).
If used as a standalone line, then
<command>systemd-tmpfiles</command>
will try to set extended
attributes on specified path.
This can be especially used to set
SMACK labels.
</para></listitem>
</varlistentry>
</variablelist>
<para>If the exclamation mark is used, this
@@ -430,7 +449,7 @@ r! /tmp/.X[0-9]*-lock</programlisting>
will not be modified. This parameter is
ignored for <varname>x</varname>,
<varname>r</varname>, <varname>R</varname>,
<varname>L</varname> lines.</para>
<varname>L</varname>, <varname>t</varname> lines.</para>
<para>Optionally, if prefixed with
<literal>~</literal>, the access mode is masked
@@ -462,8 +481,8 @@ r! /tmp/.X[0-9]*-lock</programlisting>
ownership will not be modified. These
parameters are ignored for
<varname>x</varname>, <varname>r</varname>,
<varname>R</varname>, <varname>L</varname>
lines.</para>
<varname>R</varname>, <varname>L</varname>,
<varname>t</varname> lines.</para>
</refsect2>
<refsect2>
@@ -527,8 +546,8 @@ r! /tmp/.X[0-9]*-lock</programlisting>
specify a short string that is written to the
file, suffixed by a newline. For
<varname>C</varname>, specifies the source file
or directory. Ignored for all other
lines.</para>
or directory. For <varname>t</varname> determines
extended attributes to be set. Ignored for all other lines.</para>
</refsect2>
</refsect1>
@@ -540,7 +559,8 @@ r! /tmp/.X[0-9]*-lock</programlisting>
<para><command>screen</command> needs two directories created at boot with specific modes and ownership.</para>
<programlisting>d /run/screens 1777 root root 10d
d /run/uscreens 0755 root root 10d12h</programlisting>
d /run/uscreens 0755 root root 10d12h
t /run/screen - - - - user.name="John Smith" security.SMACK64=screen</programlisting>
</example>
<example>
<title>/etc/tmpfiles.d/abrt.conf example</title>