Today, perfinion asked if I knew anything about the "portage_sandbox_t portage_tmp_t:dir relabelfrom" denials we've all been seeing for quite some time now, so I went to trace them to their origin. Those denials turn out to be caused by the multilib eclassed, which creates the directory $D/tmp/multilib-include/ and later copies it to $D/usr/include. If that target dir doesn't already exist, cp insists on "relabeling" it from portage_tmp_t to portage_tmp_t. Hence, this permission doesn't seem to be required and we could probably just dontaudit it. But since it doesn't cause any security problems and we already allow the respective permissions for files, I've opted to just allow relabeling dirs, too. You can pull my patch from git://github.com/atlaua/hardened-refpolicy aranea/portage_tmp_relabel.
Created attachment 454448 [details, diff] Proposed patch for contrib/portage.if
Fixed in 2.20161023-r2.
