Transmute feature in Smack solves a problem of two applications running with different Smack rules sharing data in a single directory. First of all, both applications need write ('w') and execute ('x') access to label of the directory in order to be able to write into it. But the files that would be created will have Smack label of the process that created them. If one of two apps would like to access files in that directory that were created by the other app, it would need access to the other app's label.
To solve that, Smack provides transmute feature. Two parts are needed:
- The applications that write to the directory must have 't' access to the directory label.
- The directory needs to have transmute attribute. If it is an ordinary directory, you set the attribute with security.SMACK64TRANSMUTE xattr set to "TRUE", or simpler with "chsmack -t " command. If the directory is a mount point (like /run in your Tizen example), it can be mounted with smackfstransmute="some_label" mount option to give it desired Smack label and enable transmute.
This will enable transmute, affecting Smack labels of newly created files in that directory. Every file created there by one of the apps will now get Smack label of the directory instead of Smack label of the process that created it. And every sub-directory created in that directory will also get transmute attribute.
Let me show an example:
# mkdir /tmp/test
# chsmack -a dir_label /tmp/test
# chsmack /tmp/test
# echo "process_label dir_label wx" | smackload
# echo process_label >/proc/self/attr/current
With directory /tmp/test having label "dir_label" and current shell running with label "process_label", let's see how new files and directories will be labeled:
# touch /tmp/test/file1
# mkdir /tmp/test/dir1
# chsmack /tmp/test/file1 /tmp/test/dir1
Let's enable transmute:
# chsmack -t /tmp/test
# chsmack /tmp/test
/tmp/test/ access="dir_label" transmute="TRUE"
# echo "process_label dir_label wxt" | smackload
And transmute in action:
# touch /tmp/test/file2
# mkdir /tmp/test/dir2
# chsmack /tmp/test/file2 /tmp/test/dir2
/tmp/test/dir2 access="dir_label" transmute="TRUE"