mcstrans: preserve runtime directory

Do not remove the runtime directory /run/setrans/, which is the parent
for the security context translation socket .setrans-unix, when the
service is stopped, so the path can not be taken over by a foreign
program, which could lead to a compromise of the context translation of
libselinux.

Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
Acked-by: James Carter <jwcart2@gmail.com>

mcstrans/src/mcstrans.service

@@ -9,6 +9,7 @@ Conflicts=shutdown.target
 [Service]
 ExecStart=/sbin/mcstransd -f
 RuntimeDirectory=setrans
+RuntimeDirectoryPreserve=true
 
 [Install]
 WantedBy=multi-user.target