readonly workdir prevent binder to start

Close for HH RC1

works for me

I propose to accept that patch that fallback to /tmp for the following reason:

• it is protected by smack and DAC (umask = 0077)

• /tmp can be mounted by application by systemd using PrivateTmp=true

• this is a fallback

• this is traditionnal (see function tmpfile of glibc)

Question: do we have to create a subfolder per app in /tmp or not ?

This boils down to : do a file created by App1 in /tmp is readable/writable/visible by App2 ? This depends obviously on the set of smack rules which are set per application.

And the same would apply for multiple users running the same app BTW.

A stupid solution would be to create a tempdir per user and per app: something like /run/user/<uid>/tmp/<appname>/ but what about cleanup?