Created attachment 3238 [details]
Results of ausearch with audit tracing enabled on ~/tmp

So for a while now on my Fedora 23 build machine all the files in my ~/tmp directory were being deleted on an irregular basis (just that directory, not recursively). I had a hunch it was happening at the same time as rebuilding something early in the build process and I'd set up a canary and script to try to track down what was doing it, but it wasn't until yesterday I actually caught it with the audit system - see attached. There were a number of these events, one per entry in my ~/tmp so it was clearly looping through all of the items in that directory and calling unlink() on them.

There are a bunch of interesting things in the log entries but the most significant is that the apparent executable running is /usr/bin/ccache. Richard dug into the ccache source and found that as part of cleanup it was deleting CCACHE_DIR/tmp, and then found that CCACHE_DIR is being set by us in bitbake.conf to $HOME if it's not set (which it isn't in my environment):

-------- snip --------
# Assign CCACHE_DIR a default value to fix a bug of ccache 3.1.7,
# since it would always create CCACHE_DIR/.ccache even if
# CCACHE_DISABLE = 1.
export CCACHE_DIR ??= "${@os.getenv('HOME')}"
-------- snip --------

Given the results I really don't think this is a good idea. We need to investigate whether we really still need this and if we do, default it to something much more sensible. Luckily I don't think I've lost anything valuable with these deletions, but someone else might not be so fortunate.