Re: Single home directory type for all roles.

[Russell Coker <rcoker@redhat.com>]

On Thu, 2004-12-09 at 17:43 -0500, Colin Walters wrote:
> On Fri, 2004-12-10 at 05:02 +1100, Russell Coker wrote:
> > Currently the default policy has /root labeled as staff_home_dir_t.
> > This significantly weakens the boundaries between staff_r and sysadm_r.
> 
> I don't see there as being an interesting boundary between staff_r and
> sysadm_r.  The reason I see staff_r as separated is because it has no
> interaction with user_r, which closes a lot of possible attacks.

Among other things a default configuration allows sshd to permit logins
as staff_r but not sysadm_r.  If a sshd was suspected to be compromised
then you could login at the console as sysadm_r to fix things IFF /root
was not writable to staff_r domains.  If a session launched by sshd can
directly modify files under /root then if you suspected a sshd
compromise then the only option would be to boot from recovery media.

Also note that many daemons look for configuration or data files
under /root, this is due to bugs in daemons but many of them are not
expected to be fixed for quite a while.  Until/unless we get the daemons
in question fixed staff_t can be used to modify the behavior of daemons
with the current labeling of /root (NB in most cases the daemon will
operate without permission to read files under the /root directory, but
even the existence of files can change the behavior).


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.