From: Tom <tom@lemuria.org>
To: SELinux Mail List <selinux@tycho.nsa.gov>
Subject: Re: ssh policy hassles
Date: Thu, 25 Sep 2003 08:46:17 +0200 [thread overview]
Message-ID: <20030925084613.H11866@lemuria.org> (raw)
In-Reply-To: <20030924221157.GS21997@vnl.com>; from amon@vnl.com on Wed, Sep 24, 2003 at 11:11:57PM +0100
On Wed, Sep 24, 2003 at 11:11:57PM +0100, Dale Amon wrote:
> > Don't know if this helps much, but the only reference I see to /var/lib in the trace is sshd doing a stat on directory /var/lib/empty.
>
> It certainly does. I wonder why I can't find it via a source grep?
Because it is not hard-coded. It's whatever home-directory you set in
/etc/passwd for the privsep account.
That's also why others don't see that access. On Debian, for example,
it defaults to /var/empty
You might want to define a special type for the empty dir, so you can
move it around and don't have to give sshd access to all of /var
--
http://web.lemuria.org/pubkey.html
pub 1024D/2D7A04F5 2002-05-16 Tom Vogt <tom@lemuria.org>
Key fingerprint = C731 64D1 4BCF 4C20 48A4 29B2 BF01 9FA1 2D7A 04F5
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
next prev parent reply other threads:[~2003-09-25 6:51 UTC|newest]
Thread overview: 27+ messages / expand[flat|nested] mbox.gz Atom feed top
2003-09-24 21:55 ssh policy hassles Inger, Slav (S.B.)
2003-09-24 22:11 ` Dale Amon
2003-09-24 22:27 ` Dale Amon
2003-09-25 3:01 ` Diyab
2003-09-25 8:30 ` Dale Amon
2003-09-25 6:46 ` Tom [this message]
2003-09-25 8:14 ` Russell Coker
2003-09-25 10:29 ` Dale Amon
2003-09-25 12:55 ` Diyab
2003-09-25 16:47 ` Russell Coker
2003-09-26 0:16 ` Diyab
2003-09-26 2:42 ` Russell Coker
2003-09-29 20:27 ` SELinux & UML FAQ Nick Davis
2003-09-29 20:51 ` Stephen Smalley
2003-09-30 6:36 ` Russell Coker
-- strict thread matches above, loose matches on Subject: below --
2003-09-23 15:09 Some minor thoughts on syntax/semantics Dale Amon
2003-09-24 13:34 ` Russell Coker
2003-09-24 20:31 ` ssh policy hassles Dale Amon
2003-09-24 21:20 ` Kerry Thompson
2003-09-25 3:32 ` Russell Coker
2003-09-25 10:44 ` Dale Amon
2003-09-25 11:31 ` Dale Amon
2003-09-25 12:17 ` Dale Amon
2003-09-25 12:21 ` Russell Coker
2003-09-25 12:55 ` Stephen Smalley
2003-09-25 14:20 ` Dale Amon
2003-09-27 10:47 ` Dale Amon
[not found] ` <20030927133244.GC22582@vnl.com>
[not found] ` <20030927133352.GD22582@vnl.com>
2003-09-27 14:13 ` Russell Coker
2003-09-27 23:00 ` Dale Amon
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20030925084613.H11866@lemuria.org \
--to=tom@lemuria.org \
--cc=selinux@tycho.nsa.gov \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.