Re: Restorecon script

[Luke Kenneth Casson Leighton <lkcl@lkcl.net>]

On Fri, Jun 10, 2005 at 05:57:48PM -0400, Ivan Gyurdiev wrote:
> 
> > > Who will create /tmp/orbit and /tmp/gconfd, and how will you
> > > get them to have different types? 
> >  
> >  a special selinux-aware library, that all gconfd-aware programs and
> >  orbit-aware programs must utilise, respectively.
> > 
> >  heck, it could even do the setfilecon() for you.
> 
> That library is libselinux. I've already tried this,
> and it doesn't work very well, for the reasons mentioned in my chown()
> email.
 
 sorry, i introduced two issues in my email: the one about chown() was
 just a thought tacked on to the end.

 please ignore and totally disassociate any thought about chown() from
 the "/tmp/<DIR>/.SOCKET-$USER" idea.

 
> ==========
> 
> I do agree with the other comments, however, that a per application
> solution is appropriate. 

 you mean a per-application-or-better-per-client-server group
 (gconfd is just the server...)

 which implies two functions: one for creating the socket in the right
 place (and the subdirectory if appropriate, hence there is a place
 where selinux could be introduced, if appropriate, to set the
 appropriate permissions: almost undoubtedly this will be needed).

 one for connection _to_ the socket.

> For /tmp, we can we can implement a tmpskel
> similar to /skel that gets created at init.

> Please consider that this script was just yesterday's solution to make
> the policy usable. I do realize that it has drawbacks, and does not
> work well in the long run, so thanks for the comments.
> 
> The important thing to me is the agreement that creating folders
> ahead of time is the right thing to do. The mechanism for doing
> that can be changed.
> 
> 

-- 
--
<a href="http://lkcl.net">http://lkcl.net</a>
-

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.