From: sven.vermeulen@siphos.be (Sven Vermeulen)
To: refpolicy@oss.tresys.com
Subject: [refpolicy] userdom_list_user_home_dirs for system cronjobs
Date: Sat, 10 Dec 2011 09:49:20 +0100 [thread overview]
Message-ID: <20111210084920.GA7537@siphos.be> (raw)
Hi guys,
We had a case (logwatch) where running logwatch from within a cronjob failed
because /etc/crontab had "HOME=/root" set [1]. The application used the current
working directory for scanning and failed because the job did not have the
proper privileges. As a result, logwatch died out and didn't function.
I think that we have HOME=/ by default, but HOME=/root for system cronjobs
is not all that uncommon. But policy-wise, what is the best way to handle
this?
We can
- document that /etc/crontab must use HOME=/ and leave any job that needs
HOME=/root for the root users' cronjobs
- allow the necessary privileges for logwatch_t only, or
- grant this to all domains through cron_system_entry
I personally think that the first one (document) is the proper one, but
perhaps one of you have a more profound vision on this?
Wkr,
Sven Vermeulen
[1] https://bugs.gentoo.org/show_bug.cgi?id=392699
reply other threads:[~2011-12-10 8:49 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20111210084920.GA7537@siphos.be \
--to=sven.vermeulen@siphos.be \
--cc=refpolicy@oss.tresys.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.