From: Sven Vermeulen <sven.vermeulen@siphos.be>
To: SELinux development <selinux@tycho.nsa.gov>
Subject: Re: Suggestion on fixing a old libselinux problem.
Date: Thu, 1 Mar 2012 19:35:53 +0100 [thread overview]
Message-ID: <20120301183552.GA14832@siphos.be> (raw)
In-Reply-To: <1330551258.20078.28.camel@moss-pluto>
On Wed, Feb 29, 2012 at 04:34:18PM -0500, Stephen Smalley wrote:
> > On Wed, 2012-02-29 at 15:47 -0500, Daniel J Walsh wrote:
> > > Right now we have an open bug on confined users. Basically if you
> > > setup a confined user guest_u and attempt to login to that user via
> > > xdm_t, you get a context of guest_u:guest_r:oddjob_mkhomedir_t:s0
> > >
> > > selinuxdefcon pwalsh system_u:system_r:xdm_t:s0
> > > guest_u:guest_r:oddjob_mkhomedir_t:s0
We had a similar issue with vixie-cron. It's attempt to get an initial
context gave strange results and we had a rough time figuring out what was
the case.
Now, we recommend users to run getseuser to find out what the returned
context is on the user' system and check if it is cronjob_t [1].
[1] http://www.gentoo.org/proj/en/hardened/selinux-faq.xml#cronfails
> > Last time we discussed this, I thought we agreed to migrate away from
> > the current usage of security_compute_user (/selinux/user) altogether
> > within libselinux, and replace it with a simpler userspace configuration
> > and logic for determining user roles and levels.
>
> I don't think we want to introduce greater complexity and more possible
> failures causes into the mix for determining user contexts. Simplest
> option would be to change get_ordered_context_list() to return the empty
> list / fail in that case rather than return the full reachable list from
> security_compute_user.
I agree. I find it illogical that it returns a full reachable list.
Wkr,
Sven Vermeulen
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
prev parent reply other threads:[~2012-03-01 18:37 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2012-02-29 20:47 Suggestion on fixing a old libselinux problem Daniel J Walsh
2012-02-29 21:22 ` Stephen Smalley
2012-02-29 21:34 ` Stephen Smalley
2012-03-01 14:42 ` Daniel J Walsh
2012-03-02 17:46 ` Stephen Smalley
2012-03-02 21:14 ` Stephen Smalley
2012-03-01 18:35 ` Sven Vermeulen [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20120301183552.GA14832@siphos.be \
--to=sven.vermeulen@siphos.be \
--cc=selinux@tycho.nsa.gov \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.