[refpolicy] [PATCH] Add allow_gssd_write_tmp boolean

[jason@perfinion.com (Jason Zaman)]

On Fri, Jul 25, 2014 at 08:19:16AM -0400, Christopher J. PeBenito wrote:
> On 7/23/2014 4:31 PM, Jason Zaman wrote:
> > gssd needs to be able to add entries to the kerberos credential
> > cache. This adds a boolean to allow that.
> [...]
> > @@ -309,6 +317,11 @@ tunable_policy(`allow_gssd_read_tmp',`
> >  	userdom_read_user_tmp_symlinks(gssd_t)
> >  ')
> >  
> > +tunable_policy(`allow_gssd_write_tmp',`
> > +	userdom_list_user_tmp(gssd_t)
> > +	userdom_write_user_tmp_files(gssd_t)
> > +')
> > +
> 
> Are you sure that these credential caches can't have more specific
> labels, e.g. by name filetrans?

That was sort of the point of my original question, the file is
/tmp/krb5cc_1000 ie depends on the uid. A named transition is not quite
possible but having something like krb_user_tmp_t would work then gssd
could get only access to that instead of every single user_tmp_t.

I don't know enough about the details of kerberos but I think only the
kernel and kinit/klist/etc need to be able to read the credential
cache file so having it labelled as user_tmp_t is a bit strange.

-- Jason