systemd_user_runtime_dir_t

systemd_user_runtime_dir_t

[Russell Coker]

What kind of name is that?  It's a poor choice of name by systemd upstream and 
I don't think we are obliged to copy that bad idea.

How about systemd_userdir_mgr_t or something similar?

-- 
My Main Blog         http://etbe.coker.com.au/
My Documents Blog    http://doc.coker.com.au/

Re: systemd_user_runtime_dir_t

[Topi Miettinen]

On 8.4.2020 5.19, Russell Coker wrote:
> What kind of name is that?  It's a poor choice of name by systemd upstream and
> I don't think we are obliged to copy that bad idea.

The name is related to environment variable XDG_USER_RUNTIME_DIR, which 
is not systemd specific construct:

https://specifications.freedesktop.org/basedir-spec/basedir-spec-latest.html

So if the name should change, xdg_user_runtime_dir_t might be more 
accurate. On the other hand, the current name reflects that it's 
specifically the service supplied by systemd called 
"runtime-user-dir@.service" which provides the directory. If the 
provider would be something other (/etc/init.d/elogind-mkuserdir), it 
could be equally accurate to label the directory with something else. 
Though if the result (temporary directory owned by the user) is no 
different in either case from the point of view of SELinux policy, why 
change?

-Topi

Re: systemd_user_runtime_dir_t

[Russell Coker]

On Wednesday, 8 April 2020 4:43:32 PM AEST Topi Miettinen wrote:
> On 8.4.2020 5.19, Russell Coker wrote:
> > What kind of name is that?  It's a poor choice of name by systemd upstream
> > and I don't think we are obliged to copy that bad idea.
> 
> The name is related to environment variable XDG_USER_RUNTIME_DIR, which
> is not systemd specific construct:

That's a fine name for an environment variable, clearly indicating that it 
points to a directory.

It's a poor name for a domain, making a casual observer think it's a type for 
a directory not a domain for a process.

> https://specifications.freedesktop.org/basedir-spec/basedir-spec-latest.html
> 
> So if the name should change, xdg_user_runtime_dir_t might be more
> accurate.

It would be more accurate to have a name that reflects the function of managing 
the directory in question.

> On the other hand, the current name reflects that it's
> specifically the service supplied by systemd called
> "runtime-user-dir@.service" which provides the directory. If the
> provider would be something other (/etc/init.d/elogind-mkuserdir), it
> could be equally accurate to label the directory with something else.

If the provider changed to a different process (theoretically we are supposed 
to be able to swap out parts of systemd for equivalents) then it should have 
the same domain name.

> Though if the result (temporary directory owned by the user) is no
> different in either case from the point of view of SELinux policy, why
> change?

SE Linux is difficult enough to understand without making things needlessly 
confusing.

-- 
My Main Blog         http://etbe.coker.com.au/
My Documents Blog    http://doc.coker.com.au/

Re: systemd_user_runtime_dir_t

[Chris PeBenito]

On 4/8/20 2:48 AM, Russell Coker wrote:
> On Wednesday, 8 April 2020 4:43:32 PM AEST Topi Miettinen wrote:
>> On 8.4.2020 5.19, Russell Coker wrote:
>>> What kind of name is that?  It's a poor choice of name by systemd upstream
>>> and I don't think we are obliged to copy that bad idea.
>>
>> The name is related to environment variable XDG_USER_RUNTIME_DIR, which
>> is not systemd specific construct:
> 
> That's a fine name for an environment variable, clearly indicating that it
> points to a directory.
> 
> It's a poor name for a domain, making a casual observer think it's a type for
> a directory not a domain for a process.
> 
>> https://specifications.freedesktop.org/basedir-spec/basedir-spec-latest.html
>>
>> So if the name should change, xdg_user_runtime_dir_t might be more
>> accurate.
> 
> It would be more accurate to have a name that reflects the function of managing
> the directory in question.
> 
>> On the other hand, the current name reflects that it's
>> specifically the service supplied by systemd called
>> "runtime-user-dir@.service" which provides the directory. If the
>> provider would be something other (/etc/init.d/elogind-mkuserdir), it
>> could be equally accurate to label the directory with something else.
> 
> If the provider changed to a different process (theoretically we are supposed
> to be able to swap out parts of systemd for equivalents) then it should have
> the same domain name.
> 
>> Though if the result (temporary directory owned by the user) is no
>> different in either case from the point of view of SELinux policy, why
>> change?
> 
> SE Linux is difficult enough to understand without making things needlessly
> confusing.

You're right.  I wasn't pleased when I came across it.  However, the way I see 
it, the direction you suggest is confusing in a different way, since it doesn't 
obviously align with the systemd command name.  I see it as being between a rock 
and a hard place, so I'm inclined to keep it as-is. This isn't a domain that is 
going to show up all over the place, it is a microscopic niche of the byzantine 
set of processes under the systemd umbrella.


-- 
Chris PeBenito