* setfiles and /home labeling
@ 2003-10-15 23:01 Michael Reilly
2003-10-16 1:30 ` Russell Coker
` (2 more replies)
0 siblings, 3 replies; 6+ messages in thread
From: Michael Reilly @ 2003-10-15 23:01 UTC (permalink / raw)
To: selinux
I know I am missing something. These are all of the lines from
file_contexts which reference the /home directories. Notice the two lines
which reference /home/michaelr. After running make relabel /home/michaelr
is labeled system_u:object_r:user_home_dir_t instead of
system_u:object_r:staff_home_dir_t and all of the files in /home/michaelr
and below (except the files special cased like .ssh, etc.) are labeled
system_u:object_r:user_home_t.
Why are the two lines for /home/michaelr being ignored? What am I doing
wrong?
Thanks,
michael
# Ordinary user home directories.
/home system_u:object_r:home_root_t
/home/[^/]+ -d system_u:object_r:user_home_dir_t
/home/[^/]+/.+ system_u:object_r:user_home_t
# Other staff home directories, replace "jadmin" with appropriate name
/home/michaelr/(/.*)? system_u:object_r:staff_home_t
/home/michaelr system_u:object_r:staff_home_dir_t
/home/\.\.\.security(/.*)? system_u:object_r:file_labels_t
/home/lost\+found(/.*)? system_u:object_r:lost_found_t
/home/[^/]+/\.gnupg(/.+)? system_u:object_r:user_gpg_secret_t
/home/[^/]+/\.netscape(/.*)? system_u:object_r:user_netscape_rw_t
/home/[^/]+/\.mozilla(/.*)? system_u:object_r:user_netscape_rw_t
/root/\.ssh(/.*)? system_u:object_r:staff_home_ssh_t
/home/[^/]+/\.ssh(/.*)? system_u:object_r:user_home_ssh_t
/home/michaelr/\.ssh(/.*)? system_u:object_r:staff_home_ssh_t
/home/[^/]+/\.vmware(/.*)? system_u:object_r:vmware_user_file_t
/home/[^/]+/\vmware(/.*)? system_u:object_r:vmware_user_file_t
/home/[^/]+/\vmware[^/]*/.*\.cfg system_u:object_r:vmware_user_conf_t
/home/[^/]+/\.Xauthority.* system_u:object_r:user_home_xauth_t
--
---- ---- ----
Michael Reilly michaelr@cisco.com
Cisco Systems, Santa Cruz, CA
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: setfiles and /home labeling
2003-10-15 23:01 setfiles and /home labeling Michael Reilly
@ 2003-10-16 1:30 ` Russell Coker
2003-10-16 1:45 ` Michael Reilly
2003-10-16 2:12 ` Diyab
2003-10-16 12:32 ` Stephen Smalley
2 siblings, 1 reply; 6+ messages in thread
From: Russell Coker @ 2003-10-16 1:30 UTC (permalink / raw)
To: Michael Reilly, selinux
On Thu, 16 Oct 2003 09:01, Michael Reilly wrote:
> /home/michaelr/(/.*)? system_u:object_r:staff_home_t
> /home/michaelr system_u:object_r:staff_home_dir_t
Change the above two lines to the below:
/home/michaelr/.+ michaelr:object_r:staff_home_t
/home/michaelr -d michaelr:object_r:staff_home_dir_t
It should work then. Let me know what happens.
--
http://www.coker.com.au/selinux/ My NSA Security Enhanced Linux packages
http://www.coker.com.au/bonnie++/ Bonnie++ hard drive benchmark
http://www.coker.com.au/postal/ Postal SMTP/POP benchmark
http://www.coker.com.au/~russell/ My home page
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: setfiles and /home labeling
2003-10-16 1:30 ` Russell Coker
@ 2003-10-16 1:45 ` Michael Reilly
0 siblings, 0 replies; 6+ messages in thread
From: Michael Reilly @ 2003-10-16 1:45 UTC (permalink / raw)
To: russell; +Cc: selinux
Thank you - I'll try that now.
BTW - this documented anywhere? It appears to be a form of REGEXP but is
slightly different than I am used to.
michael
On Thu, 16 Oct 2003 11:30:21 +1000
Russell Coker <russell@coker.com.au> wrote:
> On Thu, 16 Oct 2003 09:01, Michael Reilly wrote:
> > /home/michaelr/(/.*)? system_u:object_r:staff_home_t
> > /home/michaelr system_u:object_r:staff_home_dir_t
>
> Change the above two lines to the below:
>
> /home/michaelr/.+ michaelr:object_r:staff_home_t
> /home/michaelr -d michaelr:object_r:staff_home_dir_t
>
> It should work then. Let me know what happens.
>
> --
> http://www.coker.com.au/selinux/ My NSA Security Enhanced Linux packages
> http://www.coker.com.au/bonnie++/ Bonnie++ hard drive benchmark
> http://www.coker.com.au/postal/ Postal SMTP/POP benchmark
> http://www.coker.com.au/~russell/ My home page
--
---- ---- ----
Michael Reilly michaelr@cisco.com
Cisco Systems, Santa Cruz, CA
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: setfiles and /home labeling
2003-10-15 23:01 setfiles and /home labeling Michael Reilly
2003-10-16 1:30 ` Russell Coker
@ 2003-10-16 2:12 ` Diyab
2003-10-16 5:35 ` Michael Reilly
2003-10-16 12:32 ` Stephen Smalley
2 siblings, 1 reply; 6+ messages in thread
From: Diyab @ 2003-10-16 2:12 UTC (permalink / raw)
To: Michael Reilly, SELinux Mail List
Michael Reilly wrote:
> I know I am missing something. These are all of the lines from
> file_contexts which reference the /home directories. Notice the two lines
> which reference /home/michaelr. After running make relabel /home/michaelr
> is labeled system_u:object_r:user_home_dir_t instead of
> system_u:object_r:staff_home_dir_t and all of the files in /home/michaelr
> and below (except the files special cased like .ssh, etc.) are labeled
> system_u:object_r:user_home_t.
>
> Why are the two lines for /home/michaelr being ignored? What am I doing
> wrong?
>
> Thanks,
>
> michael
> # Ordinary user home directories.
> /home system_u:object_r:home_root_t
> /home/[^/]+ -d system_u:object_r:user_home_dir_t
> /home/[^/]+/.+ system_u:object_r:user_home_t
> # Other staff home directories, replace "jadmin" with appropriate name
> /home/michaelr/(/.*)? system_u:object_r:staff_home_t
> /home/michaelr system_u:object_r:staff_home_dir_t
You have an extra / in the staff_home_t declaration. Change it to read
like this:
/home/michaelr(/.*)? system_u:object_r:staff_home_t
Timothy,
--
I put instant coffee in a microwave and almost went back in time.
-- Steven Wright
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: setfiles and /home labeling
2003-10-16 2:12 ` Diyab
@ 2003-10-16 5:35 ` Michael Reilly
0 siblings, 0 replies; 6+ messages in thread
From: Michael Reilly @ 2003-10-16 5:35 UTC (permalink / raw)
To: Diyab; +Cc: SELinux Mail List
Thank you. I do not have the original 1.2 policy file here so I do not know if I added the extra / or if it was already there when I changed the name from jadmin to michaelr.
michael
On Wed, 15 Oct 2003 22:12:51 -0400
Diyab <diyab@diyab.net> wrote:
> Michael Reilly wrote:
> > I know I am missing something. These are all of the lines from
> > file_contexts which reference the /home directories. Notice the two lines
> > which reference /home/michaelr. After running make relabel /home/michaelr
> > is labeled system_u:object_r:user_home_dir_t instead of
> > system_u:object_r:staff_home_dir_t and all of the files in /home/michaelr
> > and below (except the files special cased like .ssh, etc.) are labeled
> > system_u:object_r:user_home_t.
> >
> > Why are the two lines for /home/michaelr being ignored? What am I doing
> > wrong?
> >
> > Thanks,
> >
> > michael
> > # Ordinary user home directories.
> > /home system_u:object_r:home_root_t
> > /home/[^/]+ -d system_u:object_r:user_home_dir_t
> > /home/[^/]+/.+ system_u:object_r:user_home_t
> > # Other staff home directories, replace "jadmin" with appropriate name
> > /home/michaelr/(/.*)? system_u:object_r:staff_home_t
> > /home/michaelr system_u:object_r:staff_home_dir_t
>
> You have an extra / in the staff_home_t declaration. Change it to read
> like this:
>
> /home/michaelr(/.*)? system_u:object_r:staff_home_t
>
> Timothy,
>
> --
> I put instant coffee in a microwave and almost went back in time.
> -- Steven Wright
--
---- ---- ----
Michael Reilly michaelr@cisco.com
Cisco Systems, Santa Cruz, CA
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: setfiles and /home labeling
2003-10-15 23:01 setfiles and /home labeling Michael Reilly
2003-10-16 1:30 ` Russell Coker
2003-10-16 2:12 ` Diyab
@ 2003-10-16 12:32 ` Stephen Smalley
2 siblings, 0 replies; 6+ messages in thread
From: Stephen Smalley @ 2003-10-16 12:32 UTC (permalink / raw)
To: Michael Reilly; +Cc: selinux, Russell Coker
On Wed, 2003-10-15 at 19:01, Michael Reilly wrote:
> # Other staff home directories, replace "jadmin" with appropriate name
> /home/michaelr/(/.*)? system_u:object_r:staff_home_t
This is a bug in the upstream policy entry for jadmin; extra / in the
above path prevents proper matching.
--
Stephen Smalley <sds@epoch.ncsc.mil>
National Security Agency
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2003-10-16 12:33 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2003-10-15 23:01 setfiles and /home labeling Michael Reilly
2003-10-16 1:30 ` Russell Coker
2003-10-16 1:45 ` Michael Reilly
2003-10-16 2:12 ` Diyab
2003-10-16 5:35 ` Michael Reilly
2003-10-16 12:32 ` Stephen Smalley
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.