Re: User home directory creation with useradd (rhbz#217441)

[Karl MacMillan <kmacmillan@mentalrootkit.com>]

James Antill wrote:
>  As some of you know, there's an open BZ about the fact that in a
> strict/MLS environment useradd doesn't create the user's homedir with
> the correct context[1].
>  The problem is that matchpathcon() needs semanage to have run, so we
> know what SELinux user the unix user is associated with, but that runs
> separately and after useradd. The four obvious solutions are:
> 
> 1. Have an option for useradd to call semanage to add the selinux user,
> and then do the restorecon.
> 

I think this is the best option, though there needs to be additional 
flags to useradd added to allow the setting or roles.

> 2. Have semanage do the equivalent of a restorecon when doing an
> add/modify (or just add) of SELinux user information.
> 

I think this is needed in addition to one for changes to users. Should 
be optional (but perhaps on by default) since the operating is 
potentially expensive.

> 3. Have some kind of wrapper that does:
> 	i. useradd
> 	ii. semanage
> 	iii. restorecon
> 

Setools used to include something like this - didn't get much use that I 
am aware of because no one knew it was there. I would prefer patching 
the default tools.

> 4. Document that you need to call the list of programs in #3.
> 

Nobody reads documentation - this isn't viable.

Karl

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.