Re: User home directory creation with useradd (rhbz#217441)

[Linda Knippers <linda.knippers@hp.com>]

James Antill wrote:
>  As some of you know, there's an open BZ about the fact that in a
> strict/MLS environment useradd doesn't create the user's homedir with
> the correct context[1].
>  The problem is that matchpathcon() needs semanage to have run, so we
> know what SELinux user the unix user is associated with, but that runs
> separately and after useradd. The four obvious solutions are:
> 
> 1. Have an option for useradd to call semanage to add the selinux user,
> and then do the restorecon.

I think useradd should be able to either create the selinux user or map the
linux user to an existing selinux user.  Right now you can't create an
selinux user without a linux login but I think I ought to be able to create
the selinux users separate and them map one or more linux login to each one,
or have useradd create a unique linux user for me if I choose.  And if I
don't choose, the linux user should end up with the correct home directory
based on the default selinux user.
> 
> 2. Have semanage do the equivalent of a restorecon when doing an
> add/modify (or just add) of SELinux user information.

If the semanage is done after the useradd (could be weeks after), the
user could have files that live outside the home directory (I think
Dan pointed this out to me) so what files and directories would you
run restorecon on?
> 
> 3. Have some kind of wrapper that does:
> 	i. useradd
> 	ii. semanage
> 	iii. restorecon

I don't like the wrapper idea because if we can do it in a wrapper,
we can do it in useradd.
> 
> 4. Document that you need to call the list of programs in #3.

I think we need to document that anytime semanage is used one
might need to run restorecon.  There's nothing in the semanage
manpage about that, for example.
> 
>  Does anyone have comments on which of the above they like/hate?
> 
> 
> [1] http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=217441
> 

-- ljk

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.