Re: [patch 0/4] libsemanage: genhomedircon replacement

[Daniel J Walsh <dwalsh@redhat.com>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Finally catching up on Email after vacation.

genhomedircon lists the entire list of passwords in order to figure out
where home directories are.  Not just the contents of the seusers.

At RedHat we have about 50 different root home directories

/home/location/dwalsh

We need to know this in order to have restorecon work properly.

Labeling of the homedir for things like .mozilla .gnome2 and .ssh
is still needed, but differentiating them on Roles does not make sense
in a distributed world.  Where if dwalsh logs into a kiosk machine he
might be xguest_t, on a terminal server guest_t, on his local machine
unconfined_t and on the security machine staff_t.  If his home directory
is the same on all of these, SELinux is in trouble.

I would be fine with the /tmp differentiation based on role, although I
believe that most machines will have almost everyone using the same role
so you have little separation.  Now that XWindows no longer requires
/tmp.  pam_namespace is a much better solution for this.

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org

iD8DBQFG0w7mrlYvE4MpobMRArZ5AJ9epyM+nDcr5ONXr3ZQVOCOyLDUtwCg2hjJ
NVP3ISNd7Fd0jrq4tFh2/eE=
=l+ea
-----END PGP SIGNATURE-----

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.