Re: [patch 0/4] libsemanage: genhomedircon replacement

[Joshua Brindle <jbrindle@tresys.com>]

Daniel J Walsh wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> Finally catching up on Email after vacation.
> 
> genhomedircon lists the entire list of passwords in order to figure out
> where home directories are.  Not just the contents of the seusers.
> 

Is there an implementation error in the new genhomedircon?

> At RedHat we have about 50 different root home directories
> 
> /home/location/dwalsh
> 
> We need to know this in order to have restorecon work properly.
> 
> Labeling of the homedir for things like .mozilla .gnome2 and .ssh
> is still needed, but differentiating them on Roles does not make sense
> in a distributed world.  Where if dwalsh logs into a kiosk machine he
> might be xguest_t, on a terminal server guest_t, on his local machine
> unconfined_t and on the security machine staff_t.  If his home directory
> is the same on all of these, SELinux is in trouble.

So, it doesn't make sense for your specific infrastructure, that doesn't 
mean it doesn't make sense ever. And this is a policy issue really, 
genhomedircon just does what its told.


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.