Re: genhomedircon is broken in libsemanage

[Joshua Brindle <method@manicmethod.com>]

Todd Miller wrote:
> Daniel J Walsh wrote:
>   
>> -----BEGIN PGP SIGNED MESSAGE-----
>> Hash: SHA1
>>
>> Adding
>>
>> mythtv:x:1004:1004::/var/lib/mythtv:/bin/bash
>>
>> To /etc/passwd causes the labeling to get all screwed up.  This would
>> report an error when we used the python version of genhomedircon and
>> not foul up the labeling by checking if there was a label for /var/lib
>> already in the file_context file. (Boy do I love python.  :^))
>>
>> https://bugzilla.redhat.com/show_bug.cgi?id=430195
>>
>> Dan
>>     
>
> That shouldn't be hard to add to genhomedircon.c.  I'll take a look.
>   

So, Todd is about to send a patch to fix this but I want to point out 
that I'm adverse to this sort of thing. There is a minuid and a null 
shell for a reason, using something above minuid with a valid shell for 
a non-interactive user is a broken configuration and the fact that we 
have to work around it is pretty unfortunate.

That said the alternative of breaking the system labeling is pretty bad, 
its probably better to hack around the problem than leave clueless users 
with broken configurations stranded but I really wish we didn't have to 
do things like this.

*sigh*


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.