* pam_namespace context inside of name.inst @ 2009-09-27 6:12 Justin Mattock 2009-09-27 13:13 ` Dominick Grift 0 siblings, 1 reply; 6+ messages in thread From: Justin Mattock @ 2009-09-27 6:12 UTC (permalink / raw) To: SE-Linux I'm going crazy over here trying to figure out how one system created a context inside name.inst one way and another for the other system: the first system has inside of name.inst: system_u:object_r:file_t_name and on the other system I have: name:object_r:user_home_dir_t_name the only difference with the machines is one machine had not been labeled yet, before turning on namespace. what should be the right context directory inside of name.inst? -- Justin P. Mattock -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with the words "unsubscribe selinux" without quotes as the message. ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: pam_namespace context inside of name.inst 2009-09-27 6:12 pam_namespace context inside of name.inst Justin Mattock @ 2009-09-27 13:13 ` Dominick Grift 2009-09-27 15:14 ` Justin P. Mattock 0 siblings, 1 reply; 6+ messages in thread From: Dominick Grift @ 2009-09-27 13:13 UTC (permalink / raw) To: selinux [-- Attachment #1: Type: text/plain, Size: 1305 bytes --] On Sat, Sep 26, 2009 at 11:12:20PM -0700, Justin Mattock wrote: > I'm going crazy over here trying to figure > out how one system created a context inside > name.inst one way and another for the other system: > > the first system has inside of > name.inst: > system_u:object_r:file_t_name This is wrong because the fs wasnt labelled properly > > and on the other system I have: > > name:object_r:user_home_dir_t_name This is right > the only difference with the machines is one machine > had not been labeled yet, before turning on namespace. > > what should be the right context directory inside of > name.inst? Depends, i think theres 3 different possibilities (not sure) first theres only name (no selinux) which create a dir with the user name second is context which create a dir with the context of the usre home dir (user_home_dir_t and appends the user name third is level , which creates a dir with the context of the user home dir and appends the username and also appends the level of the dir. > -- > Justin P. Mattock > > -- > This message was distributed to subscribers of the selinux mailing list. > If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with > the words "unsubscribe selinux" without quotes as the message. [-- Attachment #2: Type: application/pgp-signature, Size: 197 bytes --] ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: pam_namespace context inside of name.inst 2009-09-27 13:13 ` Dominick Grift @ 2009-09-27 15:14 ` Justin P. Mattock 2009-09-27 16:05 ` Dominick Grift 0 siblings, 1 reply; 6+ messages in thread From: Justin P. Mattock @ 2009-09-27 15:14 UTC (permalink / raw) To: Dominick Grift; +Cc: selinux Dominick Grift wrote: > On Sat, Sep 26, 2009 at 11:12:20PM -0700, Justin Mattock wrote: > >> I'm going crazy over here trying to figure >> out how one system created a context inside >> name.inst one way and another for the other system: >> >> the first system has inside of >> name.inst: >> system_u:object_r:file_t_name >> > > This is wrong because the fs wasnt labelled properly > That's what I figured,(this is the system that I did not label before turning on namespace). >> and on the other system I have: >> >> name:object_r:user_home_dir_t_name >> > > This is right > This is from the system that was labeled before turning on namespace. > >> the only difference with the machines is one machine >> had not been labeled yet, before turning on namespace. >> >> what should be the right context directory inside of >> name.inst? >> > > Depends, i think theres 3 different possibilities (not sure) > > first theres only name (no selinux) which create a dir with the user name > second is context which create a dir with the context of the usre home dir (user_home_dir_t and appends the user name > third is level , which creates a dir with the context of the user home dir and appends the username and also appends the level of the dir. > > >> -- >> Justin P. Mattock >> >> -- >> This message was distributed to subscribers of the selinux mailing list. >> If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with >> the words "unsubscribe selinux" without quotes as the message. >> So either you can use(name,context,level) or (meth=1,2,3)? (I'm wondering if this is all I need to configure) Anyways what's getting me is after the initial loading of namespace, the directory is created with the context (namespace.conf is set to it's default). Then after wards I haven't found a way to change that directory (besides using mv, or cp)from what it is(*file_t) to the correct context(*home_dir_t) if I delete that directory, then logout/in namespace does not create another. Is there a way to reset namespace and start fresh since I messed up and turned on namespace before labeling my filesystem, causing it to somehow be stuck with the wrong labeled context? Justin P. Mattock -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with the words "unsubscribe selinux" without quotes as the message. ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: pam_namespace context inside of name.inst 2009-09-27 15:14 ` Justin P. Mattock @ 2009-09-27 16:05 ` Dominick Grift 2009-09-27 17:51 ` Justin Mattock 2009-09-27 22:45 ` Justin P. Mattock 0 siblings, 2 replies; 6+ messages in thread From: Dominick Grift @ 2009-09-27 16:05 UTC (permalink / raw) To: selinux [-- Attachment #1: Type: text/plain, Size: 4279 bytes --] On Sun, Sep 27, 2009 at 08:14:16AM -0700, Justin P. Mattock wrote: > Dominick Grift wrote: > >On Sat, Sep 26, 2009 at 11:12:20PM -0700, Justin Mattock wrote: > >>I'm going crazy over here trying to figure > >>out how one system created a context inside > >>name.inst one way and another for the other system: > >> > >>the first system has inside of > >>name.inst: > >>system_u:object_r:file_t_name > > > >This is wrong because the fs wasnt labelled properly > That's what I figured,(this is the system that I did not label > before turning on namespace). > >>and on the other system I have: > >> > >>name:object_r:user_home_dir_t_name > > > >This is right > This is from the system that was labeled before turning on namespace. > >>the only difference with the machines is one machine > >>had not been labeled yet, before turning on namespace. > >> > >>what should be the right context directory inside of > >>name.inst? > > > >Depends, i think theres 3 different possibilities (not sure) > > > >first theres only name (no selinux) which create a dir with the user name > >second is context which create a dir with the context of the usre home dir (user_home_dir_t and appends the user name > >third is level , which creates a dir with the context of the user home dir and appends the username and also appends the level of the dir. > > > >>-- > >>Justin P. Mattock > >> > >>-- > >>This message was distributed to subscribers of the selinux mailing list. > >>If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with > >>the words "unsubscribe selinux" without quotes as the message. > So either you can use(name,context,level) or (meth=1,2,3)? > (I'm wondering if this is all I need to configure) This is what i use in /etc/security/namespace.conf: /tmp /tmp-inst/ level root,adm /var/tmp /var/tmp-inst/ level root,adm $HOME $HOME/$USER.inst/ level root,adm Besides that you would add entries to the related logins in /etc/pam.d/ For example: session required pam_namespace.so These entries are often already there. And you need to set the boolean: allow_polyinstantiation --> on Also chmod -R 000 /tmp-inst (and /var/tmp-inst) And make sure the have proper labelling: [root@notebook3 pam.d]# /usr/sbin/semanage fcontext -l | grep tmp-inst /tmp-inst directory system_u:object_r:tmp_t:s0 /tmp-inst/.* all files <<None>> /tmp-inst/\.ICE-unix directory system_u:object_r:xdm_tmp_t:s0 /tmp-inst/\.ICE-unix/.* socket <<None>> /tmp-inst/\.X0-lock all files system_u:object_r:xserver_tmp_t:s0 /tmp-inst/\.X11-unix directory system_u:object_r:xdm_tmp_t:s0 /tmp-inst/\.X11-unix/.* socket <<None>> /tmp-inst/\.font-unix(/.*)? all files system_u:object_r:xfs_tmp_t:s0 /var/tmp-inst directory system_u:object_r:tmp_t:s0 After that , the rest should go automaticly. You do not have to manually create /home/joe/joe.inst ( usually this is done for you, and same goes for stuff under there plus stuff under /tmp-inst and /tmp-inst. If however joe.inst is not automatically created on login , than do it manually. also do chmod -R 000 on it and make sure its context is user_home_dir_t. > > Anyways what's getting me is after the initial loading > of namespace, the directory is created with the context > (namespace.conf is set to it's default). > Then after wards I haven't found a way to change that directory > (besides using mv, or cp)from what it is(*file_t) to > the correct context(*home_dir_t) > > if I delete that directory, then logout/in namespace does not > create another. Is there a way to reset namespace and start fresh > since I messed up and turned on namespace before labeling my filesystem, > causing it to somehow be stuck with the wrong labeled context? It should create a new one automatically... > > Justin P. Mattock [-- Attachment #2: Type: application/pgp-signature, Size: 198 bytes --] ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: pam_namespace context inside of name.inst 2009-09-27 16:05 ` Dominick Grift @ 2009-09-27 17:51 ` Justin Mattock 2009-09-27 22:45 ` Justin P. Mattock 1 sibling, 0 replies; 6+ messages in thread From: Justin Mattock @ 2009-09-27 17:51 UTC (permalink / raw) To: Dominick Grift; +Cc: selinux On Sun, Sep 27, 2009 at 9:05 AM, Dominick Grift <domg472@gmail.com> wrote: > On Sun, Sep 27, 2009 at 08:14:16AM -0700, Justin P. Mattock wrote: >> Dominick Grift wrote: >> >On Sat, Sep 26, 2009 at 11:12:20PM -0700, Justin Mattock wrote: >> >>I'm going crazy over here trying to figure >> >>out how one system created a context inside >> >>name.inst one way and another for the other system: >> >> >> >>the first system has inside of >> >>name.inst: >> >>system_u:object_r:file_t_name >> > >> >This is wrong because the fs wasnt labelled properly >> That's what I figured,(this is the system that I did not label >> before turning on namespace). >> >>and on the other system I have: >> >> >> >>name:object_r:user_home_dir_t_name >> > >> >This is right >> This is from the system that was labeled before turning on namespace. >> >>the only difference with the machines is one machine >> >>had not been labeled yet, before turning on namespace. >> >> >> >>what should be the right context directory inside of >> >>name.inst? >> > >> >Depends, i think theres 3 different possibilities (not sure) >> > >> >first theres only name (no selinux) which create a dir with the user name >> >second is context which create a dir with the context of the usre home dir (user_home_dir_t and appends the user name >> >third is level , which creates a dir with the context of the user home dir and appends the username and also appends the level of the dir. >> > >> >>-- >> >>Justin P. Mattock >> >> >> >>-- >> >>This message was distributed to subscribers of the selinux mailing list. >> >>If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with >> >>the words "unsubscribe selinux" without quotes as the message. >> So either you can use(name,context,level) or (meth=1,2,3)? >> (I'm wondering if this is all I need to configure) > > This is what i use in /etc/security/namespace.conf: > > /tmp /tmp-inst/ level root,adm > /var/tmp /var/tmp-inst/ level root,adm > $HOME $HOME/$USER.inst/ level root,adm > yep, that's what I have as well. > > Besides that you would add entries to the related logins in /etc/pam.d/ > > For example: > session required pam_namespace.so > > These entries are often already there. > I added that to login, and ssh(gdm if I had it installed) > And you need to set the boolean: > allow_polyinstantiation --> on > yep. > Also chmod -R 000 /tmp-inst (and /var/tmp-inst) > And make sure the have proper labelling: > [root@notebook3 pam.d]# /usr/sbin/semanage fcontext -l | grep tmp-inst > /tmp-inst directory system_u:object_r:tmp_t:s0 > /tmp-inst/.* all files <<None>> > /tmp-inst/\.ICE-unix directory system_u:object_r:xdm_tmp_t:s0 > /tmp-inst/\.ICE-unix/.* socket <<None>> > /tmp-inst/\.X0-lock all files system_u:object_r:xserver_tmp_t:s0 > /tmp-inst/\.X11-unix directory system_u:object_r:xdm_tmp_t:s0 > /tmp-inst/\.X11-unix/.* socket <<None>> > /tmp-inst/\.font-unix(/.*)? all files system_u:object_r:xfs_tmp_t:s0 > /var/tmp-inst directory system_u:object_r:tmp_t:s0 > > After that , the rest should go automaticly. You do not have to manually create /home/joe/joe.inst ( usually this is done for you, and same goes for stuff under there plus stuff under /tmp-inst and /tmp-inst. > it was generated. the problem I'm seeing right now is the context is wrong, because I hadn't labeled the filesystem. > If however joe.inst is not automatically created on login , than do it manually. also do chmod -R 000 on it and make sure its context is user_home_dir_t. > >> >> Anyways what's getting me is after the initial loading >> of namespace, the directory is created with the context >> (namespace.conf is set to it's default). >> Then after wards I haven't found a way to change that directory >> (besides using mv, or cp)from what it is(*file_t) to >> the correct context(*home_dir_t) >> >> if I delete that directory, then logout/in namespace does not >> create another. Is there a way to reset namespace and start fresh >> since I messed up and turned on namespace before labeling my filesystem, >> causing it to somehow be stuck with the wrong labeled context? > > It should create a new one automatically... Seems from what I'm looking at /etc/security/namespace.init is called once for the initial start, then after that is never called again. (but could be wrong). for now Im going to see if there's a way to have this mechanism call itself like it had done from the first start, if so then it should generate a newly created *.inst and be in the right context. (if not then Ill manually create it like you had suggested). >> >> Justin P. Mattock > -- Justin P. Mattock -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with the words "unsubscribe selinux" without quotes as the message. ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: pam_namespace context inside of name.inst 2009-09-27 16:05 ` Dominick Grift 2009-09-27 17:51 ` Justin Mattock @ 2009-09-27 22:45 ` Justin P. Mattock 1 sibling, 0 replies; 6+ messages in thread From: Justin P. Mattock @ 2009-09-27 22:45 UTC (permalink / raw) To: Dominick Grift; +Cc: selinux Well this is confusing to me the first initial start created /home/name/name.inst then if I move name.inst that directory just for some reason isn't being recreated after login. But if I change the location to: /home/name.inst that directory can be deleted, and a new one created upon every login. As for the context in name.inst for some reason one system created name:object_r:user_home_dir_t_name as the directory name, but then other directories created are: system_u:object_r:file_t_name (which seems right, but am unsure) I think if Ill leave namespace.conf to /home/name.inst because everything runs as is. Justin P. Mattock -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with the words "unsubscribe selinux" without quotes as the message. ^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2009-09-27 22:45 UTC | newest] Thread overview: 6+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2009-09-27 6:12 pam_namespace context inside of name.inst Justin Mattock 2009-09-27 13:13 ` Dominick Grift 2009-09-27 15:14 ` Justin P. Mattock 2009-09-27 16:05 ` Dominick Grift 2009-09-27 17:51 ` Justin Mattock 2009-09-27 22:45 ` Justin P. Mattock
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.