* Labeling home directories in refpolicy
@ 2010-05-12 14:04 Alan Rouse
2010-05-12 14:11 ` [refpolicy] " Stephen Smalley
0 siblings, 1 reply; 13+ messages in thread
From: Alan Rouse @ 2010-05-12 14:04 UTC (permalink / raw)
To: selinux@tycho.nsa.gov
[-- Attachment #1: Type: text/plain, Size: 892 bytes --]
I'm trying to adapt a recent refpolicy snapshot (May 4) to OpenSUSE. (Previously I adapted the Fedora 12 policy, more as a learning exercise.) Now I'm finding that the refpolicy is not labeling home directories properly (they all end up as default_t after "fixfiles -F relabel"). I'm running unprivileged users as user_u and root as sysadm_u, so I expect corresponding labels on files in the home directory. Is there a special mechanism for getting the home dirs labeled consistent with the corresponding selinux user, or do I need to define labeling for the files individually in a new module? And how do files in the home dir such as .ssh (which should have a type other than user_t) get their types?
Or perhaps something is broken in the distribution that is causing labels from the refpolicy not to be applied in the home dir?
Any insights would be appreciated!
Alan
[-- Attachment #2: Type: text/html, Size: 1442 bytes --]
^ permalink raw reply [flat|nested] 13+ messages in thread
* Re: Labeling home directories in refpolicy
2010-05-12 14:04 Labeling home directories in refpolicy Alan Rouse
@ 2010-05-12 14:11 ` Stephen Smalley
0 siblings, 0 replies; 13+ messages in thread
From: Stephen Smalley @ 2010-05-12 14:11 UTC (permalink / raw)
To: Alan Rouse; +Cc: selinux@tycho.nsa.gov, refpolicy
On Wed, 2010-05-12 at 10:04 -0400, Alan Rouse wrote:
> I'm trying to adapt a recent refpolicy snapshot (May 4) to OpenSUSE.
> (Previously I adapted the Fedora 12 policy, more as a learning
> exercise.) Now I'm finding that the refpolicy is not labeling home
> directories properly (they all end up as default_t after "fixfiles -F
> relabel"). I'm running unprivileged users as user_u and root as
> sysadm_u, so I expect corresponding labels on files in the home
> directory. Is there a special mechanism for getting the home dirs
> labeled consistent with the corresponding selinux user, or do I need
> to define labeling for the files individually in a new module? And
> how do files in the home dir such as .ssh (which should have a type
> other than user_t) get their types?
>
> Or perhaps something is broken in the distribution that is causing
> labels from the refpolicy not to be applied in the home dir?
>
> Any insights would be appreciated!
Did you build with MONOLITHIC=n?
--
Stephen Smalley
National Security Agency
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 13+ messages in thread
* [refpolicy] Labeling home directories in refpolicy
@ 2010-05-12 14:11 ` Stephen Smalley
0 siblings, 0 replies; 13+ messages in thread
From: Stephen Smalley @ 2010-05-12 14:11 UTC (permalink / raw)
To: refpolicy
On Wed, 2010-05-12 at 10:04 -0400, Alan Rouse wrote:
> I'm trying to adapt a recent refpolicy snapshot (May 4) to OpenSUSE.
> (Previously I adapted the Fedora 12 policy, more as a learning
> exercise.) Now I'm finding that the refpolicy is not labeling home
> directories properly (they all end up as default_t after "fixfiles -F
> relabel"). I'm running unprivileged users as user_u and root as
> sysadm_u, so I expect corresponding labels on files in the home
> directory. Is there a special mechanism for getting the home dirs
> labeled consistent with the corresponding selinux user, or do I need
> to define labeling for the files individually in a new module? And
> how do files in the home dir such as .ssh (which should have a type
> other than user_t) get their types?
>
> Or perhaps something is broken in the distribution that is causing
> labels from the refpolicy not to be applied in the home dir?
>
> Any insights would be appreciated!
Did you build with MONOLITHIC=n?
--
Stephen Smalley
National Security Agency
^ permalink raw reply [flat|nested] 13+ messages in thread
* Re: [refpolicy] Labeling home directories in refpolicy
2010-05-12 14:11 ` [refpolicy] " Stephen Smalley
@ 2010-05-12 14:31 ` Justin P. Mattock
-1 siblings, 0 replies; 13+ messages in thread
From: Justin P. Mattock @ 2010-05-12 14:31 UTC (permalink / raw)
To: Stephen Smalley; +Cc: Alan Rouse, refpolicy, selinux@tycho.nsa.gov
On 05/12/2010 07:11 AM, Stephen Smalley wrote:
> On Wed, 2010-05-12 at 10:04 -0400, Alan Rouse wrote:
>
>> I'm trying to adapt a recent refpolicy snapshot (May 4) to OpenSUSE.
>> (Previously I adapted the Fedora 12 policy, more as a learning
>> exercise.) Now I'm finding that the refpolicy is not labeling home
>> directories properly (they all end up as default_t after "fixfiles -F
>> relabel"). I'm running unprivileged users as user_u and root as
>> sysadm_u, so I expect corresponding labels on files in the home
>> directory. Is there a special mechanism for getting the home dirs
>> labeled consistent with the corresponding selinux user, or do I need
>> to define labeling for the files individually in a new module? And
>> how do files in the home dir such as .ssh (which should have a type
>> other than user_t) get their types?
>>
>> Or perhaps something is broken in the distribution that is causing
>> labels from the refpolicy not to be applied in the home dir?
>>
>> Any insights would be appreciated!
>>
> Did you build with MONOLITHIC=n?
>
>
I've noticed some funkyness with the home dir
labels as well i.g.
id -Z
name:staff_r:staff_t:s0
but the labels go
name name user_r:object_r:user_home_t:s0
if I add a new file the labels get set right
name name name:object_r:user_home_t:s0
maybe something is astray in genhomedircon!
(genhomedircon line#13)
Justin P. Mattock
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 13+ messages in thread
* [refpolicy] Labeling home directories in refpolicy
@ 2010-05-12 14:31 ` Justin P. Mattock
0 siblings, 0 replies; 13+ messages in thread
From: Justin P. Mattock @ 2010-05-12 14:31 UTC (permalink / raw)
To: refpolicy
On 05/12/2010 07:11 AM, Stephen Smalley wrote:
> On Wed, 2010-05-12 at 10:04 -0400, Alan Rouse wrote:
>
>> I'm trying to adapt a recent refpolicy snapshot (May 4) to OpenSUSE.
>> (Previously I adapted the Fedora 12 policy, more as a learning
>> exercise.) Now I'm finding that the refpolicy is not labeling home
>> directories properly (they all end up as default_t after "fixfiles -F
>> relabel"). I'm running unprivileged users as user_u and root as
>> sysadm_u, so I expect corresponding labels on files in the home
>> directory. Is there a special mechanism for getting the home dirs
>> labeled consistent with the corresponding selinux user, or do I need
>> to define labeling for the files individually in a new module? And
>> how do files in the home dir such as .ssh (which should have a type
>> other than user_t) get their types?
>>
>> Or perhaps something is broken in the distribution that is causing
>> labels from the refpolicy not to be applied in the home dir?
>>
>> Any insights would be appreciated!
>>
> Did you build with MONOLITHIC=n?
>
>
I've noticed some funkyness with the home dir
labels as well i.g.
id -Z
name:staff_r:staff_t:s0
but the labels go
name name user_r:object_r:user_home_t:s0
if I add a new file the labels get set right
name name name:object_r:user_home_t:s0
maybe something is astray in genhomedircon!
(genhomedircon line#13)
Justin P. Mattock
^ permalink raw reply [flat|nested] 13+ messages in thread
* Re: [refpolicy] Labeling home directories in refpolicy
2010-05-12 14:31 ` Justin P. Mattock
@ 2010-05-12 14:48 ` Stephen Smalley
-1 siblings, 0 replies; 13+ messages in thread
From: Stephen Smalley @ 2010-05-12 14:48 UTC (permalink / raw)
To: Justin P. Mattock; +Cc: Alan Rouse, refpolicy, selinux@tycho.nsa.gov
On Wed, 2010-05-12 at 07:31 -0700, Justin P. Mattock wrote:
> On 05/12/2010 07:11 AM, Stephen Smalley wrote:
> > On Wed, 2010-05-12 at 10:04 -0400, Alan Rouse wrote:
> >
> >> I'm trying to adapt a recent refpolicy snapshot (May 4) to OpenSUSE.
> >> (Previously I adapted the Fedora 12 policy, more as a learning
> >> exercise.) Now I'm finding that the refpolicy is not labeling home
> >> directories properly (they all end up as default_t after "fixfiles -F
> >> relabel"). I'm running unprivileged users as user_u and root as
> >> sysadm_u, so I expect corresponding labels on files in the home
> >> directory. Is there a special mechanism for getting the home dirs
> >> labeled consistent with the corresponding selinux user, or do I need
> >> to define labeling for the files individually in a new module? And
> >> how do files in the home dir such as .ssh (which should have a type
> >> other than user_t) get their types?
> >>
> >> Or perhaps something is broken in the distribution that is causing
> >> labels from the refpolicy not to be applied in the home dir?
> >>
> >> Any insights would be appreciated!
> >>
> > Did you build with MONOLITHIC=n?
> >
> >
> I've noticed some funkyness with the home dir
> labels as well i.g.
> id -Z
> name:staff_r:staff_t:s0
> but the labels go
> name name user_r:object_r:user_home_t:s0
> if I add a new file the labels get set right
> name name name:object_r:user_home_t:s0
>
> maybe something is astray in genhomedircon!
> (genhomedircon line#13)
The genhomedircon functionality is part of libsemanage these days,
and /usr/sbin/genhomedircon is just a compatibility script that does:
#!/bin/sh
/usr/sbin/semodule -Bn
i.e. rebuild policy in order to regenerate the file_contexts.homedirs
file.
So if policy is monolithic, I'm not sure you get any
file_contexts.homedirs at all.
--
Stephen Smalley
National Security Agency
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 13+ messages in thread
* [refpolicy] Labeling home directories in refpolicy
@ 2010-05-12 14:48 ` Stephen Smalley
0 siblings, 0 replies; 13+ messages in thread
From: Stephen Smalley @ 2010-05-12 14:48 UTC (permalink / raw)
To: refpolicy
On Wed, 2010-05-12 at 07:31 -0700, Justin P. Mattock wrote:
> On 05/12/2010 07:11 AM, Stephen Smalley wrote:
> > On Wed, 2010-05-12 at 10:04 -0400, Alan Rouse wrote:
> >
> >> I'm trying to adapt a recent refpolicy snapshot (May 4) to OpenSUSE.
> >> (Previously I adapted the Fedora 12 policy, more as a learning
> >> exercise.) Now I'm finding that the refpolicy is not labeling home
> >> directories properly (they all end up as default_t after "fixfiles -F
> >> relabel"). I'm running unprivileged users as user_u and root as
> >> sysadm_u, so I expect corresponding labels on files in the home
> >> directory. Is there a special mechanism for getting the home dirs
> >> labeled consistent with the corresponding selinux user, or do I need
> >> to define labeling for the files individually in a new module? And
> >> how do files in the home dir such as .ssh (which should have a type
> >> other than user_t) get their types?
> >>
> >> Or perhaps something is broken in the distribution that is causing
> >> labels from the refpolicy not to be applied in the home dir?
> >>
> >> Any insights would be appreciated!
> >>
> > Did you build with MONOLITHIC=n?
> >
> >
> I've noticed some funkyness with the home dir
> labels as well i.g.
> id -Z
> name:staff_r:staff_t:s0
> but the labels go
> name name user_r:object_r:user_home_t:s0
> if I add a new file the labels get set right
> name name name:object_r:user_home_t:s0
>
> maybe something is astray in genhomedircon!
> (genhomedircon line#13)
The genhomedircon functionality is part of libsemanage these days,
and /usr/sbin/genhomedircon is just a compatibility script that does:
#!/bin/sh
/usr/sbin/semodule -Bn
i.e. rebuild policy in order to regenerate the file_contexts.homedirs
file.
So if policy is monolithic, I'm not sure you get any
file_contexts.homedirs at all.
--
Stephen Smalley
National Security Agency
^ permalink raw reply [flat|nested] 13+ messages in thread
* RE: [refpolicy] Labeling home directories in refpolicy
2010-05-12 14:48 ` Stephen Smalley
@ 2010-05-12 16:44 ` Alan Rouse
-1 siblings, 0 replies; 13+ messages in thread
From: Alan Rouse @ 2010-05-12 16:44 UTC (permalink / raw)
To: Stephen Smalley, Justin P. Mattock
Cc: refpolicy@oss1.tresys.com, selinux@tycho.nsa.gov
Running genhomedircon creates file_contexts.homedirs but it is pretty sparse:
> #
> # Home Context for user unconfined_u
> #
>
> /home/a?quota\.(user|group) -- system_u:object_r:quota_db_t:s0
> /home/lost\+found/.* <<none>>
> /home -d system_u:object_r:home_root_t:s0
> /home/\.journal <<none>>
> /home/lost\+found -d system_u:object_r:lost_found_t:s0
In the source rpm the file policy/modules/system/userdomain.fc differs between fedora and refpolicy. The refpolicy version just has
> HOME_DIR -d gen_context(system_u:object_r:user_home_dir_t,s0-mls_systemhigh)
> HOME_DIR/.+ gen_context(system_u:object_r:user_home_t,s0)
>
> /tmp/gconfd-USER -d gen_context(system_u:object_r:user_tmp_t,s0)
But the fedora version has
> HOME_DIR -d gen_context(system_u:object_r:user_home_dir_t,s0-mls_systemhigh)
> HOME_DIR -l gen_context(system_u:object_r:user_home_dir_t,s0-mls_systemhigh)
> HOME_DIR/.+ gen_context(system_u:object_r:user_home_t,s0)
> /tmp/gconfd-USER -d gen_context(system_u:object_r:user_tmp_t,s0)
> /root(/.*)? gen_context(system_u:object_r:admin_home_t,s0)
> /dev/shm/pulse-shm.* gen_context(system_u:object_r:user_tmpfs_t,s0)
> /dev/shm/mono.* gen_context(system_u:object_r:user_tmpfs_t,s0)
> HOME_DIR/\.cert(/.*)? gen_context(system_u:object_r:home_cert_t,s0)
> HOME_DIR/\.pki(/.*)? gen_context(system_u:object_r:home_cert_t,s0)
> HOME_DIR/\.gvfs(/.*)? <<none>>
> /root/\.cert(/.*)? gen_context(system_u:object_r:home_cert_t,s0)
I don't see the answer to my labeling problems in the fedora version. Am I missing something? Or is there a different .fc that gets involved in correctly labeling user home directories?
-----Original Message-----
From: Stephen Smalley [mailto:sds@tycho.nsa.gov]
Sent: Wednesday, May 12, 2010 10:48 AM
To: Justin P. Mattock
Cc: Alan Rouse; refpolicy@oss1.tresys.com; selinux@tycho.nsa.gov
Subject: Re: [refpolicy] Labeling home directories in refpolicy
On Wed, 2010-05-12 at 07:31 -0700, Justin P. Mattock wrote:
> On 05/12/2010 07:11 AM, Stephen Smalley wrote:
> > On Wed, 2010-05-12 at 10:04 -0400, Alan Rouse wrote:
> >
> >> I'm trying to adapt a recent refpolicy snapshot (May 4) to OpenSUSE.
> >> (Previously I adapted the Fedora 12 policy, more as a learning
> >> exercise.) Now I'm finding that the refpolicy is not labeling home
> >> directories properly (they all end up as default_t after "fixfiles -F
> >> relabel"). I'm running unprivileged users as user_u and root as
> >> sysadm_u, so I expect corresponding labels on files in the home
> >> directory. Is there a special mechanism for getting the home dirs
> >> labeled consistent with the corresponding selinux user, or do I need
> >> to define labeling for the files individually in a new module? And
> >> how do files in the home dir such as .ssh (which should have a type
> >> other than user_t) get their types?
> >>
> >> Or perhaps something is broken in the distribution that is causing
> >> labels from the refpolicy not to be applied in the home dir?
> >>
> >> Any insights would be appreciated!
> >>
> > Did you build with MONOLITHIC=n?
> >
> >
> I've noticed some funkyness with the home dir labels as well i.g.
> id -Z
> name:staff_r:staff_t:s0
> but the labels go
> name name user_r:object_r:user_home_t:s0 if I add a new file the
> labels get set right name name name:object_r:user_home_t:s0
>
> maybe something is astray in genhomedircon!
> (genhomedircon line#13)
The genhomedircon functionality is part of libsemanage these days, and /usr/sbin/genhomedircon is just a compatibility script that does:
#!/bin/sh
/usr/sbin/semodule -Bn
i.e. rebuild policy in order to regenerate the file_contexts.homedirs file.
So if policy is monolithic, I'm not sure you get any file_contexts.homedirs at all.
--
Stephen Smalley
National Security Agency
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 13+ messages in thread
* [refpolicy] Labeling home directories in refpolicy
@ 2010-05-12 16:44 ` Alan Rouse
0 siblings, 0 replies; 13+ messages in thread
From: Alan Rouse @ 2010-05-12 16:44 UTC (permalink / raw)
To: refpolicy
Running genhomedircon creates file_contexts.homedirs but it is pretty sparse:
> #
> # Home Context for user unconfined_u
> #
>
> /home/a?quota\.(user|group) -- system_u:object_r:quota_db_t:s0
> /home/lost\+found/.* <<none>>
> /home -d system_u:object_r:home_root_t:s0
> /home/\.journal <<none>>
> /home/lost\+found -d system_u:object_r:lost_found_t:s0
In the source rpm the file policy/modules/system/userdomain.fc differs between fedora and refpolicy. The refpolicy version just has
> HOME_DIR -d gen_context(system_u:object_r:user_home_dir_t,s0-mls_systemhigh)
> HOME_DIR/.+ gen_context(system_u:object_r:user_home_t,s0)
>
> /tmp/gconfd-USER -d gen_context(system_u:object_r:user_tmp_t,s0)
But the fedora version has
> HOME_DIR -d gen_context(system_u:object_r:user_home_dir_t,s0-mls_systemhigh)
> HOME_DIR -l gen_context(system_u:object_r:user_home_dir_t,s0-mls_systemhigh)
> HOME_DIR/.+ gen_context(system_u:object_r:user_home_t,s0)
> /tmp/gconfd-USER -d gen_context(system_u:object_r:user_tmp_t,s0)
> /root(/.*)? gen_context(system_u:object_r:admin_home_t,s0)
> /dev/shm/pulse-shm.* gen_context(system_u:object_r:user_tmpfs_t,s0)
> /dev/shm/mono.* gen_context(system_u:object_r:user_tmpfs_t,s0)
> HOME_DIR/\.cert(/.*)? gen_context(system_u:object_r:home_cert_t,s0)
> HOME_DIR/\.pki(/.*)? gen_context(system_u:object_r:home_cert_t,s0)
> HOME_DIR/\.gvfs(/.*)? <<none>>
> /root/\.cert(/.*)? gen_context(system_u:object_r:home_cert_t,s0)
I don't see the answer to my labeling problems in the fedora version. Am I missing something? Or is there a different .fc that gets involved in correctly labeling user home directories?
-----Original Message-----
From: Stephen Smalley [mailto:sds at tycho.nsa.gov]
Sent: Wednesday, May 12, 2010 10:48 AM
To: Justin P. Mattock
Cc: Alan Rouse; refpolicy at oss1.tresys.com; selinux at tycho.nsa.gov
Subject: Re: [refpolicy] Labeling home directories in refpolicy
On Wed, 2010-05-12 at 07:31 -0700, Justin P. Mattock wrote:
> On 05/12/2010 07:11 AM, Stephen Smalley wrote:
> > On Wed, 2010-05-12 at 10:04 -0400, Alan Rouse wrote:
> >
> >> I'm trying to adapt a recent refpolicy snapshot (May 4) to OpenSUSE.
> >> (Previously I adapted the Fedora 12 policy, more as a learning
> >> exercise.) Now I'm finding that the refpolicy is not labeling home
> >> directories properly (they all end up as default_t after "fixfiles -F
> >> relabel"). I'm running unprivileged users as user_u and root as
> >> sysadm_u, so I expect corresponding labels on files in the home
> >> directory. Is there a special mechanism for getting the home dirs
> >> labeled consistent with the corresponding selinux user, or do I need
> >> to define labeling for the files individually in a new module? And
> >> how do files in the home dir such as .ssh (which should have a type
> >> other than user_t) get their types?
> >>
> >> Or perhaps something is broken in the distribution that is causing
> >> labels from the refpolicy not to be applied in the home dir?
> >>
> >> Any insights would be appreciated!
> >>
> > Did you build with MONOLITHIC=n?
> >
> >
> I've noticed some funkyness with the home dir labels as well i.g.
> id -Z
> name:staff_r:staff_t:s0
> but the labels go
> name name user_r:object_r:user_home_t:s0 if I add a new file the
> labels get set right name name name:object_r:user_home_t:s0
>
> maybe something is astray in genhomedircon!
> (genhomedircon line#13)
The genhomedircon functionality is part of libsemanage these days, and /usr/sbin/genhomedircon is just a compatibility script that does:
#!/bin/sh
/usr/sbin/semodule -Bn
i.e. rebuild policy in order to regenerate the file_contexts.homedirs file.
So if policy is monolithic, I'm not sure you get any file_contexts.homedirs at all.
--
Stephen Smalley
National Security Agency
^ permalink raw reply [flat|nested] 13+ messages in thread
* Re: [refpolicy] Labeling home directories in refpolicy
2010-05-12 16:44 ` Alan Rouse
@ 2010-05-12 17:40 ` Justin P. Mattock
-1 siblings, 0 replies; 13+ messages in thread
From: Justin P. Mattock @ 2010-05-12 17:40 UTC (permalink / raw)
To: Alan Rouse
Cc: Stephen Smalley, refpolicy@oss1.tresys.com, selinux@tycho.nsa.gov
On 05/12/2010 09:44 AM, Alan Rouse wrote:
> Running genhomedircon creates file_contexts.homedirs but it is pretty sparse:
>
>
>> #
>> # Home Context for user unconfined_u
>> #
>>
>> /home/a?quota\.(user|group) -- system_u:object_r:quota_db_t:s0
>> /home/lost\+found/.* <<none>>
>> /home -d system_u:object_r:home_root_t:s0
>> /home/\.journal <<none>>
>> /home/lost\+found -d system_u:object_r:lost_found_t:s0
>>
> In the source rpm the file policy/modules/system/userdomain.fc differs between fedora and refpolicy. The refpolicy version just has
>
>
>> HOME_DIR -d gen_context(system_u:object_r:user_home_dir_t,s0-mls_systemhigh)
>> HOME_DIR/.+ gen_context(system_u:object_r:user_home_t,s0)
>>
>> /tmp/gconfd-USER -d gen_context(system_u:object_r:user_tmp_t,s0)
>>
> But the fedora version has
>
>
>> HOME_DIR -d gen_context(system_u:object_r:user_home_dir_t,s0-mls_systemhigh)
>> HOME_DIR -l gen_context(system_u:object_r:user_home_dir_t,s0-mls_systemhigh)
>> HOME_DIR/.+ gen_context(system_u:object_r:user_home_t,s0)
>> /tmp/gconfd-USER -d gen_context(system_u:object_r:user_tmp_t,s0)
>> /root(/.*)? gen_context(system_u:object_r:admin_home_t,s0)
>> /dev/shm/pulse-shm.* gen_context(system_u:object_r:user_tmpfs_t,s0)
>> /dev/shm/mono.* gen_context(system_u:object_r:user_tmpfs_t,s0)
>> HOME_DIR/\.cert(/.*)? gen_context(system_u:object_r:home_cert_t,s0)
>> HOME_DIR/\.pki(/.*)? gen_context(system_u:object_r:home_cert_t,s0)
>> HOME_DIR/\.gvfs(/.*)? <<none>>
>> /root/\.cert(/.*)? gen_context(system_u:object_r:home_cert_t,s0)
>>
> I don't see the answer to my labeling problems in the fedora version. Am I missing something? Or is there a different .fc that gets involved in correctly labeling user home directories?
>
> -----Original Message-----
> From: Stephen Smalley [mailto:sds@tycho.nsa.gov]
> Sent: Wednesday, May 12, 2010 10:48 AM
> To: Justin P. Mattock
> Cc: Alan Rouse; refpolicy@oss1.tresys.com; selinux@tycho.nsa.gov
> Subject: Re: [refpolicy] Labeling home directories in refpolicy
>
> On Wed, 2010-05-12 at 07:31 -0700, Justin P. Mattock wrote:
>
>> On 05/12/2010 07:11 AM, Stephen Smalley wrote:
>>
>>> On Wed, 2010-05-12 at 10:04 -0400, Alan Rouse wrote:
>>>
>>>
>>>> I'm trying to adapt a recent refpolicy snapshot (May 4) to OpenSUSE.
>>>> (Previously I adapted the Fedora 12 policy, more as a learning
>>>> exercise.) Now I'm finding that the refpolicy is not labeling home
>>>> directories properly (they all end up as default_t after "fixfiles -F
>>>> relabel"). I'm running unprivileged users as user_u and root as
>>>> sysadm_u, so I expect corresponding labels on files in the home
>>>> directory. Is there a special mechanism for getting the home dirs
>>>> labeled consistent with the corresponding selinux user, or do I need
>>>> to define labeling for the files individually in a new module? And
>>>> how do files in the home dir such as .ssh (which should have a type
>>>> other than user_t) get their types?
>>>>
>>>> Or perhaps something is broken in the distribution that is causing
>>>> labels from the refpolicy not to be applied in the home dir?
>>>>
>>>> Any insights would be appreciated!
>>>>
>>>>
>>> Did you build with MONOLITHIC=n?
>>>
>>>
>>>
>> I've noticed some funkyness with the home dir labels as well i.g.
>> id -Z
>> name:staff_r:staff_t:s0
>> but the labels go
>> name name user_r:object_r:user_home_t:s0 if I add a new file the
>> labels get set right name name name:object_r:user_home_t:s0
>>
>> maybe something is astray in genhomedircon!
>> (genhomedircon line#13)
>>
> The genhomedircon functionality is part of libsemanage these days, and /usr/sbin/genhomedircon is just a compatibility script that does:
> #!/bin/sh
> /usr/sbin/semodule -Bn
>
> i.e. rebuild policy in order to regenerate the file_contexts.homedirs file.
>
> So if policy is monolithic, I'm not sure you get any file_contexts.homedirs at all.
>
> --
> Stephen Smalley
> National Security Agency
>
>
>
hm.. what I can do is a bisect on refpolicy,
and userspace tools to see what I find.
(will be in a few days or so..)
Justin P. Mattock
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 13+ messages in thread
* [refpolicy] Labeling home directories in refpolicy
@ 2010-05-12 17:40 ` Justin P. Mattock
0 siblings, 0 replies; 13+ messages in thread
From: Justin P. Mattock @ 2010-05-12 17:40 UTC (permalink / raw)
To: refpolicy
On 05/12/2010 09:44 AM, Alan Rouse wrote:
> Running genhomedircon creates file_contexts.homedirs but it is pretty sparse:
>
>
>> #
>> # Home Context for user unconfined_u
>> #
>>
>> /home/a?quota\.(user|group) -- system_u:object_r:quota_db_t:s0
>> /home/lost\+found/.* <<none>>
>> /home -d system_u:object_r:home_root_t:s0
>> /home/\.journal <<none>>
>> /home/lost\+found -d system_u:object_r:lost_found_t:s0
>>
> In the source rpm the file policy/modules/system/userdomain.fc differs between fedora and refpolicy. The refpolicy version just has
>
>
>> HOME_DIR -d gen_context(system_u:object_r:user_home_dir_t,s0-mls_systemhigh)
>> HOME_DIR/.+ gen_context(system_u:object_r:user_home_t,s0)
>>
>> /tmp/gconfd-USER -d gen_context(system_u:object_r:user_tmp_t,s0)
>>
> But the fedora version has
>
>
>> HOME_DIR -d gen_context(system_u:object_r:user_home_dir_t,s0-mls_systemhigh)
>> HOME_DIR -l gen_context(system_u:object_r:user_home_dir_t,s0-mls_systemhigh)
>> HOME_DIR/.+ gen_context(system_u:object_r:user_home_t,s0)
>> /tmp/gconfd-USER -d gen_context(system_u:object_r:user_tmp_t,s0)
>> /root(/.*)? gen_context(system_u:object_r:admin_home_t,s0)
>> /dev/shm/pulse-shm.* gen_context(system_u:object_r:user_tmpfs_t,s0)
>> /dev/shm/mono.* gen_context(system_u:object_r:user_tmpfs_t,s0)
>> HOME_DIR/\.cert(/.*)? gen_context(system_u:object_r:home_cert_t,s0)
>> HOME_DIR/\.pki(/.*)? gen_context(system_u:object_r:home_cert_t,s0)
>> HOME_DIR/\.gvfs(/.*)? <<none>>
>> /root/\.cert(/.*)? gen_context(system_u:object_r:home_cert_t,s0)
>>
> I don't see the answer to my labeling problems in the fedora version. Am I missing something? Or is there a different .fc that gets involved in correctly labeling user home directories?
>
> -----Original Message-----
> From: Stephen Smalley [mailto:sds at tycho.nsa.gov]
> Sent: Wednesday, May 12, 2010 10:48 AM
> To: Justin P. Mattock
> Cc: Alan Rouse; refpolicy at oss1.tresys.com; selinux at tycho.nsa.gov
> Subject: Re: [refpolicy] Labeling home directories in refpolicy
>
> On Wed, 2010-05-12 at 07:31 -0700, Justin P. Mattock wrote:
>
>> On 05/12/2010 07:11 AM, Stephen Smalley wrote:
>>
>>> On Wed, 2010-05-12 at 10:04 -0400, Alan Rouse wrote:
>>>
>>>
>>>> I'm trying to adapt a recent refpolicy snapshot (May 4) to OpenSUSE.
>>>> (Previously I adapted the Fedora 12 policy, more as a learning
>>>> exercise.) Now I'm finding that the refpolicy is not labeling home
>>>> directories properly (they all end up as default_t after "fixfiles -F
>>>> relabel"). I'm running unprivileged users as user_u and root as
>>>> sysadm_u, so I expect corresponding labels on files in the home
>>>> directory. Is there a special mechanism for getting the home dirs
>>>> labeled consistent with the corresponding selinux user, or do I need
>>>> to define labeling for the files individually in a new module? And
>>>> how do files in the home dir such as .ssh (which should have a type
>>>> other than user_t) get their types?
>>>>
>>>> Or perhaps something is broken in the distribution that is causing
>>>> labels from the refpolicy not to be applied in the home dir?
>>>>
>>>> Any insights would be appreciated!
>>>>
>>>>
>>> Did you build with MONOLITHIC=n?
>>>
>>>
>>>
>> I've noticed some funkyness with the home dir labels as well i.g.
>> id -Z
>> name:staff_r:staff_t:s0
>> but the labels go
>> name name user_r:object_r:user_home_t:s0 if I add a new file the
>> labels get set right name name name:object_r:user_home_t:s0
>>
>> maybe something is astray in genhomedircon!
>> (genhomedircon line#13)
>>
> The genhomedircon functionality is part of libsemanage these days, and /usr/sbin/genhomedircon is just a compatibility script that does:
> #!/bin/sh
> /usr/sbin/semodule -Bn
>
> i.e. rebuild policy in order to regenerate the file_contexts.homedirs file.
>
> So if policy is monolithic, I'm not sure you get any file_contexts.homedirs at all.
>
> --
> Stephen Smalley
> National Security Agency
>
>
>
hm.. what I can do is a bisect on refpolicy,
and userspace tools to see what I find.
(will be in a few days or so..)
Justin P. Mattock
^ permalink raw reply [flat|nested] 13+ messages in thread
* RE: [refpolicy] Labeling home directories in refpolicy (SOLVED)
2010-05-12 16:44 ` Alan Rouse
@ 2010-05-12 17:52 ` Alan Rouse
-1 siblings, 0 replies; 13+ messages in thread
From: Alan Rouse @ 2010-05-12 17:52 UTC (permalink / raw)
To: Stephen Smalley, Justin P. Mattock
Cc: refpolicy@oss1.tresys.com, selinux@tycho.nsa.gov
It seems the problem was due to the fact that on this particular VM I had neglected to set the selinux user for the unprivileged login (semanage -a -s user_u <login>).
-----Original Message-----
From: refpolicy-bounces@oss.tresys.com [mailto:refpolicy-bounces@oss.tresys.com] On Behalf Of Alan Rouse
Sent: Wednesday, May 12, 2010 12:44 PM
To: Stephen Smalley; Justin P. Mattock
Cc: refpolicy@oss1.tresys.com; selinux@tycho.nsa.gov
Subject: Re: [refpolicy] Labeling home directories in refpolicy
Running genhomedircon creates file_contexts.homedirs but it is pretty sparse:
> #
> # Home Context for user unconfined_u
> #
>
> /home/a?quota\.(user|group) -- system_u:object_r:quota_db_t:s0
> /home/lost\+found/.* <<none>>
> /home -d system_u:object_r:home_root_t:s0
> /home/\.journal <<none>>
> /home/lost\+found -d system_u:object_r:lost_found_t:s0
In the source rpm the file policy/modules/system/userdomain.fc differs between fedora and refpolicy. The refpolicy version just has
> HOME_DIR -d gen_context(system_u:object_r:user_home_dir_t,s0-mls_systemhigh)
> HOME_DIR/.+ gen_context(system_u:object_r:user_home_t,s0)
>
> /tmp/gconfd-USER -d gen_context(system_u:object_r:user_tmp_t,s0)
But the fedora version has
> HOME_DIR -d gen_context(system_u:object_r:user_home_dir_t,s0-mls_systemhigh)
> HOME_DIR -l gen_context(system_u:object_r:user_home_dir_t,s0-mls_systemhigh)
> HOME_DIR/.+ gen_context(system_u:object_r:user_home_t,s0)
> /tmp/gconfd-USER -d gen_context(system_u:object_r:user_tmp_t,s0)
> /root(/.*)? gen_context(system_u:object_r:admin_home_t,s0)
> /dev/shm/pulse-shm.* gen_context(system_u:object_r:user_tmpfs_t,s0)
> /dev/shm/mono.* gen_context(system_u:object_r:user_tmpfs_t,s0)
> HOME_DIR/\.cert(/.*)? gen_context(system_u:object_r:home_cert_t,s0)
> HOME_DIR/\.pki(/.*)? gen_context(system_u:object_r:home_cert_t,s0)
> HOME_DIR/\.gvfs(/.*)? <<none>>
> /root/\.cert(/.*)? gen_context(system_u:object_r:home_cert_t,s0)
I don't see the answer to my labeling problems in the fedora version. Am I missing something? Or is there a different .fc that gets involved in correctly labeling user home directories?
-----Original Message-----
From: Stephen Smalley [mailto:sds@tycho.nsa.gov]
Sent: Wednesday, May 12, 2010 10:48 AM
To: Justin P. Mattock
Cc: Alan Rouse; refpolicy@oss1.tresys.com; selinux@tycho.nsa.gov
Subject: Re: [refpolicy] Labeling home directories in refpolicy
On Wed, 2010-05-12 at 07:31 -0700, Justin P. Mattock wrote:
> On 05/12/2010 07:11 AM, Stephen Smalley wrote:
> > On Wed, 2010-05-12 at 10:04 -0400, Alan Rouse wrote:
> >
> >> I'm trying to adapt a recent refpolicy snapshot (May 4) to OpenSUSE.
> >> (Previously I adapted the Fedora 12 policy, more as a learning
> >> exercise.) Now I'm finding that the refpolicy is not labeling home
> >> directories properly (they all end up as default_t after "fixfiles -F
> >> relabel"). I'm running unprivileged users as user_u and root as
> >> sysadm_u, so I expect corresponding labels on files in the home
> >> directory. Is there a special mechanism for getting the home dirs
> >> labeled consistent with the corresponding selinux user, or do I need
> >> to define labeling for the files individually in a new module? And
> >> how do files in the home dir such as .ssh (which should have a type
> >> other than user_t) get their types?
> >>
> >> Or perhaps something is broken in the distribution that is causing
> >> labels from the refpolicy not to be applied in the home dir?
> >>
> >> Any insights would be appreciated!
> >>
> > Did you build with MONOLITHIC=n?
> >
> >
> I've noticed some funkyness with the home dir labels as well i.g.
> id -Z
> name:staff_r:staff_t:s0
> but the labels go
> name name user_r:object_r:user_home_t:s0 if I add a new file the
> labels get set right name name name:object_r:user_home_t:s0
>
> maybe something is astray in genhomedircon!
> (genhomedircon line#13)
The genhomedircon functionality is part of libsemanage these days, and /usr/sbin/genhomedircon is just a compatibility script that does:
#!/bin/sh
/usr/sbin/semodule -Bn
i.e. rebuild policy in order to regenerate the file_contexts.homedirs file.
So if policy is monolithic, I'm not sure you get any file_contexts.homedirs at all.
--
Stephen Smalley
National Security Agency
_______________________________________________
refpolicy mailing list
refpolicy@oss.tresys.com
http://oss.tresys.com/mailman/listinfo/refpolicy
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 13+ messages in thread
* [refpolicy] Labeling home directories in refpolicy (SOLVED)
@ 2010-05-12 17:52 ` Alan Rouse
0 siblings, 0 replies; 13+ messages in thread
From: Alan Rouse @ 2010-05-12 17:52 UTC (permalink / raw)
To: refpolicy
It seems the problem was due to the fact that on this particular VM I had neglected to set the selinux user for the unprivileged login (semanage -a -s user_u <login>).
-----Original Message-----
From: refpolicy-bounces@oss.tresys.com [mailto:refpolicy-bounces at oss.tresys.com] On Behalf Of Alan Rouse
Sent: Wednesday, May 12, 2010 12:44 PM
To: Stephen Smalley; Justin P. Mattock
Cc: refpolicy at oss1.tresys.com; selinux at tycho.nsa.gov
Subject: Re: [refpolicy] Labeling home directories in refpolicy
Running genhomedircon creates file_contexts.homedirs but it is pretty sparse:
> #
> # Home Context for user unconfined_u
> #
>
> /home/a?quota\.(user|group) -- system_u:object_r:quota_db_t:s0
> /home/lost\+found/.* <<none>>
> /home -d system_u:object_r:home_root_t:s0
> /home/\.journal <<none>>
> /home/lost\+found -d system_u:object_r:lost_found_t:s0
In the source rpm the file policy/modules/system/userdomain.fc differs between fedora and refpolicy. The refpolicy version just has
> HOME_DIR -d gen_context(system_u:object_r:user_home_dir_t,s0-mls_systemhigh)
> HOME_DIR/.+ gen_context(system_u:object_r:user_home_t,s0)
>
> /tmp/gconfd-USER -d gen_context(system_u:object_r:user_tmp_t,s0)
But the fedora version has
> HOME_DIR -d gen_context(system_u:object_r:user_home_dir_t,s0-mls_systemhigh)
> HOME_DIR -l gen_context(system_u:object_r:user_home_dir_t,s0-mls_systemhigh)
> HOME_DIR/.+ gen_context(system_u:object_r:user_home_t,s0)
> /tmp/gconfd-USER -d gen_context(system_u:object_r:user_tmp_t,s0)
> /root(/.*)? gen_context(system_u:object_r:admin_home_t,s0)
> /dev/shm/pulse-shm.* gen_context(system_u:object_r:user_tmpfs_t,s0)
> /dev/shm/mono.* gen_context(system_u:object_r:user_tmpfs_t,s0)
> HOME_DIR/\.cert(/.*)? gen_context(system_u:object_r:home_cert_t,s0)
> HOME_DIR/\.pki(/.*)? gen_context(system_u:object_r:home_cert_t,s0)
> HOME_DIR/\.gvfs(/.*)? <<none>>
> /root/\.cert(/.*)? gen_context(system_u:object_r:home_cert_t,s0)
I don't see the answer to my labeling problems in the fedora version. Am I missing something? Or is there a different .fc that gets involved in correctly labeling user home directories?
-----Original Message-----
From: Stephen Smalley [mailto:sds at tycho.nsa.gov]
Sent: Wednesday, May 12, 2010 10:48 AM
To: Justin P. Mattock
Cc: Alan Rouse; refpolicy at oss1.tresys.com; selinux at tycho.nsa.gov
Subject: Re: [refpolicy] Labeling home directories in refpolicy
On Wed, 2010-05-12 at 07:31 -0700, Justin P. Mattock wrote:
> On 05/12/2010 07:11 AM, Stephen Smalley wrote:
> > On Wed, 2010-05-12 at 10:04 -0400, Alan Rouse wrote:
> >
> >> I'm trying to adapt a recent refpolicy snapshot (May 4) to OpenSUSE.
> >> (Previously I adapted the Fedora 12 policy, more as a learning
> >> exercise.) Now I'm finding that the refpolicy is not labeling home
> >> directories properly (they all end up as default_t after "fixfiles -F
> >> relabel"). I'm running unprivileged users as user_u and root as
> >> sysadm_u, so I expect corresponding labels on files in the home
> >> directory. Is there a special mechanism for getting the home dirs
> >> labeled consistent with the corresponding selinux user, or do I need
> >> to define labeling for the files individually in a new module? And
> >> how do files in the home dir such as .ssh (which should have a type
> >> other than user_t) get their types?
> >>
> >> Or perhaps something is broken in the distribution that is causing
> >> labels from the refpolicy not to be applied in the home dir?
> >>
> >> Any insights would be appreciated!
> >>
> > Did you build with MONOLITHIC=n?
> >
> >
> I've noticed some funkyness with the home dir labels as well i.g.
> id -Z
> name:staff_r:staff_t:s0
> but the labels go
> name name user_r:object_r:user_home_t:s0 if I add a new file the
> labels get set right name name name:object_r:user_home_t:s0
>
> maybe something is astray in genhomedircon!
> (genhomedircon line#13)
The genhomedircon functionality is part of libsemanage these days, and /usr/sbin/genhomedircon is just a compatibility script that does:
#!/bin/sh
/usr/sbin/semodule -Bn
i.e. rebuild policy in order to regenerate the file_contexts.homedirs file.
So if policy is monolithic, I'm not sure you get any file_contexts.homedirs at all.
--
Stephen Smalley
National Security Agency
_______________________________________________
refpolicy mailing list
refpolicy at oss.tresys.com
http://oss.tresys.com/mailman/listinfo/refpolicy
^ permalink raw reply [flat|nested] 13+ messages in thread
end of thread, other threads:[~2010-05-12 17:52 UTC | newest]
Thread overview: 13+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2010-05-12 14:04 Labeling home directories in refpolicy Alan Rouse
2010-05-12 14:11 ` Stephen Smalley
2010-05-12 14:11 ` [refpolicy] " Stephen Smalley
2010-05-12 14:31 ` Justin P. Mattock
2010-05-12 14:31 ` Justin P. Mattock
2010-05-12 14:48 ` Stephen Smalley
2010-05-12 14:48 ` Stephen Smalley
2010-05-12 16:44 ` Alan Rouse
2010-05-12 16:44 ` Alan Rouse
2010-05-12 17:40 ` Justin P. Mattock
2010-05-12 17:40 ` Justin P. Mattock
2010-05-12 17:52 ` [refpolicy] Labeling home directories in refpolicy (SOLVED) Alan Rouse
2010-05-12 17:52 ` Alan Rouse
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.