We have an interesting problem with pam_namespace on mls boxes

[Daniel J Walsh <dwalsh@redhat.com>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

We want to be able to create a new directory at different levels when
a user logs in.  The first time  user logs in at s2 on an mls box
without a namespaced homedir, pam_namespace would create the s2
directory and mount it over ~/.  Currently we also execute a script to
copy the files from /etc/skell onto the newly created homedir and then
run restorecon on the content to make sure everything has the correct
types.  BUT this hammers the MLS Levels and sets everything as s0.
Not what we want.

1 We can either turn the restorecon off for mls boxes, which will
create files with the wrong types,

2 Not copy /etc/skel, which will eliminate functionality.

3 Change restorecon to not change the Level unless you specify -F.
Meaning restorecon will only change the USER/ROLE/TYPE.

4 Hack up the script to use matchpatcon/secon/chcon -t to fix the
types of files created.

Any way we go we still end up with a potential problem in that a user
admin running restorecon on a file could lower the level of the data
to s0, accidentally.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEYEARECAAYFAk5WcY4ACgkQrlYvE4MpobMTlwCeNDyvfpV8GO8TAODiTLfT0hbi
g4QAnjwlCzkQlvjzXXf85EhU58o78h96
=egdc
-----END PGP SIGNATURE-----

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.