[PATCH] HOME on /var causes incorrect labelling

[PATCH] HOME on /var causes incorrect labelling

[Laurens Blankers]

[-- Attachment #1: Type: text/plain, Size: 538 bytes --]

Hello list,

My users home directory is /var/home. It gets incorrectly labelled as
var_t in stead of home_root_t/user_home_dir_t because of the order of
declarations in types.fc. Moving the declaration of HOME to directly
after /var solves the problem.

This of course may introduce another problem when /var is actually
/home/var, but that is a very unlikely scenario. While home in /var is
more common (in my experience).

I have attached a patch (against policy 1.20) which modifies types.fc
accordingly.

Sincerely,

Laurens Blankers

[-- Attachment #2: policy-varhome.patch --]
[-- Type: application/octet-stream, Size: 1599 bytes --]

--- file_contexts/types.fc	2005-01-05 17:38:40.000000000 +0100
+++ /etc/selinux/targeted/src/policy/file_contexts/types.fc	2005-02-18 13:00:55.604875312 +0100
@@ -44,19 +44,6 @@
 /			-d	system_u:object_r:root_t
 
 #
-# Ordinary user home directories.
-# HOME_ROOT expands to all valid home directory prefixes found in /etc/passwd
-# HOME_DIR expands to each user's home directory,
-#                  and to HOME_ROOT/[^/]+ for each HOME_ROOT.
-# ROLE expands to each user's role when role != user_r, and to "user" otherwise.
-#
-HOME_ROOT		-d	system_u:object_r:home_root_t
-HOME_DIR		-d	system_u:object_r:ROLE_home_dir_t
-HOME_DIR/.+			system_u:object_r:ROLE_home_t
-
-/root/\.default_contexts	-- 	system_u:object_r:default_context_t
-
-#
 # Mount points; do not relabel subdirectories, since
 # we don't want to change any removable media by default.
 /mnt(/[^/]*)?		-d	system_u:object_r:mnt_t
@@ -84,6 +71,19 @@
 /var/mailman/pythonlib(/.*)?/.*\.so(\..*)?	-- system_u:object_r:shlib_t
 
 #
+# Ordinary user home directories.
+# HOME_ROOT expands to all valid home directory prefixes found in /etc/passwd
+# HOME_DIR expands to each user's home directory,
+#                  and to HOME_ROOT/[^/]+ for each HOME_ROOT.
+# ROLE expands to each user's role when role != user_r, and to "user" otherwise.
+#
+HOME_ROOT       -d  system_u:object_r:home_root_t
+HOME_DIR        -d  system_u:object_r:ROLE_home_dir_t
+HOME_DIR/.+         system_u:object_r:ROLE_home_t
+
+/root/\.default_contexts    --  system_u:object_r:default_context_t
+
+#
 # /var/ftp
 #
 /var/ftp/bin(/.*)?		system_u:object_r:bin_t