Bug 2209265

Summary:	Enhance polyinstantiation configuration file
Product:	Red Hat Enterprise Linux 9	Reporter:	Renaud Métrich <rmetrich>
Component:	pam	Assignee:	Iker Pedrosa <ipedrosa>
Status:	CLOSED DEFERRED	QA Contact:	sssd-qe
Severity:	low	Docs Contact:
Priority:	low
Version:	9.2	CC:	aboscatt, pbrezina
Target Milestone:	rc
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:	sync-to-jira
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2023-06-27 15:19:00 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Renaud Métrich 2023-05-23 09:38:13 UTC

Description of problem:

There are several issues with /etc/security/namespace.conf, some cosmetic, some not.

1. Alignment issue

The first paragraph goes beyond 80 characters:
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------
# Uncommenting the following three lines will polyinstantiate
# /tmp, /var/tmp and user's home directories. /tmp and /var/tmp will
# be polyinstantiated based on the MLS level part of the security context as well as user
# name, Polyinstantion will not be performed for user root and adm for directories
# /tmp and /var/tmp, whereas home directories will be polyinstantiated for all users.
# The user name and context is appended to the instance prefix.
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------

2. Nowhere we warn the user that polyinstantiation requires enabling "polyinstantiation_enabled" SELinux boolean on SELinux-enabled system

I think it would be nice adding it.
Additionally if the admin chooses a different path than "/tmp/tmp-inst" and "/var/tmp/tmp-inst", then he needs to add SELinux equivalency rules to make sure "tmp_t" is applied.
Example: semanage fcontext -a -e /tmp-inst /my/custom/tmp-inst

3. The text states that "pam_namespace_helper" automatically executes at boot to create the directories

This is not true, it's actually through "pam_namespace.service" that this gets created.
But actually I don't see "pam_namespace.service" executing at all on my system, it's a static service unit which isn't pulled by anything.
It looks like to me this service is not needed at all, since just logging in as a polyinstantiated user makes the directories be automatically created somehow (I guess it's through pam_namespace.so).

Version-Release number of selected component (if applicable):

pam-1.5.1-14.el9.x86_64

How reproducible:

Always

Steps to Reproduce: see above

Comment 1 Andre Boscatto 2023-06-27 15:19:00 UTC

Please know that we carefully considered and evaluated your request and its potential impact on our product roadmap, market demand, and overall strategy.

While we understand that addressing enhancements, bugs, and issues is critical for ensuring the quality and reliability of our product, we need to balance these priorities with our long-term goals and resource constraints. Unfortunately, we cannot address this request at this time as it does not align with our product vision and strategy, and keeping it in the backlog would be misleading and give the false impression that we will address it in the future, thus we are closing it.

Although we cannot address this specific request, we encourage anyone to collaborate and contribute to the upstream communities, as this approach enhances the flexibility, scalability, and customization of our solution while maintaining its security and stability.

We apologize for any inconvenience this may cause, and we understand that it can be frustrating when requests/expectations are not met. However, we hope that you can appreciate that we must balance our priorities with our long-term goals and resource constraints.

Please be aware that while you are welcome to open a new support case or reopen this request, we cannot guarantee that it will be addressed due to resource constraints and the prioritization of other requests.

Once again, thank you for taking the time to share feedback with us, and we look forward to continuing to work together to deliver the best possible solution, supporting in any way we can.

Thank you for understanding,

André Boscatto
Product Owner - Identity and Access Management Department