Description of problem:

(note: while this was tested in mls, the problem might technically appear with targeted policy as well!)

According to SELinux Users and Administrators Guide [1] for RHEL7, the user can configure polyinstation on /tmp and /var/tmp as

/tmp     /tmp-inst/            level      root,adm
/var/tmp /var/tmp/tmp-inst/    level      root,adm

and when searching the policy, there's support for that:

# semanage fcontext -l | grep inst | grep -v install
/tmp-inst                                          all files          system_u:object_r:tmp_t:s0 
/var/tmp-inst                                      directory          system_u:object_r:tmp_t:s0 

(which could be technically achieved by using selinux fcontext equivalency, but either works).

The guide also mentions home dir instantiation,

$HOME    $HOME/$USER.inst/     level

which isn't supported by the policy (no fcontext rules as far as I see), presumably due to the variable nature of $HOME or $USER.

One way to support it would be to use a non-variable instantiation root dir (ie. /home/home-inst) and define it as home_root_t in the policy - like tmp_t for /tmp-inst - or let the admin simply add fcontext equivalency from /home to wherever the destination is.

The issue is that (tty) login / sshd isn't allowed (via pam_namespace) to create instantiated homedirs in home_root_t, which also needs to be fixed:

----
time->Tue Oct 27 15:17:46 2015
type=SYSCALL msg=audit(1445955466.781:1203): arch=c000003e syscall=83 success=no exit=-13 a0=7fc75948f640 a1=100 a2=7fc7574f4780 a3=0 items=0 ppid=3149 pid=3151 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=15 comm="ssh-keycat" exe="/usr/libexec/openssh/ssh-keycat" subj=system_u:system_r:sshd_t:s0-s15:c0.c1023 key=(null)
type=AVC msg=audit(1445955466.781:1203): avc:  denied  { create } for  pid=3151 comm="ssh-keycat" name="staff_u:object_r:user_home_dir_t:s0-s15:c0.c1023_eal" scontext=system_u:system_r:sshd_t:s0-s15:c0.c1023 tcontext=system_u:object_r:home_root_t:s0 tclass=dir
----
time->Tue Oct 27 15:17:48 2015
type=SYSCALL msg=audit(1445955468.901:1216): arch=c000003e syscall=83 success=no exit=-13 a0=7f2d2f8d21a0 a1=100 a2=7f2d2c416780 a3=0 items=0 ppid=1003 pid=3149 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=16 comm="sshd" exe="/usr/sbin/sshd" subj=system_u:system_r:sshd_t:s0-s15:c0.c1023 key=(null)
type=AVC msg=audit(1445955468.901:1216): avc:  denied  { create } for  pid=3149 comm="sshd" name="staff_u:object_r:user_home_dir_t:s0-s15:c0.c1023_eal" scontext=system_u:system_r:sshd_t:s0-s15:c0.c1023 tcontext=system_u:object_r:home_root_t:s0 tclass=dir

and

----
time->Tue Oct 27 15:20:51 2015
type=SYSCALL msg=audit(1445955651.355:1368): arch=c000003e syscall=83 success=no exit=-13 a0=1558610 a1=100 a2=7f3fd73ac780 a3=0 items=0 ppid=1 pid=3304 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=ttyS0 ses=20 comm="login" exe="/usr/bin/login" subj=system_u:system_r:local_login_t:s0-s15:c0.c1023 key=(null)
type=AVC msg=audit(1445955651.355:1368): avc:  denied  { create } for  pid=3304 comm="login" name="staff_u:object_r:user_home_dir_t:s0-s15:c0.c1023_eal" scontext=system_u:system_r:local_login_t:s0-s15:c0.c1023 tcontext=system_u:object_r:home_root_t:s0 tclass=dir

When both are allowed via a custom module,

------------------8<----------------------
policy_module(testmod,1.0);

require {
        type home_root_t;
        type local_login_t;
        type sshd_t;
        class dir create;
}

#============= local_login_t ==============
allow local_login_t home_root_t:dir create;

#============= sshd_t ==============
allow sshd_t home_root_t:dir create;
------------------8<----------------------

both ssh and tty console login (creation of instantiated home) work as expected under home_root_t.


There's also one related issue - currently, due to missing home-inst (or $USER.inst) rules in the policy, new files/dirs inside the instantiated home dir get created with correct context only thanks to user_home_dir_t and type transition rules, so with our theoretical /home/home-inst/, it "just works" during runtime because sshd/login creates /home/home-inst/staff_u:object_r:user_home_dir_t:s0-s15:c0.c1023_username/ correctly with user_home_dir_t, so that ie. ~/.screen gets screen_home_t thanks to:

# sesearch -T -s staff_screen_t -t user_home_dir_t
Found 1 semantic te rules:
   type_transition staff_screen_t user_home_dir_t : dir screen_home_t; 

However if the admin runs restorecon (even without -F) or autorelabel, on /home/home-inst, all dirs under /home/home-inst get user_home_t instead of user_home_dir_t, making all users unable to log in. This - again - is solved either by putting /home/home-inst (or $HOME/$USER.inst) into the policy or defining a fcontext equivalency by the admin, as mentioned before.


(So, to mention it explicitly, if an admin configures polyinstation for user homedirs according to the guide [1], the system becomes unusable/broken after the first restorecon/autorelabel.)


[1]: https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html-single/SELinux_Users_and_Administrators_Guide/index.html#polyinstantiated-directories


My suggestion would be to implement the AVC fixes from above into the policy + define a static /home/home-inst or /home-inst for user homedir polyinstantiation (like with /tmp-inst) with home_root_t fcontext (either as a separate rule or via equivalency from /home). And also fix the guide.


Version-Release number of selected component (if applicable):
selinux-policy-3.13.1-60.el7