Bug 146337 - genhomedircon needs better handling of subdirs
genhomedircon needs better handling of subdirs
Product: Fedora
Classification: Fedora
Component: policycoreutils (Show other bugs)
All Linux
medium Severity medium
: ---
: ---
Assigned To: Daniel Walsh
Ben Levenson
Depends On:
  Show dependency treegraph
Reported: 2005-01-27 01:00 EST by Alexandre Oliva
Modified: 2007-11-30 17:10 EST (History)
2 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2005-03-11 13:02:03 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

  None (edit)
Description Alexandre Oliva 2005-01-27 01:00:41 EST
Forcing /home (or whatever useradd defaults to) into prefixes can have
a very bad side effect if your actual home dir roots are subdirs of
/home.  You end up with file contexts such as:

/home/foo               -d      system_u:object_r:home_root_t
/home           -d      system_u:object_r:home_root_t
/home/foo/[^/]+         -d      system_u:object_r:user_home_dir_t
/home/[^/]+             -d      system_u:object_r:user_home_dir_t
/home/foo/[^/]+/.+                      system_u:object_r:user_home_t
/home/[^/]+/.+                  system_u:object_r:user_home_t

So you see, /home/foo ends up labeled as user_home_t, not home_root_t,
and things don't quite work as expected.

Sure enough, having a single /home/foo is easy, and you can simply
adjust useradd's default to match that, but if you have many, no
default would be appropriate, and you then have to be careful to never
choose a dir that has any home dir as a subdir.  In fact, if you have
home dir roots that are subdirs of each other, things get
unpredictable, since the order of the hash keys is unpredictable. 
They should be sorted from outermost to innermost to get the correct
behavior and, even then, you have to group all above entries per
HOME_DIR before all such entries for nested homedirs, otherwise you
get incorrect labels.

Version-Release number of selected component (if applicable):

How reproducible:

Steps to Reproduce:
1.Create a user with home in /foo/bar
2.Create another user with home in /foo/baz/bad
3.Update file_contexts

Actual Results:  /foo/baz will have conflicting rules.

Expected Results:  They should be ordered properly, so as to be
Comment 1 Daniel Walsh 2005-02-21 18:28:42 EST
We have rewritten genhomedircon in rawhide to better handle this situation.

Note You need to log in before you can comment on or make changes to this bug.