Red Hat Bugzilla – Bug 409671
policies no longer updated to reflect home directories different than /home
Last modified: 2008-05-07 16:15:04 EDT
Description of problem:
With home directory paths for users with UIDs >= 500 different than "/home", the
policies no longer get updated (rebuilt) to reflect that fact. This causes files
in home directories not under /home to not be labelled with the correct SELinux
security context type. Given that F8 contains a number of rules for such
processes as sshd, gdm, xsetroot and X that limit their access to home
directories for files not correctly labeled, this causes a number of problems
(particularly severe for sshd).
genhomedircon in versions prior to F8 used to make modifications to the policy
in order to ensure that all home directories in /etc/passwd with a UID >= 500
would be correctly labelled. However, in F8, that genhomedircon python script
was replaced with a simple shell script running "/usr/sbin/semodule -Bn". This
causes a rebuild of the policy that has no effect in correctly labelling home
directories not under /home.
Version-Release number of selected component (if applicable):
Steps to Reproduce:
1. Create user with home directory not under /home (say /tmp/home/user)
2. run "matchpathcon /tmp/home/user/.ssh"
Fixed in policycoreutils-2.0.34-7.fc8