Bug 409671 - policies no longer updated to reflect home directories different than /home
policies no longer updated to reflect home directories different than /home
Status: CLOSED CURRENTRELEASE
Product: Fedora
Classification: Fedora
Component: policycoreutils (Show other bugs)
8
All Linux
low Severity medium
: ---
: ---
Assigned To: Daniel Walsh
Fedora Extras Quality Assurance
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2007-12-03 21:43 EST by Yves Perrenoud
Modified: 2008-05-07 16:15 EDT (History)
0 users

See Also:
Fixed In Version: Current
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2008-05-07 16:15:04 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Yves Perrenoud 2007-12-03 21:43:50 EST
Description of problem:

With home directory paths for users with UIDs >= 500 different than "/home", the
policies no longer get updated (rebuilt) to reflect that fact. This causes files
in home directories not under /home to not be labelled with the correct SELinux
security context type. Given that F8 contains a number of rules for such
processes as sshd, gdm, xsetroot and X that limit their access to home
directories for files not correctly labeled, this causes a number of problems
(particularly severe for sshd).

genhomedircon in versions prior to F8 used to make modifications to the policy
in order to ensure that all home directories in /etc/passwd with a UID >= 500
would be correctly labelled. However, in F8, that genhomedircon python script
was replaced with a simple shell script running "/usr/sbin/semodule -Bn". This
causes a rebuild of the policy that has no effect in correctly labelling home
directories not under /home.

Version-Release number of selected component (if applicable):

policycoreutils-2.0.31-20.fc8

Steps to Reproduce:
1. Create user with home directory not under /home (say /tmp/home/user)
2. run "matchpathcon /tmp/home/user/.ssh"
  
Actual results:

/tmp/home/user/.ssh  system_u:object_r:default_t:s0

Expected results:

/tmp/home/user/.ssh  system_u:object_r:user_home_ssh_t:s0
Comment 1 Daniel Walsh 2008-05-07 16:15:04 EDT
Fixed in policycoreutils-2.0.34-7.fc8

Note You need to log in before you can comment on or make changes to this bug.