Description of problem: With home directory paths for users with UIDs >= 500 different than "/home", the policies no longer get updated (rebuilt) to reflect that fact. This causes files in home directories not under /home to not be labelled with the correct SELinux security context type. Given that F8 contains a number of rules for such processes as sshd, gdm, xsetroot and X that limit their access to home directories for files not correctly labeled, this causes a number of problems (particularly severe for sshd). genhomedircon in versions prior to F8 used to make modifications to the policy in order to ensure that all home directories in /etc/passwd with a UID >= 500 would be correctly labelled. However, in F8, that genhomedircon python script was replaced with a simple shell script running "/usr/sbin/semodule -Bn". This causes a rebuild of the policy that has no effect in correctly labelling home directories not under /home. Version-Release number of selected component (if applicable): policycoreutils-2.0.31-20.fc8 Steps to Reproduce: 1. Create user with home directory not under /home (say /tmp/home/user) 2. run "matchpathcon /tmp/home/user/.ssh" Actual results: /tmp/home/user/.ssh system_u:object_r:default_t:s0 Expected results: /tmp/home/user/.ssh system_u:object_r:user_home_ssh_t:s0
Fixed in policycoreutils-2.0.34-7.fc8