Bug 409671 - policies no longer updated to reflect home directories different than /home
Summary: policies no longer updated to reflect home directories different than /home
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: None
Product: Fedora
Classification: Fedora
Component: policycoreutils
Version: 8
Hardware: All
OS: Linux
low
medium
Target Milestone: ---
Assignee: Daniel Walsh
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2007-12-04 02:43 UTC by Yves Perrenoud
Modified: 2008-05-07 20:15 UTC (History)
0 users

Fixed In Version: Current
Clone Of:
Environment:
Last Closed: 2008-05-07 20:15:04 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)

Description Yves Perrenoud 2007-12-04 02:43:50 UTC
Description of problem:

With home directory paths for users with UIDs >= 500 different than "/home", the
policies no longer get updated (rebuilt) to reflect that fact. This causes files
in home directories not under /home to not be labelled with the correct SELinux
security context type. Given that F8 contains a number of rules for such
processes as sshd, gdm, xsetroot and X that limit their access to home
directories for files not correctly labeled, this causes a number of problems
(particularly severe for sshd).

genhomedircon in versions prior to F8 used to make modifications to the policy
in order to ensure that all home directories in /etc/passwd with a UID >= 500
would be correctly labelled. However, in F8, that genhomedircon python script
was replaced with a simple shell script running "/usr/sbin/semodule -Bn". This
causes a rebuild of the policy that has no effect in correctly labelling home
directories not under /home.

Version-Release number of selected component (if applicable):

policycoreutils-2.0.31-20.fc8

Steps to Reproduce:
1. Create user with home directory not under /home (say /tmp/home/user)
2. run "matchpathcon /tmp/home/user/.ssh"
  
Actual results:

/tmp/home/user/.ssh  system_u:object_r:default_t:s0

Expected results:

/tmp/home/user/.ssh  system_u:object_r:user_home_ssh_t:s0

Comment 1 Daniel Walsh 2008-05-07 20:15:04 UTC
Fixed in policycoreutils-2.0.34-7.fc8


Note You need to log in before you can comment on or make changes to this bug.