Sure if you can define a non local user.  If we ever got to the point where nfs shares had labels then we might want it.  I would actually love to get rid of genhomedircon altogether and force admins to add 

semanage fcontext -a -e /home /random/home

I guess non-local for me means not in /etc/passwd.  Might mean something else to others.

I'd be happy to do the above - easy to add in my kickstart %post scripts.  Might need to get added to anaconda somehow though so that when people create some strange partition they can mark it as housing users.

You could add 

disable-genhomedircon=true

To /etc/selinux/semanage.conf

Which would stop running it after it has been run once.

Although I think I would like to see it just setup the labeling of /home and then allow the admin to put in equivalents via semanage.

(In reply to comment #1)
> I would actually love to get rid of
> genhomedircon altogether and force admins to add 
> 
> semanage fcontext -a -e /home /random/home    

I wanted to use this great new feature but the man page totally confuses me. It is using a very unfortunate "source / destination / target" terminology. With most Unix commands (mv, ln,...) , the source becomes the destination (or target). Now compare this to the semanage man page:

 -e, --equal
     Substitute source path for target when relabeling.

I am afraid I am not the only one confused, I suspect the example at the bottom of the same man page is just plain wrong:

  # Make /home1 labeling equivalent to /home (used by restorecon)
  $ semanage fcontext -a -e /home1 /home


My suggestion:  "semanage -e referred reference"


(Sorry to hi-jack this bug; I think this does not deserve a new bug)

(In reply to comment #4)
>  -e, --equal
>  [...]
>   # Make /home1 labeling equivalent to /home

"equal" and "equivalent" are not very good either. Both "x = y" and "y = x" make x equal to y. Yet these are two very different operations.

How about

Substiture target path with sourcepath when generating default label.  This is used with fcontext. Requires source and target path arguments.  The context
labeling for the target subtree is made equivalent to that defined for the source.

# Substitute /home1 with /home when setting file context (used by restorecon)
$ semanage fcontext -a -e /home /home1

Looks much better, thanks. In the example would also change "/home1" by something more explicit like for instance "/disk6/home"

Created attachment 395757 [details]
Updated man page

(In reply to comment #8)
> Created an attachment (id=395757) [details]
> Updated man page    

I think there is a typo: "Substiture"

Fixed in policycoreutils-2.0.80-1

I should have said, you can add an entry to /etc/selinux/semanage.conf

# usepasswd check tells semanage to scan all pass word records for home directories
# and setup the labeling correctly.  If this is turned off, SELinux will label /home 
# correctly only.  You will need to use semanage fcontext command.  
# For example, if you had home dirs in /althome directory you would have to execute
# semanage fcontext -a -e /home /althome
usepasswd=False


libsemanage-2.0.45-1

(In reply to comment #11)
> # usepasswd check tells semanage to scan all pass word records for home
> # directories and setup the labeling correctly.

Interesting, thanks.

What happens to "a" and "b" directories in /a/b/althome?

I think whatever happens to them is worth documenting. Especially if it is "nothing".

Nothing happens.

The matchpathcon library basically does a string replace of 

/a/b/althome/dwalsh/.ssh becomes /home/dwalsh/.ssh

If /a/b are not searchable by a confined domain, then they will still fail.

If you actually added /a/b/althome, they would be labeled default_t.

Addint the equivalency would end up with

/a -> default_t
/a/b -> default_t
/a/b/althome -> home_root_t
/a/b/althome/dwalsh -> user_home_dir_t
/a/b/althome/dwalsh/.ssh -> ssh_home_t

But sshd_t would not be allowed to read /a/b/althome/dwalsh/.ssh, since it is not allowed to search_dir_perms on default_t.

Best solution would be to add a file context

semanage fcontext -a -t home_root_t '/a(/.*)?'

libsemanage-2.0.45-1.fc12 has been submitted as an update for Fedora 12.
http://admin.fedoraproject.org/updates/libsemanage-2.0.45-1.fc12

libsemanage-2.0.45-1.fc12 has been pushed to the Fedora 12 testing repository.  If problems still persist, please make note of it in this bug report.
 If you want to test the update, you can install it with 
 su -c 'yum --enablerepo=updates-testing update libsemanage'.  You can provide feedback for this update here: http://admin.fedoraproject.org/updates/libsemanage-2.0.45-1.fc12

libsemanage-2.0.45-1.fc12 has been pushed to the Fedora 12 stable repository.  If problems still persist, please make note of it in this bug report.