Bug 700244 - Some files on nfs mounted home dirs still get wrong labels
Some files on nfs mounted home dirs still get wrong labels
Status: CLOSED CURRENTRELEASE
Product: Red Hat Enterprise Linux 5
Classification: Red Hat
Component: selinux-policy (Show other bugs)
5.6
Unspecified Unspecified
unspecified Severity unspecified
: rc
: ---
Assigned To: Miroslav Grepl
BaseOS QE Security Team
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2011-04-27 17:04 EDT by Orion Poplawski
Modified: 2011-04-28 14:46 EDT (History)
1 user (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2011-04-28 14:46:46 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:


Attachments (Terms of Use)

  None (edit)
Description Orion Poplawski 2011-04-27 17:04:42 EDT
Description of problem:

I'm periodically running /sbin/restorecon -R -v /export/home on our EL 5.6 NFS home directory server.  I'm seeing messages like the following periodically:

/sbin/restorecon reset /export/home/kwan/.lyxpipe.in context system_u:object_r:user_home_dir_t:s0->user_u:object_r:user_home_t:s0
/sbin/restorecon reset /export/home/kwan/.lyxpipe.out context system_u:object_r:user_home_dir_t:s0->user_u:object_r:user_home_t:s0

Version-Release number of selected component (if applicable):
selinux-policy-2.4.6-300.el5
Comment 1 Orion Poplawski 2011-04-27 17:21:57 EDT
/sbin/restorecon reset /export/home/riggin/.#NSF_bio.tex context system_u:object_r:user_home_dir_t:s0->user_u:object_r:user_home_t:s0
Comment 2 Daniel Walsh 2011-04-28 07:54:34 EDT
Miroslav in RHEL6 we have

optional_policy(`
	userdom_user_home_dir_filetrans_user_home_content(kernel_t, { file dir })
')

Do we have this in RHEL5?

This would still be broken and until we get some of the file name transition stuff we are adding in F16, it would be the best we can do, if it works.
Comment 3 Orion Poplawski 2011-04-28 12:01:41 EDT
FWIW - Things are a *lot* better now with 5.6 than with 5.5, so it seems something changed there.
Comment 4 Miroslav Grepl 2011-04-28 12:27:39 EDT
Well, we are missing this in RHEL5.
Comment 5 Daniel Walsh 2011-04-28 14:46:46 EDT
Orion I am closing this as fixed (Well fixes as best we can.)  And you triggered me to make a whole series of changes to Fedora 16 to make this much better.

Note You need to log in before you can comment on or make changes to this bug.