Skip to contentSkip to conversation

namespace: new policy for namespace.init script

PATCH New Miroslav Grepl 3 participants 4 messages Mar 3, 2011 – Mar 23, 2011

lore
Share & tools
lore

Miroslav Grepl

author
#0 lore raw

PATCH 2/2 namespace: new policy for namespace.init script

http://mgrepl.fedorapeople.org/F15/apps_namespace_p2.patch

* adds polydomain attribute for login programs
* namespace.init runs restorecon
* make ssh_home_t parent of polyinstantiated directory since
pam_namespace.so can be used for ssh
* make user_tmp_t parent of polyinstantiated directory

#1 lore raw

PATCH 2/2 namespace: new policy for namespace.init script

Quoted 3 lines · Miroslav Grepl

http://mgrepl.fedorapeople.org/F15/apps_namespace_p2.patch

* adds polydomain attribute for login programs

I'm unsure why this is necessary.

Quoted 3 lines

* namespace.init runs restorecon
* make ssh_home_t parent of polyinstantiated directory since
pam_namespace.so can be used for ssh

I don't think I follow. Wouldn't the whole home directory be polyinstantiated, not just the .ssh dir?

Quoted 1 line

* make user_tmp_t parent of polyinstantiated directory

This also seems odd.

Signature · 3 lines
Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com
#2 lore raw

PATCH 2/2 namespace: new policy for namespace.init script

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Quoted 11 lines · Christopher J. PeBenito
Quoted 3 lines · Miroslav Grepl

http://mgrepl.fedorapeople.org/F15/apps_namespace_p2.patch

* adds polydomain attribute for login programs

I'm unsure why this is necessary.

Quoted 3 lines

* namespace.init runs restorecon
* make ssh_home_t parent of polyinstantiated directory since
pam_namespace.so can be used for ssh

Quoted 8 lines

I don't think I follow. Wouldn't the whole home directory be polyinstantiated, not just the .ssh dir?

Quoted 1 line

* make user_tmp_t parent of polyinstantiated directory

This also seems odd.

Lets examine what is going on. We want to allow the login programs to populate a newly created directory from /etc/skel with proper labelling.
If the admin puts /etc/skel/.ssh then this directory needs to be
created by namespace.init with ssh_home_t.

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/

iEYEARECAAYFAk2IlVAACgkQrlYvE4MpobOedACdGyOxOGaCDh0yOB6ZR5Y+H+l3 S2gAn0KznF2knaYqioTEpwy1K0uRtzsX
=x2t/
-----END PGP SIGNATURE-----

#3 lore raw

PATCH 2/2 namespace: new policy for namespace.init script

Quoted 15 lines · Daniel J Walsh
Quoted 13 lines · Christopher J. PeBenito
Quoted 3 lines · Miroslav Grepl

http://mgrepl.fedorapeople.org/F15/apps_namespace_p2.patch

* adds polydomain attribute for login programs

I'm unsure why this is necessary.

Quoted 3 lines

* namespace.init runs restorecon
* make ssh_home_t parent of polyinstantiated directory since
pam_namespace.so can be used for ssh

I don't think I follow. Wouldn't the whole home directory be polyinstantiated, not just the .ssh dir?

Quoted 8 lines
Quoted 3 lines
Quoted 1 line

* make user_tmp_t parent of polyinstantiated directory

This also seems odd.

Lets examine what is going on. We want to allow the login programs to populate a newly created directory from /etc/skel with proper labelling.
If the admin puts /etc/skel/.ssh then this directory needs to be
created by namespace.init with ssh_home_t.

Yes, I know thats what happens. I just got polydir and polyparent mixed up.

Signature · 3 lines
Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com