[refpolicy] [patch 2/2] namespace: new policy for namespace.init script
Daniel J Walsh
dwalsh at redhat.com
Tue Mar 22 07:25:52 CDT 2011
-----BEGIN PGP SIGNED MESSAGE-----
On 03/21/2011 10:44 AM, Christopher J. PeBenito wrote:
> On 03/03/11 05:44, Miroslav Grepl wrote:
>> * adds polydomain attribute for login programs
> I'm unsure why this is necessary.
>> * namespace.init runs restorecon
>> * make ssh_home_t parent of polyinstantiated directory since
>> pam_namespace.so can be used for ssh
> I don't think I follow. Wouldn't the whole home directory be
> polyinstantiated, not just the .ssh dir?
>> * make user_tmp_t parent of polyinstantiated directory
> This also seems odd.
Lets examine what is going on. We want to allow the login programs to
populate a newly created directory from /etc/skel with proper labelling.
If the admin puts /etc/skel/.ssh then this directory needs to be
created by namespace.init with ssh_home_t.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
-----END PGP SIGNATURE-----
More information about the refpolicy