Christopher J. PeBenito wrote:
On Fri, 2008-07-18 at 13:31 -0400, Mike Edenfield wrote:
Christopher J. PeBenito wrote:
On Mon, 2008-07-14 at 16:31 -0400, Mike Edenfield wrote:
+tunable_policy(`samba_create_home_dirs',`
+ unprivuser_home_filetrans_home_dir(smbd_t)
+ unprivuser_manage_home_dirs(smbd_t)
I think we want this to be unprivuser_create_home_dirs(), which would
need to be added.
That was my first instinct but I didn't see one already present, so I
just copied what I found for oddjob_mkhomedir.
I'll define a new interface for this -- I assume that's probably a
separate patch?
No, its fine to include it in this one.
And I should convert the sysadm role and oddjob type to
use the interface?
Sysadm is fine as is, since it already has broad powers for managing
users. I'm not sure about the oddjob usage; you'd have to check the
programs features to see if it does other things in addition to just
creating the dirs.
The reason I mentioned it is because both sysadm and oddjob use the same
two interfaces I put in the samba patch. In fact, I don't see anywhere
in the ref policy that manage_home_dirs is ever used without the
filetrans interface right before it. This leads me to suggest that I
just add a call to home_filetrans_home_dir inside manage_home_dirs,
since it seems to be almost a prerequisite anyway.
I just checked oddjob -- it calls a series of related interfaces, which
sysadm and the samba policy already also called, so perhaps all of these
can be put into a "create_home_directories" interface and simplify the
policy in three places:
unprivuser_home_filetrans_home_dir(oddjob_mkhomedir_t)
unprivuser_manage_home_content_dirs(oddjob_mkhomedir_t)
unprivuser_manage_home_content_files(oddjob_mkhomedir_t)
unprivuser_manage_home_dirs(oddjob_mkhomedir_t)
unprivuser_home_dir_filetrans_home_content(oddjob_mkhomedir_t,notdevfile_class_set)
--Mike
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@xxxxxxxxxxxxx with
the words "unsubscribe selinux" without quotes as the message.
