-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 We want to be able to create a new directory at different levels when a user logs in. The first time user logs in at s2 on an mls box without a namespaced homedir, pam_namespace would create the s2 directory and mount it over ~/. Currently we also execute a script to copy the files from /etc/skell onto the newly created homedir and then run restorecon on the content to make sure everything has the correct types. BUT this hammers the MLS Levels and sets everything as s0. Not what we want. 1 We can either turn the restorecon off for mls boxes, which will create files with the wrong types, 2 Not copy /etc/skel, which will eliminate functionality. 3 Change restorecon to not change the Level unless you specify -F. Meaning restorecon will only change the USER/ROLE/TYPE. 4 Hack up the script to use matchpatcon/secon/chcon -t to fix the types of files created. Any way we go we still end up with a potential problem in that a user admin running restorecon on a file could lower the level of the data to s0, accidentally. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iEYEARECAAYFAk5WcY4ACgkQrlYvE4MpobMTlwCeNDyvfpV8GO8TAODiTLfT0hbi g4QAnjwlCzkQlvjzXXf85EhU58o78h96 =egdc -----END PGP SIGNATURE----- -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to majordomo@xxxxxxxxxxxxx with the words "unsubscribe selinux" without quotes as the message.
