Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 396331 - default selinux policy does not create homedirs upon login
Summary: default selinux policy does not create homedirs upon login
Alias: None
Product: Gentoo Linux
Classification: Unclassified
Component: Hardened (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: Sven Vermeulen (RETIRED)
Depends on:
Reported: 2011-12-28 16:07 UTC by Matthew Thode ( prometheanfire )
Modified: 2014-06-27 12:39 UTC (History)
2 users (show)

See Also:
Package list:
Runtime testing required: ---

selinux module (mkhomedir.te,337 bytes, text/plain)
2011-12-28 16:07 UTC, Matthew Thode ( prometheanfire )

Note You need to log in before you can comment on or make changes to this bug.
Description Matthew Thode ( prometheanfire ) archtester Gentoo Infrastructure gentoo-dev Security 2011-12-28 16:07:07 UTC
Created attachment 297219 [details]
selinux module

This fix requires oddjob (from upstream) to be installed as an selinux module.
It also requires /sbin/mkhomedir_helper to be oddjob_mkhomedir_exec_t.

we could also don't audit this log if we want, but since it should only occur during the first login, might be alright to keep around.

type=AVC msg=audit(1325087090.549:751): avc:  denied  { search } for  pid=13389 comm="mkhomedir_helpe" name="sys" dev=proc ino=4026531852 scontext=system_u:system_r:oddjob_mkhomedir_t tcontext=system_u:object_r:sysctl_t tclass=dir
type=SYSCALL msg=audit(1325087090.549:751): arch=c000003e syscall=2 success=no exit=-13 a0=6c166ac4ca10 a1=0 a2=1b6 a3=0 items=0 ppid=13386 pid=13389 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=66 comm="mkhomedir_helpe" exe="/sbin/mkhomedir_helper" subj=system_u:system_r:oddjob_mkhomedir_t key=(null)
Comment 1 Sven Vermeulen (RETIRED) gentoo-dev 2011-12-28 19:44:16 UTC
Action plan:
- Have ssh.te updated to call the oddjob stuff optionally (and send upstream)
- Mark the helper application (/sbin/mkhomedir_helper) correctly (and send upstream)
- Create a sec-policy/selinux-oddjob package (pending)
- Have sys-libs/pam pull this package as dependency

Will be part of rev 10.
Comment 2 Sven Vermeulen (RETIRED) gentoo-dev 2011-12-30 20:08:24 UTC
In hardened-dev overlay
Comment 3 Sven Vermeulen (RETIRED) gentoo-dev 2012-01-14 20:04:15 UTC
Pushed to main tree, ~arch
Comment 4 Sven Vermeulen (RETIRED) gentoo-dev 2012-02-26 10:07:52 UTC
Marked as stable in tree