What kind of name is that? It's a poor choice of name by systemd upstream and
I don't think we are obliged to copy that bad idea.
How about systemd_userdir_mgr_t or something similar?
--
My Main Blog http://etbe.coker.com.au/
My Documents Blog http://doc.coker.com.au/
On 8.4.2020 5.19, Russell Coker wrote:
> What kind of name is that? It's a poor choice of name by systemd upstream and
> I don't think we are obliged to copy that bad idea.
The name is related to environment variable XDG_USER_RUNTIME_DIR, which
is not systemd specific construct:
https://specifications.freedesktop.org/basedir-spec/basedir-spec-latest.html
So if the name should change, xdg_user_runtime_dir_t might be more
accurate. On the other hand, the current name reflects that it's
specifically the service supplied by systemd called
"[email protected]" which provides the directory. If the
provider would be something other (/etc/init.d/elogind-mkuserdir), it
could be equally accurate to label the directory with something else.
Though if the result (temporary directory owned by the user) is no
different in either case from the point of view of SELinux policy, why
change?
-Topi
On Wednesday, 8 April 2020 4:43:32 PM AEST Topi Miettinen wrote:
> On 8.4.2020 5.19, Russell Coker wrote:
> > What kind of name is that? It's a poor choice of name by systemd upstream
> > and I don't think we are obliged to copy that bad idea.
>
> The name is related to environment variable XDG_USER_RUNTIME_DIR, which
> is not systemd specific construct:
That's a fine name for an environment variable, clearly indicating that it
points to a directory.
It's a poor name for a domain, making a casual observer think it's a type for
a directory not a domain for a process.
> https://specifications.freedesktop.org/basedir-spec/basedir-spec-latest.html
>
> So if the name should change, xdg_user_runtime_dir_t might be more
> accurate.
It would be more accurate to have a name that reflects the function of managing
the directory in question.
> On the other hand, the current name reflects that it's
> specifically the service supplied by systemd called
> "[email protected]" which provides the directory. If the
> provider would be something other (/etc/init.d/elogind-mkuserdir), it
> could be equally accurate to label the directory with something else.
If the provider changed to a different process (theoretically we are supposed
to be able to swap out parts of systemd for equivalents) then it should have
the same domain name.
> Though if the result (temporary directory owned by the user) is no
> different in either case from the point of view of SELinux policy, why
> change?
SE Linux is difficult enough to understand without making things needlessly
confusing.
--
My Main Blog http://etbe.coker.com.au/
My Documents Blog http://doc.coker.com.au/
On 4/8/20 2:48 AM, Russell Coker wrote:
> On Wednesday, 8 April 2020 4:43:32 PM AEST Topi Miettinen wrote:
>> On 8.4.2020 5.19, Russell Coker wrote:
>>> What kind of name is that? It's a poor choice of name by systemd upstream
>>> and I don't think we are obliged to copy that bad idea.
>>
>> The name is related to environment variable XDG_USER_RUNTIME_DIR, which
>> is not systemd specific construct:
>
> That's a fine name for an environment variable, clearly indicating that it
> points to a directory.
>
> It's a poor name for a domain, making a casual observer think it's a type for
> a directory not a domain for a process.
>
>> https://specifications.freedesktop.org/basedir-spec/basedir-spec-latest.html
>>
>> So if the name should change, xdg_user_runtime_dir_t might be more
>> accurate.
>
> It would be more accurate to have a name that reflects the function of managing
> the directory in question.
>
>> On the other hand, the current name reflects that it's
>> specifically the service supplied by systemd called
>> "[email protected]" which provides the directory. If the
>> provider would be something other (/etc/init.d/elogind-mkuserdir), it
>> could be equally accurate to label the directory with something else.
>
> If the provider changed to a different process (theoretically we are supposed
> to be able to swap out parts of systemd for equivalents) then it should have
> the same domain name.
>
>> Though if the result (temporary directory owned by the user) is no
>> different in either case from the point of view of SELinux policy, why
>> change?
>
> SE Linux is difficult enough to understand without making things needlessly
> confusing.
You're right. I wasn't pleased when I came across it. However, the way I see
it, the direction you suggest is confusing in a different way, since it doesn't
obviously align with the systemd command name. I see it as being between a rock
and a hard place, so I'm inclined to keep it as-is. This isn't a domain that is
going to show up all over the place, it is a microscopic niche of the byzantine
set of processes under the systemd umbrella.
--
Chris PeBenito