Received-SPF: pass (google.com: best guess record for domain of selinux-refpolicy-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
From:   Russell Coker <russell@coker.com.au>
To:     Topi Miettinen <toiwoton@gmail.com>
Cc:     selinux-refpolicy@vger.kernel.org
Subject: Re: systemd_user_runtime_dir_t
Date:   Wed, 08 Apr 2020 16:48:32 +1000
Message-ID: <3285433.FrU4F1G8SV@liv>
In-Reply-To: <b4ec6d11-1f0d-1f3c-7ee9-d1f9fd99ce1b@gmail.com>
References: <2379388.043O1XupSG@liv> <b4ec6d11-1f0d-1f3c-7ee9-d1f9fd99ce1b@gmail.com>
MIME-Version: 1.0
Content-Transfer-Encoding: 7Bit
Content-Type: text/plain; charset="us-ascii"
Sender: selinux-refpolicy-owner@vger.kernel.org
Precedence: bulk

On Wednesday, 8 April 2020 4:43:32 PM AEST Topi Miettinen wrote:
> On 8.4.2020 5.19, Russell Coker wrote:
> > What kind of name is that?  It's a poor choice of name by systemd upstream
> > and I don't think we are obliged to copy that bad idea.
> 
> The name is related to environment variable XDG_USER_RUNTIME_DIR, which
> is not systemd specific construct:

That's a fine name for an environment variable, clearly indicating that it 
points to a directory.

It's a poor name for a domain, making a casual observer think it's a type for 
a directory not a domain for a process.

> https://specifications.freedesktop.org/basedir-spec/basedir-spec-latest.html
> 
> So if the name should change, xdg_user_runtime_dir_t might be more
> accurate.

It would be more accurate to have a name that reflects the function of managing 
the directory in question.

> On the other hand, the current name reflects that it's
> specifically the service supplied by systemd called
> "runtime-user-dir@.service" which provides the directory. If the
> provider would be something other (/etc/init.d/elogind-mkuserdir), it
> could be equally accurate to label the directory with something else.

If the provider changed to a different process (theoretically we are supposed 
to be able to swap out parts of systemd for equivalents) then it should have 
the same domain name.

> Though if the result (temporary directory owned by the user) is no
> different in either case from the point of view of SELinux policy, why
> change?

SE Linux is difficult enough to understand without making things needlessly 
confusing.

-- 
My Main Blog         http://etbe.coker.com.au/
My Documents Blog    http://doc.coker.com.au/