2010-02-25 17:59:57

by Justin P. Mattock

[permalink] [raw]
Subject: [refpolicy] home directory user context question

On 02/25/2010 08:14 AM, Alan Rouse wrote:
> Your home directory is labeled "user:" or "user_u" ?
>
> Mine is labeled "user_u:"
>


yeah my mistake it's user_u
(user_u:object_r:user_home_dir_t)
dos this look correct?

or should it be:
name:object_r:user_home_dir_t

Justin P. Mattock


2010-02-25 18:10:37

by cpebenito

[permalink] [raw]
Subject: [refpolicy] home directory user context question

On Thu, 2010-02-25 at 09:59 -0800, Justin P. mattock wrote:
> On 02/25/2010 08:14 AM, Alan Rouse wrote:
> > Your home directory is labeled "user:" or "user_u" ?
> >
> > Mine is labeled "user_u:"
>
> yeah my mistake it's user_u
> (user_u:object_r:user_home_dir_t)
> dos this look correct?
>
> or should it be:
> name:object_r:user_home_dir_t

If you have UBAC enabled, then the seuser of the processes needs to
match the seuser on the contents of your home directory. So your home
dir should be name:object_r:user_home_dir_t.

--
Chris PeBenito
Tresys Technology, LLC
(410) 290-1411 x150

2010-02-25 18:17:54

by Justin P. Mattock

[permalink] [raw]
Subject: [refpolicy] home directory user context question

On 02/25/2010 10:10 AM, Christopher J. PeBenito wrote:
> On Thu, 2010-02-25 at 09:59 -0800, Justin P. mattock wrote:
>> On 02/25/2010 08:14 AM, Alan Rouse wrote:
>>> Your home directory is labeled "user:" or "user_u" ?
>>>
>>> Mine is labeled "user_u:"
>>
>> yeah my mistake it's user_u
>> (user_u:object_r:user_home_dir_t)
>> dos this look correct?
>>
>> or should it be:
>> name:object_r:user_home_dir_t
>
> If you have UBAC enabled, then the seuser of the processes needs to
> match the seuser on the contents of your home directory. So your home
> dir should be name:object_r:user_home_dir_t.
>


yeah that's what I figured.. I'm just hitting some odd
quirk or something to where user_u just stays there,
and "name" doesn't appear until I delete a file in
my home directory i.g. mozilla(for example)
after deleting and restarting things go to "name"



Justin P. Mattock