From: harrytaurus2002@hotmail.com (HarryCiao) Date: Sun, 13 Feb 2011 10:46:32 +0000 Subject: [refpolicy] Make crond able to use pam_namespace.so Message-ID: To: refpolicy@oss.tresys.com List-Id: refpolicy.oss.tresys.com Hello Chris and Dom, Please hold on this patch. I am now puzzled at if we should have crond use pam_namespace.so at all. The problem I run into is that the cron job process does not share the same namespace with the cron job submitter's process. If a staff user(mapped to staff_u) specifies cron job to write into a "/home/staff/somefile", if $HOME is polyinstantiated, then the cron job process will attempt to write into somefile to the BASE directory of /home/staff, rather than the MEMBER directory of /home/home.inst/staff_xxx created by ssh or login, resulting that this somefile is invisible to the staff user, only the root user could see it in the original base directory of /home/staff. How could I have the cron job process share the same namespace with the user's login session? Would below plan ever work? 1. when crontab command creates user's cron job files in /var/spool/cron, the file name not only contains user's Linux User name, but also the submitter's role and MLS level; 2. crond determines cron job process security context from the name of above cron job files, rather than by get_default_context_with_level(). The cron job process will be in the same security context as the relevant submitter, rather than cronjob_t fetched from system_r:crond_t:s0 related entries in contexts/default_contexts or users/[user]. 3. crond PAM configs uses pam_namespace.so, which will find the cron job submitter's polyinstantiation member directory already created by ssh or login in the polyinstantiation parent directory. Thanks, Harry From: harrytaurus2002@hotmail.com To: cpebenito at tresys.com; refpolicy at oss1.tresys.com Date: Fri, 11 Feb 2011 08:54:29 +0000 Subject: [refpolicy] Make crond able to use pam_namespace.so Hi Chirs, Another patch for crond_t, call the files_polyinstantiate_all() interface for it as what has been done for other entrypoint applications' domains, so that crond could work well when pam_namespace.so is used in its PAM config files and polyinstantiation is enabled. Thanks, Best regards, Harry _______________________________________________ refpolicy mailing list refpolicy at oss.tresys.com http://oss.tresys.com/mailman/listinfo/refpolicy -------------- next part -------------- An HTML attachment was scrubbed... URL: http://oss.tresys.com/pipermail/refpolicy/attachments/20110213/2369fc73/attachment.html