On 07/23/2009 10:43 AM, Stephen Smalley wrote:
On Wed, 2009-07-22 at 22:19 +0200, Dominick Grift wrote:
> On Wed, 2009-07-22 at 16:05 -0400, Stephen Smalley wrote:
>> On Wed, 2009-07-22 at 12:57 -0700, Vadym Chepkov wrote:
>>> You are right, these types are listed in
/etc/selinux/targeted/contexts/customizable_types:
>>>
>>> ....
>>> httpd_sys_content_t
>>> httpd_sys_htaccess_t
>>> httpd_sys_script_exec_t
>>> httpd_sys_script_ra_t
>>> httpd_sys_script_ro_t
>>> httpd_sys_script_rw_t
>>> httpd_unconfined_script_exec_t
>>> ....
>>>
>>> May I ask, why do they set this way?
>> Because users may choose to customize the labeling of their web
>> hierarchy and we didn't want restorecon to clobber it. These days that
>> isn't so necessary because users can use semanage fcontext -a to add
>> entries for their customizations, and that is why customizable_types in
>> F11 doesn't include those types.
>>
> But should http_user_{content,content_rw,script_exec}_t not be
> customizable types though?
>
> Afaik unpriv users cannot use semanage fcontext. What if a unpriv user
> tries to configure a custom apache homedir for example (~/mywww)
>
> Will that not be relabeled upon restorecon -R -v /home?
Good question. Dan?
Policy access control, if it ever reaches maturity and integration,
could possibly allow unprivileged users to add semanage fcontext entries
for their own home directory contents.
Dominick has a good point. I was thinking only in terms of administrators. I will fix in
Rawhide.
svirt_image_t
virt_content_t
httpd_user_htaccess_t
httpd_user_script_exec_t
httpd_user_content_ra_t
httpd_user_content_rw_t
httpd_user_content_t