Re: file contexts and modularity

[Janak Desai <janak@us.ibm.com>]

Ivan Gyurdiev wrote:

>>So at that point you no longer need to keep home directory contexts in
>>file_contexts at all, and you just exclude home directories from
>>relabeling.
> 
> 
> How is the context of the bind-mounted home dir configured?
> 
> and subdirectories? pre-created?
> what determines their context?
> 
> I am trying to understand where the labeling 
> information is stored, if you want to get rid of the 
> file_contexts.homedirs file.
> 
> 
> 

Subdirectory context is obtained from the policy
using security_compute_member() call. So the pam module will
get the security context of the member, create the
directory and bind mount it to the polyinstantiated directory.
As Stephen mentioned, the member directory is no longer a
subdirectory of polyinstantiated directory. A configuration
file is checked to determine where to create member directories
for a perticular polyinstantiated directory.

-Janak

> 
> --
> This message was distributed to subscribers of the selinux mailing list.
> If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
> the words "unsubscribe selinux" without quotes as the message.
> 
> 



--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.