SELinux-Refpolicy Archive on lore.kernel.org
 help / color / Atom feed
* systemd_user_runtime_dir_t
@ 2020-04-08  2:19 Russell Coker
  2020-04-08  6:43 ` systemd_user_runtime_dir_t Topi Miettinen
  0 siblings, 1 reply; 4+ messages in thread
From: Russell Coker @ 2020-04-08  2:19 UTC (permalink / raw)
  To: selinux-refpolicy

What kind of name is that?  It's a poor choice of name by systemd upstream and 
I don't think we are obliged to copy that bad idea.

How about systemd_userdir_mgr_t or something similar?

-- 
My Main Blog         http://etbe.coker.com.au/
My Documents Blog    http://doc.coker.com.au/




^ permalink raw reply	[flat|nested] 4+ messages in thread

* Re: systemd_user_runtime_dir_t
  2020-04-08  2:19 systemd_user_runtime_dir_t Russell Coker
@ 2020-04-08  6:43 ` Topi Miettinen
  2020-04-08  6:48   ` systemd_user_runtime_dir_t Russell Coker
  0 siblings, 1 reply; 4+ messages in thread
From: Topi Miettinen @ 2020-04-08  6:43 UTC (permalink / raw)
  To: Russell Coker, selinux-refpolicy

On 8.4.2020 5.19, Russell Coker wrote:
> What kind of name is that?  It's a poor choice of name by systemd upstream and
> I don't think we are obliged to copy that bad idea.

The name is related to environment variable XDG_USER_RUNTIME_DIR, which 
is not systemd specific construct:

https://specifications.freedesktop.org/basedir-spec/basedir-spec-latest.html

So if the name should change, xdg_user_runtime_dir_t might be more 
accurate. On the other hand, the current name reflects that it's 
specifically the service supplied by systemd called 
"runtime-user-dir@.service" which provides the directory. If the 
provider would be something other (/etc/init.d/elogind-mkuserdir), it 
could be equally accurate to label the directory with something else. 
Though if the result (temporary directory owned by the user) is no 
different in either case from the point of view of SELinux policy, why 
change?

-Topi

^ permalink raw reply	[flat|nested] 4+ messages in thread

* Re: systemd_user_runtime_dir_t
  2020-04-08  6:43 ` systemd_user_runtime_dir_t Topi Miettinen
@ 2020-04-08  6:48   ` Russell Coker
  2020-04-09 13:47     ` systemd_user_runtime_dir_t Chris PeBenito
  0 siblings, 1 reply; 4+ messages in thread
From: Russell Coker @ 2020-04-08  6:48 UTC (permalink / raw)
  To: Topi Miettinen; +Cc: selinux-refpolicy

On Wednesday, 8 April 2020 4:43:32 PM AEST Topi Miettinen wrote:
> On 8.4.2020 5.19, Russell Coker wrote:
> > What kind of name is that?  It's a poor choice of name by systemd upstream
> > and I don't think we are obliged to copy that bad idea.
> 
> The name is related to environment variable XDG_USER_RUNTIME_DIR, which
> is not systemd specific construct:

That's a fine name for an environment variable, clearly indicating that it 
points to a directory.

It's a poor name for a domain, making a casual observer think it's a type for 
a directory not a domain for a process.

> https://specifications.freedesktop.org/basedir-spec/basedir-spec-latest.html
> 
> So if the name should change, xdg_user_runtime_dir_t might be more
> accurate.

It would be more accurate to have a name that reflects the function of managing 
the directory in question.

> On the other hand, the current name reflects that it's
> specifically the service supplied by systemd called
> "runtime-user-dir@.service" which provides the directory. If the
> provider would be something other (/etc/init.d/elogind-mkuserdir), it
> could be equally accurate to label the directory with something else.

If the provider changed to a different process (theoretically we are supposed 
to be able to swap out parts of systemd for equivalents) then it should have 
the same domain name.

> Though if the result (temporary directory owned by the user) is no
> different in either case from the point of view of SELinux policy, why
> change?

SE Linux is difficult enough to understand without making things needlessly 
confusing.

-- 
My Main Blog         http://etbe.coker.com.au/
My Documents Blog    http://doc.coker.com.au/




^ permalink raw reply	[flat|nested] 4+ messages in thread

* Re: systemd_user_runtime_dir_t
  2020-04-08  6:48   ` systemd_user_runtime_dir_t Russell Coker
@ 2020-04-09 13:47     ` Chris PeBenito
  0 siblings, 0 replies; 4+ messages in thread
From: Chris PeBenito @ 2020-04-09 13:47 UTC (permalink / raw)
  To: Russell Coker, Topi Miettinen; +Cc: selinux-refpolicy

On 4/8/20 2:48 AM, Russell Coker wrote:
> On Wednesday, 8 April 2020 4:43:32 PM AEST Topi Miettinen wrote:
>> On 8.4.2020 5.19, Russell Coker wrote:
>>> What kind of name is that?  It's a poor choice of name by systemd upstream
>>> and I don't think we are obliged to copy that bad idea.
>>
>> The name is related to environment variable XDG_USER_RUNTIME_DIR, which
>> is not systemd specific construct:
> 
> That's a fine name for an environment variable, clearly indicating that it
> points to a directory.
> 
> It's a poor name for a domain, making a casual observer think it's a type for
> a directory not a domain for a process.
> 
>> https://specifications.freedesktop.org/basedir-spec/basedir-spec-latest.html
>>
>> So if the name should change, xdg_user_runtime_dir_t might be more
>> accurate.
> 
> It would be more accurate to have a name that reflects the function of managing
> the directory in question.
> 
>> On the other hand, the current name reflects that it's
>> specifically the service supplied by systemd called
>> "runtime-user-dir@.service" which provides the directory. If the
>> provider would be something other (/etc/init.d/elogind-mkuserdir), it
>> could be equally accurate to label the directory with something else.
> 
> If the provider changed to a different process (theoretically we are supposed
> to be able to swap out parts of systemd for equivalents) then it should have
> the same domain name.
> 
>> Though if the result (temporary directory owned by the user) is no
>> different in either case from the point of view of SELinux policy, why
>> change?
> 
> SE Linux is difficult enough to understand without making things needlessly
> confusing.

You're right.  I wasn't pleased when I came across it.  However, the way I see 
it, the direction you suggest is confusing in a different way, since it doesn't 
obviously align with the systemd command name.  I see it as being between a rock 
and a hard place, so I'm inclined to keep it as-is. This isn't a domain that is 
going to show up all over the place, it is a microscopic niche of the byzantine 
set of processes under the systemd umbrella.


-- 
Chris PeBenito

^ permalink raw reply	[flat|nested] 4+ messages in thread

end of thread, back to index

Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-04-08  2:19 systemd_user_runtime_dir_t Russell Coker
2020-04-08  6:43 ` systemd_user_runtime_dir_t Topi Miettinen
2020-04-08  6:48   ` systemd_user_runtime_dir_t Russell Coker
2020-04-09 13:47     ` systemd_user_runtime_dir_t Chris PeBenito

SELinux-Refpolicy Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/selinux-refpolicy/0 selinux-refpolicy/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 selinux-refpolicy selinux-refpolicy/ https://lore.kernel.org/selinux-refpolicy \
		selinux-refpolicy@vger.kernel.org
	public-inbox-index selinux-refpolicy

Example config snippet for mirrors

Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/org.kernel.vger.selinux-refpolicy


AGPL code for this site: git clone https://public-inbox.org/public-inbox.git