Re: [gentoo-hardened] SELinux policy for heimdal with LDAP support

[Mivz]

Chris PeBenito wrote:

>On Wed, 2006-01-25 at 12:56 +0100, Mivz wrote:
>
>
>>I would like some comment on the policy, what can I do better.
>>Is this a odd or nonstandard daemon configuration, or could it be
>>integrated in the portage tree?
>>I would be interested in maintaining this policy my self.
>>
>>
>
>If heimdal is supposed to work with LDAP, then its not nonstandard.
>Nonstandard means moving file locations or gluing two programs together
>that aren't normally associated with each other.  As for the rules, they
>seem reasonable except for the two rules I listed below, which are odd
>since they deal with a user domain.  It can't be integrated into portage
>as we're working on switching over to reference policy [1], which has a
>new organization.
>
>[1] http://marc.theaimsgroup.com/?l=gentoo-hardened&m=113433863728029&w=2
>
>
>
>>plain text document attachment (heimdal-LDAP.te)
>>
>>
>>#/tmp/krb5cc
>>allow user_t local_login_tmp_t:file { read lock append };
>>
>>
I added this rule because pam_krb5 init's the krbcc and thus causes the 
/tmp/krbcc to be in the wrong security context. Also kinit and kdestroy 
loose access to /tmp/krbcc because of this. Is this a pam_krb5 bug, 
because it creates the /tmp/krbcc file in the wrong context, or a 
selinux-kerberos bug, because it does not handel the /tmp/krbcc file 
correct?

>>#Needed for whoami / id to work. Else: "I have no name!" for ldap users.
>>allow user_t nscd_var_run_t:dir search;
>>
>>
This rule I have added because users added through ldap otherwise can't 
find there name.
Whitout it the console shows a "I have no name!@host ~ $", like wise 
whoami and id can't find a user name. So that is probably a bug in 
nscd.te, which is in the base-policy. Should I also file a bug report on 
this?


-- 
gentoo-hardened@g.o mailing list