Re: [systemd-devel] [PATCH] SMACK: assign * label to /tmp when using SMACK.

2013-11-12 Thread Karel Zak
On Tue, Nov 12, 2013 at 03:16:17PM +0100, Karel Zak wrote: On Fri, Nov 01, 2013 at 09:19:27AM -0700, Kok, Auke-jan H wrote: On Fri, Nov 1, 2013 at 12:57 AM, Karel Zak k...@redhat.com wrote: On Thu, Oct 31, 2013 at 01:20:18PM -0700, Kok, Auke-jan H wrote: BTW, for SELinux we remove

Re: [systemd-devel] [PATCH] SMACK: assign * label to /tmp when using SMACK.

2013-11-12 Thread Kok, Auke-jan H
On Nov 12, 2013 6:16 AM, Karel Zak k...@redhat.com wrote: On Fri, Nov 01, 2013 at 09:19:27AM -0700, Kok, Auke-jan H wrote: On Fri, Nov 1, 2013 at 12:57 AM, Karel Zak k...@redhat.com wrote: On Thu, Oct 31, 2013 at 01:20:18PM -0700, Kok, Auke-jan H wrote: BTW, for SELinux we remove

Re: [systemd-devel] [PATCH] SMACK: assign * label to /tmp when using SMACK.

2013-11-01 Thread Karel Zak
On Thu, Oct 31, 2013 at 01:20:18PM -0700, Kok, Auke-jan H wrote: BTW, for SELinux we remove selinux specific mount options in userspace (in mount(8)) if the kernel does not support selinux. It help us to make command line or fstab setting independent on the current kernel features.

Re: [systemd-devel] [PATCH] SMACK: assign * label to /tmp when using SMACK.

2013-11-01 Thread Kok, Auke-jan H
On Fri, Nov 1, 2013 at 12:57 AM, Karel Zak k...@redhat.com wrote: On Thu, Oct 31, 2013 at 01:20:18PM -0700, Kok, Auke-jan H wrote: BTW, for SELinux we remove selinux specific mount options in userspace (in mount(8)) if the kernel does not support selinux. It help us to make command

Re: [systemd-devel] [PATCH] SMACK: assign * label to /tmp when using SMACK.

2013-10-31 Thread Karel Zak
On Tue, Oct 29, 2013 at 01:27:07PM +0100, Lennart Poettering wrote: On Tue, 29.10.13 16:02, WaLyong Cho (walyong@samsung.com) wrote: Hmm, here's an idea: there has been a long standig feature request to add a configurable boolean to mount unit files that controls /bin/mount's -s

Re: [systemd-devel] [PATCH] SMACK: assign * label to /tmp when using SMACK.

2013-10-31 Thread Karel Zak
On Tue, Oct 29, 2013 at 01:27:07PM +0100, Lennart Poettering wrote: On Tue, 29.10.13 16:02, WaLyong Cho (walyong@samsung.com) wrote: Hmm, here's an idea: there has been a long standig feature request to add a configurable boolean to mount unit files that controls /bin/mount's -s

Re: [systemd-devel] [PATCH] SMACK: assign * label to /tmp when using SMACK.

2013-10-31 Thread Kok, Auke-jan H
On Thu, Oct 31, 2013 at 12:00 PM, Karel Zak k...@redhat.com wrote: On Tue, Oct 29, 2013 at 01:27:07PM +0100, Lennart Poettering wrote: On Tue, 29.10.13 16:02, WaLyong Cho (walyong@samsung.com) wrote: Hmm, here's an idea: there has been a long standig feature request to add a

Re: [systemd-devel] [PATCH] SMACK: assign * label to /tmp when using SMACK.

2013-10-29 Thread WaLyong Cho
On 10/29/2013 07:48 AM, Kok, Auke-jan H wrote: On Mon, Oct 28, 2013 at 1:09 PM, Lennart Poettering lenn...@poettering.net wrote: On Mon, 28.10.13 12:59, Kok, Auke-jan H (auke-jan.h@intel.com) wrote: On Mon, Oct 28, 2013 at 8:58 AM, Lennart Poettering lenn...@poettering.net wrote: On

Re: [systemd-devel] [PATCH] SMACK: assign * label to /tmp when using SMACK.

2013-10-29 Thread Lennart Poettering
On Tue, 29.10.13 16:02, WaLyong Cho (walyong@samsung.com) wrote: Hmm, here's an idea: there has been a long standig feature request to add a configurable boolean to mount unit files that controls /bin/mount's -s switch. Let's say we call it SloppyOptions=yes/no, or so. Then, we could

Re: [systemd-devel] [PATCH] SMACK: assign * label to /tmp when using SMACK.

2013-10-29 Thread Kok, Auke-jan H
On Tue, Oct 29, 2013 at 12:02 AM, WaLyong Cho walyong@samsung.com wrote: How about add specific options for smack? According to http://schaufler-ca.com/description_from_the_linux_source_tree Smack supports some mount options: smackfsdef=label: specifies the label to give files that

[systemd-devel] [PATCH] SMACK: assign * label to /tmp when using SMACK.

2013-10-28 Thread WaLyong Cho
At the same reason of /run and /dev/shm, when systemd is running with SMACK, countless tasks are failed by missed privilege. To avoid, /tmp is assigned '*' label. --- Makefile.am| 10 ++ configure.ac |4 +++- units/tmp.mount| 20

Re: [systemd-devel] [PATCH] SMACK: assign * label to /tmp when using SMACK.

2013-10-28 Thread Lennart Poettering
On Mon, 28.10.13 19:44, WaLyong Cho (walyong@samsung.com) wrote: At the same reason of /run and /dev/shm, when systemd is running with SMACK, countless tasks are failed by missed privilege. To avoid, /tmp is assigned '*' label. Won't this break if people compile systemd with SMACK enabled

Re: [systemd-devel] [PATCH] SMACK: assign * label to /tmp when using SMACK.

2013-10-28 Thread Kok, Auke-jan H
On Mon, Oct 28, 2013 at 3:44 AM, WaLyong Cho walyong@samsung.com wrote: At the same reason of /run and /dev/shm, when systemd is running with SMACK, countless tasks are failed by missed privilege. To avoid, /tmp is assigned '*' label. We discussed this problem earlier in our office last

Re: [systemd-devel] [PATCH] SMACK: assign * label to /tmp when using SMACK.

2013-10-28 Thread Kok, Auke-jan H
On Mon, Oct 28, 2013 at 8:58 AM, Lennart Poettering lenn...@poettering.net wrote: On Mon, 28.10.13 19:44, WaLyong Cho (walyong@samsung.com) wrote: At the same reason of /run and /dev/shm, when systemd is running with SMACK, countless tasks are failed by missed privilege. To avoid, /tmp is

Re: [systemd-devel] [PATCH] SMACK: assign * label to /tmp when using SMACK.

2013-10-28 Thread Lennart Poettering
On Mon, 28.10.13 12:59, Kok, Auke-jan H (auke-jan.h@intel.com) wrote: On Mon, Oct 28, 2013 at 8:58 AM, Lennart Poettering lenn...@poettering.net wrote: On Mon, 28.10.13 19:44, WaLyong Cho (walyong@samsung.com) wrote: At the same reason of /run and /dev/shm, when systemd is

Re: [systemd-devel] [PATCH] SMACK: assign * label to /tmp when using SMACK.

2013-10-28 Thread Kok, Auke-jan H
On Mon, Oct 28, 2013 at 1:09 PM, Lennart Poettering lenn...@poettering.net wrote: On Mon, 28.10.13 12:59, Kok, Auke-jan H (auke-jan.h@intel.com) wrote: On Mon, Oct 28, 2013 at 8:58 AM, Lennart Poettering lenn...@poettering.net wrote: On Mon, 28.10.13 19:44, WaLyong Cho