Re: [systemd-devel] [PATCH] SMACK: assign * label to /tmp when using SMACK.

2013-11-12 Thread Kok, Auke-jan H
On Nov 12, 2013 6:16 AM, "Karel Zak" wrote: > > On Fri, Nov 01, 2013 at 09:19:27AM -0700, Kok, Auke-jan H wrote: > > On Fri, Nov 1, 2013 at 12:57 AM, Karel Zak wrote: > > > On Thu, Oct 31, 2013 at 01:20:18PM -0700, Kok, Auke-jan H wrote: > > >> > BTW, for SELinux we remove selinux specific mount

Re: [systemd-devel] [PATCH] SMACK: assign * label to /tmp when using SMACK.

2013-11-12 Thread Karel Zak
On Tue, Nov 12, 2013 at 03:16:17PM +0100, Karel Zak wrote: > On Fri, Nov 01, 2013 at 09:19:27AM -0700, Kok, Auke-jan H wrote: > > On Fri, Nov 1, 2013 at 12:57 AM, Karel Zak wrote: > > > On Thu, Oct 31, 2013 at 01:20:18PM -0700, Kok, Auke-jan H wrote: > > >> > BTW, for SELinux we remove selinux sp

Re: [systemd-devel] [PATCH] SMACK: assign * label to /tmp when using SMACK.

2013-11-12 Thread Karel Zak
On Fri, Nov 01, 2013 at 09:19:27AM -0700, Kok, Auke-jan H wrote: > On Fri, Nov 1, 2013 at 12:57 AM, Karel Zak wrote: > > On Thu, Oct 31, 2013 at 01:20:18PM -0700, Kok, Auke-jan H wrote: > >> > BTW, for SELinux we remove selinux specific mount options in > >> > userspace (in mount(8)) if the kern

Re: [systemd-devel] [PATCH] SMACK: assign * label to /tmp when using SMACK.

2013-11-01 Thread Kok, Auke-jan H
On Fri, Nov 1, 2013 at 12:57 AM, Karel Zak wrote: > On Thu, Oct 31, 2013 at 01:20:18PM -0700, Kok, Auke-jan H wrote: >> > BTW, for SELinux we remove selinux specific mount options in >> > userspace (in mount(8)) if the kernel does not support selinux. >> > >> > It help us to make command line o

Re: [systemd-devel] [PATCH] SMACK: assign * label to /tmp when using SMACK.

2013-11-01 Thread Karel Zak
On Thu, Oct 31, 2013 at 01:20:18PM -0700, Kok, Auke-jan H wrote: > > BTW, for SELinux we remove selinux specific mount options in > > userspace (in mount(8)) if the kernel does not support selinux. > > > > It help us to make command line or fstab setting independent on the > > current kernel fe

Re: [systemd-devel] [PATCH] SMACK: assign * label to /tmp when using SMACK.

2013-10-31 Thread Kok, Auke-jan H
On Thu, Oct 31, 2013 at 12:00 PM, Karel Zak wrote: > On Tue, Oct 29, 2013 at 01:27:07PM +0100, Lennart Poettering wrote: >> On Tue, 29.10.13 16:02, WaLyong Cho (walyong@samsung.com) wrote: >> >> > >> Hmm, here's an idea: there has been a long standig feature request to >> > >> add a configurab

Re: [systemd-devel] [PATCH] SMACK: assign * label to /tmp when using SMACK.

2013-10-31 Thread Karel Zak
On Tue, Oct 29, 2013 at 01:27:07PM +0100, Lennart Poettering wrote: > On Tue, 29.10.13 16:02, WaLyong Cho (walyong@samsung.com) wrote: > > > >> Hmm, here's an idea: there has been a long standig feature request to > > >> add a configurable boolean to mount unit files that controls > > >> /bin/

Re: [systemd-devel] [PATCH] SMACK: assign * label to /tmp when using SMACK.

2013-10-31 Thread Karel Zak
On Tue, Oct 29, 2013 at 01:27:07PM +0100, Lennart Poettering wrote: > On Tue, 29.10.13 16:02, WaLyong Cho (walyong@samsung.com) wrote: > > > >> Hmm, here's an idea: there has been a long standig feature request to > > >> add a configurable boolean to mount unit files that controls > > >> /bin/

Re: [systemd-devel] [PATCH] SMACK: assign * label to /tmp when using SMACK.

2013-10-29 Thread Kok, Auke-jan H
On Tue, Oct 29, 2013 at 12:02 AM, WaLyong Cho wrote: > How about add specific options for smack? According to > http://schaufler-ca.com/description_from_the_linux_source_tree > > Smack supports some mount options: > > smackfsdef=label: specifies the label to give files that lack > the Smac

Re: [systemd-devel] [PATCH] SMACK: assign * label to /tmp when using SMACK.

2013-10-29 Thread Lennart Poettering
On Tue, 29.10.13 16:02, WaLyong Cho (walyong@samsung.com) wrote: > >> Hmm, here's an idea: there has been a long standig feature request to > >> add a configurable boolean to mount unit files that controls > >> /bin/mount's "-s" switch. Let's say we call it > >> "SloppyOptions=yes/no", or so.

Re: [systemd-devel] [PATCH] SMACK: assign * label to /tmp when using SMACK.

2013-10-29 Thread WaLyong Cho
On 10/29/2013 07:48 AM, Kok, Auke-jan H wrote: > On Mon, Oct 28, 2013 at 1:09 PM, Lennart Poettering > wrote: >> On Mon, 28.10.13 12:59, Kok, Auke-jan H (auke-jan.h@intel.com) wrote: >> >>> On Mon, Oct 28, 2013 at 8:58 AM, Lennart Poettering >>> wrote: On Mon, 28.10.13 19:44, WaLyong Ch

Re: [systemd-devel] [PATCH] SMACK: assign * label to /tmp when using SMACK.

2013-10-28 Thread Kok, Auke-jan H
On Mon, Oct 28, 2013 at 1:09 PM, Lennart Poettering wrote: > On Mon, 28.10.13 12:59, Kok, Auke-jan H (auke-jan.h@intel.com) wrote: > >> >> On Mon, Oct 28, 2013 at 8:58 AM, Lennart Poettering >> wrote: >> > On Mon, 28.10.13 19:44, WaLyong Cho (walyong@samsung.com) wrote: >> > >> >> At the

Re: [systemd-devel] [PATCH] SMACK: assign * label to /tmp when using SMACK.

2013-10-28 Thread Lennart Poettering
On Mon, 28.10.13 12:59, Kok, Auke-jan H (auke-jan.h@intel.com) wrote: > > On Mon, Oct 28, 2013 at 8:58 AM, Lennart Poettering > wrote: > > On Mon, 28.10.13 19:44, WaLyong Cho (walyong@samsung.com) wrote: > > > >> At the same reason of /run and /dev/shm, when systemd is running with > >>

Re: [systemd-devel] [PATCH] SMACK: assign * label to /tmp when using SMACK.

2013-10-28 Thread Kok, Auke-jan H
On Mon, Oct 28, 2013 at 8:58 AM, Lennart Poettering wrote: > On Mon, 28.10.13 19:44, WaLyong Cho (walyong@samsung.com) wrote: > >> At the same reason of /run and /dev/shm, when systemd is running with >> SMACK, countless tasks are failed by missed privilege. >> To avoid, /tmp is assigned '*' l

Re: [systemd-devel] [PATCH] SMACK: assign * label to /tmp when using SMACK.

2013-10-28 Thread Kok, Auke-jan H
On Mon, Oct 28, 2013 at 3:44 AM, WaLyong Cho wrote: > At the same reason of /run and /dev/shm, when systemd is running with > SMACK, countless tasks are failed by missed privilege. > To avoid, /tmp is assigned '*' label. We discussed this problem earlier in our office last week as we're looking i

Re: [systemd-devel] [PATCH] SMACK: assign * label to /tmp when using SMACK.

2013-10-28 Thread Lennart Poettering
On Mon, 28.10.13 19:44, WaLyong Cho (walyong@samsung.com) wrote: > At the same reason of /run and /dev/shm, when systemd is running with > SMACK, countless tasks are failed by missed privilege. > To avoid, /tmp is assigned '*' label. Won't this break if people compile systemd with SMACK enabl

[systemd-devel] [PATCH] SMACK: assign * label to /tmp when using SMACK.

2013-10-28 Thread WaLyong Cho
At the same reason of /run and /dev/shm, when systemd is running with SMACK, countless tasks are failed by missed privilege. To avoid, /tmp is assigned '*' label. --- Makefile.am| 10 ++ configure.ac |4 +++- units/tmp.mount| 20 units/tmp.mou