Re: [PATCH v2 2/2] ssh: Add interface ssh_search_dir

On четверг, 20 июня 2019 г. 18:27:31 MSK, Dominick Grift wrote:
> On Thu, Jun 20, 2019 at 06:05:57PM +0300, Alexander Miroshnichenko wrote:
>> On четверг, 20 июня 2019 г. 17:50:11 MSK, Dominick Grift wrote: ...
>
> Yes this sucks. I would probably do the following instead:
>
> 1. echo "ignoredirs=/var/lib/gitolite" >> /etc/selinux/semanage.conf
> 2. semodule -B && restorecon -RvF /var/lib/gitolite
> 3. gitosis_read_lib_files(sshd_t)

I can't use sshd_t in another policy without require statement.
Or I need to add gitosis_read_lib_files(sshd_t) to ssh.te policy file.
All 3 steps are ugly comparing with new ssh_search_dir() interface.
Why such restrictions where caller must be the source for interface? It is 
not flexible.

>
> Dont bother with labeling /var/lib/gitolite/.ssh differently
>
>>  ...
>