Bugzilla – Bug 5389
home directory in /usr/local causes selinux warnings
Last modified: 2009-09-08 09:17:39 UTC
I'm running 6.5.4 on Fedora 7. Every time I install any rpm, I get warnings like: /etc/selinux/targeted/contexts/files/file_contexts: Multiple same specifications for /usr/local/lost\+found/.*. /etc/selinux/targeted/contexts/files/file_contexts: Multiple same specifications for /usr/local/\.journal. /etc/selinux/targeted/contexts/files/file_contexts: Multiple same specifications for /usr/local/lost\+found. This bug (which was recently CLOSED NOTABUG) leads me to believe that it is due to having a user in /etc/passwd with a home directory under /usr/local/: https://bugzilla.redhat.com/show_bug.cgi?id=244815 However the only user matching this description is slimserver: .-(/home/adam)--------------------------------------------------------------(root@atlantic)- `--# grep /usr/local /etc/passwd slimserver:x:503:503:SlimServer:/usr/local/slimserver:/bin/bash If I comment slimserver out of /etc/passwd and shadow, run genhomedircon, then install a new rpm, I no longer get the warnings. However I'm not an SELinux expert so I don't know what the "right" solution to this is. Maybe /usr/local/ is a deprecated location for users? Or maybe the slimserver install should manipulate the SELinux config in some way? But I'm just guessing ...
If you create it with a shell account of /bin/nologin or /bin/false the problem will go away.
Changing the shell to /sbin/nologin on this Fedora 7 box then running genhomedircon fixed it, thanks! Can the rpm be tweaked accordingly? (Maybe /bin/false is more distro-agnostic.) Wouldn't it be a good idea security-wise to avoid having a usable shell anyway?
Dean do you want to consider this for 7.0?
If you're running selinux, I think you're used to a lot of warnings. I'm leaving this open, but reducing the priority so that it doesn't block the 7.0 release.
Fletch, can you comment on this?
The SqueezeCenter RPM creates the squeezecenter user as a system account (which does not create the home dir) and a default shell of /sbin/nologin. One (or both) of those fixes this.
Assigned to Fletch at his request per bug 5623
This is fixed in the new SqueezeCenter RPM. Please see http://forums.slimdevices.com/showthread.php?t=41217 and http://wiki.slimdevices.com/index.cgi?SqueezeCenterRPM for more information. Marking as FIXED.