{"action":"created","issue":{"url":"https://api.github.com/repos/01org/meta-intel-iot-security/issues/116","repository_url":"https://api.github.com/repos/01org/meta-intel-iot-security","labels_url":"https://api.github.com/repos/01org/meta-intel-iot-security/issues/116/labels{/name}","comments_url":"https://api.github.com/repos/01org/meta-intel-iot-security/issues/116/comments","events_url":"https://api.github.com/repos/01org/meta-intel-iot-security/issues/116/events","html_url":"https://github.com/01org/meta-intel-iot-security/pull/116","id":149749054,"number":116,"title":"smack: remove \"User\" domain","user":{"login":"pohly","id":22076,"avatar_url":"https://avatars.githubusercontent.com/u/22076?v=3","gravatar_id":"","url":"https://api.github.com/users/pohly","html_url":"https://github.com/pohly","followers_url":"https://api.github.com/users/pohly/followers","following_url":"https://api.github.com/users/pohly/following{/other_user}","gists_url":"https://api.github.com/users/pohly/gists{/gist_id}","starred_url":"https://api.github.com/users/pohly/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pohly/subscriptions","organizations_url":"https://api.github.com/users/pohly/orgs","repos_url":"https://api.github.com/users/pohly/repos","events_url":"https://api.github.com/users/pohly/events{/privacy}","received_events_url":"https://api.github.com/users/pohly/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2016-04-20T12:05:23Z","updated_at":"2016-04-21T12:26:56Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/01org/meta-intel-iot-security/pulls/116","html_url":"https://github.com/01org/meta-intel-iot-security/pull/116","diff_url":"https://github.com/01org/meta-intel-iot-security/pull/116.diff","patch_url":"https://github.com/01org/meta-intel-iot-security/pull/116.patch"},"body":"The entire \"User\" domain support has been tentative. It depends a lot\non the actual application framework and thus is neither necessarily\nthe same everywhere nor absolutely needed. For example, Ostro OS does\nnot need it.\n\nSupport for it also was incomplete, probably even in Tizen, leading to\nproblems even when a distro has no use for the \"User\" domain: in Ostro\nOS, the PAM plugin sets the process label to \"User\" even when logging\nin as root, and then when \"passwd\" is used to modify /etc/passwd, the\nnew file has \"User\" as Smack label because there is no transmute Smack\nrule for User -> System::Shared and thus the transmute flag on /etc\ngets ignored.\n\nInstead of trying to fix this, it is easier to simplify the entire\nlayers by removing the \"User\" labels and rules. What remains is\nhard-coded in the upstream recipes.\n\nIf someone need support for a \"User\" domain, they can add that to\ntheir custom distro together with the code that depends on it or (when\nthat is not easy, for example in the smacknet tool) propose patches\nwhich add back what is needed in a way that a) it is properly\ndocumented and b) optional.\n\n@jobol @ipuustin please review. I also need to do some more testing\nmyself."},"comment":{"url":"https://api.github.com/repos/01org/meta-intel-iot-security/issues/comments/212894451","html_url":"https://github.com/01org/meta-intel-iot-security/pull/116#issuecomment-212894451","issue_url":"https://api.github.com/repos/01org/meta-intel-iot-security/issues/116","id":212894451,"user":{"login":"pohly","id":22076,"avatar_url":"https://avatars.githubusercontent.com/u/22076?v=3","gravatar_id":"","url":"https://api.github.com/users/pohly","html_url":"https://github.com/pohly","followers_url":"https://api.github.com/users/pohly/followers","following_url":"https://api.github.com/users/pohly/following{/other_user}","gists_url":"https://api.github.com/users/pohly/gists{/gist_id}","starred_url":"https://api.github.com/users/pohly/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pohly/subscriptions","organizations_url":"https://api.github.com/users/pohly/orgs","repos_url":"https://api.github.com/users/pohly/repos","events_url":"https://api.github.com/users/pohly/events{/privacy}","received_events_url":"https://api.github.com/users/pohly/received_events","type":"User","site_admin":false},"created_at":"2016-04-21T12:26:56Z","updated_at":"2016-04-21T12:26:56Z","body":"On Thu, 2016-04-21 at 05:09 -0700, acornea wrote:\n> If we plan on not using User domain anymore by default, maybe we\n> should also remove that from\n> meta-security-smack/recipes-core/base-files/base-files_%.bbappend\n\nWhat is left from User there? The commit removes \"User\" also from that\nfile.\n\n\n"}}