I will edit the guide to make it clearer.
I posted this here to generally get ideas and different points of views on how to use systemd-homed on fedora. You and @vwbusguy have helped tremendously by giving us your point of views on networking aspects of this project.
I have written a SELinux policy for this project. I have to rewrite the policy every time to adjust to the users preferences. I would like to add rules for networking homes with homed. From your guys conversation, I would assume homed is a network client only or is it a network server as well?
Hopefully everyone with similar interest for this project will come here for a better understanding and use case for this project . My intent is to build a fedora wiki on this subject, but still lack information on different use cases and troubles that arise in these cases. An example below:
So in this case, new homes created by homed (or any mk.fs), selinux labels them âunlabeled_tâ. So I adjusted my policy to include rules for home directories with proper labels and home directories without. I have searched and read that you have to manually label new filesystems on (RH,Fedora,etc). For this reason, policies for homed have been abandoned. SELinux ref also states that itâs incomplete because of the labeling issue.
By adding this rule to the policy
fs_relabelfrom_xattr_fs(systemd_homework_t)
and adding
âluks-extra-mount-options=defcontext=system_u:object_r:user_home_dir_t:s0 flag to the build command, would properly label it correctly on a default LUKS btrfs filesystem.
Note:
Using âluks-extra-mount-options=defcontext=system_u:object_r:user_home_dir_t:s0 homed build flag does not properly label other LUKS file types (ext4,xfs). It labels them user_home_t , which would still need a home directory relabeling, thus needing an another solution, hence why I added âfs-type=btrfs flag to the build command on step 8.
WIthout the âluks-extra-mount-options=defcontext=system_u:object_r:user_home_dir_t:s0 build flag, the administrator or logged in user must manually relabel the home directory with restorecon
or an equivalent command. So in theory, step 8 saves you from manually relabeling your home.