4 ms·
Well, SELinux can differentiate between different subjects whereas gnome-keyring cannot. Fedora's default policy prevents openvpn from accessing your SSH keys.
by lima 10y ago
Well, SELinux can differentiate between different subjects whereas gnome-keyring cannot.
Fedora's default policy prevents openvpn from accessing your SSH keys.
- sandGorgon 10y agoYou are misunderstanding user screen fatigue. This [1] is the error message spit out by openvpn when it asks you to restorecon on your cert directory - https://bugzilla.gnome.org/show_bug.cgi?id=689818#c3 https://bugzilla.gnome.org/show_bug.cgi?id=689818#c3 It is NOT asking you to do some specific openvpn restricted setting. Its basically setting it to the same permission level as gnome-keyring. Except - not even password protected. And the biggest issue - obviously an end-user has to muck about this stuff.
- lima 10y agoYou're misunderstand what SELinux does with OpenVPN. OpenVPN runs confined, so the only thing it's allowed to access in your profile directory is the certificate files. The OpenVPN SELinux policy says "OpenVPN may only access files marked home_cert_t". With gnome-keyring, it would have access to all your secrets.