Support custom login programs about refpolicy HOT 4 CLOSED

Can you explain what the pain points in your opinion are and maybe suggest possible solutions to address this?

Yes, I agree. I've been thinking about the drop-in directory model here where for example you have /etc/selinux/TYPE/contexts/users/user_u.d/override.conf (kind of similar to systemd overrides) That way you can just add overrides and append or replace existing context configurations. (this would have to be addressed in SELinux User space though) The same would have to apply to default_context and default_type That reminds me by the way that the whole default_type idea should probably be scrutinized and that pam_selinux uses it in some places where i suspect it shouldnt. Regardless though, this is something that would have to be addressed in SELinux user space. Probably best to start a discussion on the selinux maillist. But i do agree, this is an area that could probably be improved in my view.