Re: setting up new test user domain?

[lonnie@outstep.com]

Since I would like to modify the original files as little a possible then it 
sounds to me like Option 1 would be be the best direction and I can usr the 
user_t (user.te) as a template for this new user domain.

Now then, after making the new domain, should I presume that I can simply use 
the standard "adduser" to put a user in that domain, and also use the 
standard "chown" to change the ownership of files to belong to the new domain?

Cheers,
Lonnie

Quoting Stephen Smalley <sds@tislabs.com>:

> 
> On Tue, 18 Dec 2001 lonnie@outstep.com wrote:
> 
> > Instead of modifying the user.te and every.te for our project, I think
> that it
> > might be better if I simple create a new test domain and place a
> "test" user in
> > that domain.
> 
> The rules in every.te are applied to every domain (or, to be more
> specific, to every type with the "domain" type attribute).  So if you
> create a test domain, these rules will also be applied to it unless
> you
> either 1) omit the "domain" type attribute from its declaration or 2)
> change every.te to exclude your test domain.
> 
> Option #1 will violate one of the assertions in the example policy, so
> you
> will have to remove that assertion from assert.te if you follow that
> route.  It will also require some additional rules for your test
> domain
> that are normally automatically picked up using the "domain"
> attribute,
> e.g. allowing init and the system administrator to kill the domain.
> 
> Option #2 requires you to edit every.te, but allows you to leave the
> assertions alone and lets you pick up the other rules automatically.
> If you name your new domain "testdomain", then you can do something
> like:
> 	sed "s/domain/~testdomain/g" every.te > newevery.te
> 	mv newevery.te every.te
> to create an every.te file that excludes your test domain.
> 
> > Would this be correct? If so then couls someone please help me to
> figure out
> > how to set up a simple domain from which to begin this process?
> 
> There are plenty of examples of domains in the current policy; use one
> of
> them as a starting point.  The most obvious one is the user_t domain
> that
> is currently used for ordinary users.  This is defined in
> domains/user/user.te.
> 
> --
> Stephen D. Smalley, NAI Labs
> ssmalley@nai.com
> 
> 
> 

--
You have received this message because you are subscribed to the selinux list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.