Re: Single home directory type for all roles.

[Russell Coker <rcoker@redhat.com>]

On Thu, 2004-12-09 at 14:38 -0500, Daniel J Walsh wrote:
> If we move to this plan, we would turn off the compatability between 
> user and staff.
> So only staff users could su, usermod, newrole.  The reason they are the 
> same now is because
> of the labeling problem, and the inability to easily change from a user 
> to a staff role.  Why would
> you not have access to your old files, if you switch roles.  I agree 
> this might be good in some cases
> but can't we develop a less stringent rule that does not require relabeling.

If the aim is to have two roles with the same file access but different
access to su etc then it would be better achieved by having two roles
with the same default domain.

So you could have user:staff_user_r:staff_t and user:staff_r:staff_t and
only allow staff_su_t to be in role staff_r.


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.