Re: MMCS patch against subversion policy

["Christopher J. PeBenito" <cpebenito@tresys.com>]

On Sat, 2006-10-07 at 21:13 +1000, Russell Coker wrote:
> On Saturday 07 October 2006 20:26, Daniel J Walsh <dwalsh@redhat.com> wrote:
> > There is only 
> > unconfined users.  All users in by default login with s0, not
> > SystemLow-SystemHigh.  We could make that change but then it would get
> > harder to turn on MCS as you would need to start thinking in terms of
> > administators.
> 
> Maybe we need to modify useradd to manage the SE Linux identity.  We could do 
> something like have membership of group wheel mean that by default a login 
> entry will be created with SE Linux identity "root".

A more general solution would be to enhance the user mapping to be able
to map based on the group, rather than modifying useradd.  So then the
mapping would match up in the order (first match wins):

username match
group match
__default__

-- 
Chris PeBenito
Tresys Technology, LLC
(410) 290-1411 x150


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.