Regarding SELinux User mapping

Regarding SELinux User mapping

[c.r.madhusudhanan]

[-- Attachment #1: Type: text/plain, Size: 490 bytes --]

Hi All,

I am trying to map Linux user to different SELinux user (user_u, guest_u,
xguest_u), but when I login it shows only as
system_u:system_r:local_login_t for all users.   I used semanage to map.

# semange login -l

Login Name     SELinux User

__default__     user_u
root                root
system_u       system_u


I am using selinux enabled kernel in Meego 1.2 , built user space packages
from http://userspace.selinuxproject.org and using refpolicy-2.20101213.


Regards,
Madhu

[-- Attachment #2: Type: text/html, Size: 621 bytes --]

Re: Regarding SELinux User mapping

[Stephen Smalley]

On Fri, 2011-05-27 at 18:20 +0530, c.r.madhusudhanan@gmail.com wrote:
> I am trying to map Linux user to different SELinux user (user_u,
> guest_u, xguest_u), but when I login it shows only as
> system_u:system_r:local_login_t for all users.   I used semanage to
> map. 
> 
> # semange login -l
> 
> Login Name     SELinux User
> 
> __default__     user_u
> root                root
> system_u       system_u 
> 
> 
> I am using selinux enabled kernel in Meego 1.2 , built user space
> packages 
> from http://userspace.selinuxproject.org and using
> refpolicy-2.20101213.

Do you have pam_selinux in your pam configuration for login?  Fedora has
the following session modules in /etc/pam.d/login:

# pam_selinux.so close should be the first session rule
session    required     pam_selinux.so close
session    required     pam_loginuid.so
session    optional     pam_console.so
# pam_selinux.so open should only be followed by sessions to be executed
in the user context
session    required     pam_selinux.so open
session    required     pam_namespace.so
session    optional     pam_keyinit.so force revoke
session    include      system-auth

Note that they call pam_selinux twice in the stack, once with 'close'
and once with 'open', in order to distinguish what session modules
should run with the login program's context vs what session modules
should run with the user's context.

-- 
Stephen Smalley
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: Regarding SELinux User mapping

[Dominick Grift]

[-- Attachment #1: Type: text/plain, Size: 511 bytes --]



On Fri, 2011-05-27 at 18:20 +0530, c.r.madhusudhanan@gmail.com wrote:
> Hi All,
> 
> I am trying to map Linux user to different SELinux user (user_u, guest_u,
> xguest_u), but when I login it shows only as
> system_u:system_r:local_login_t for all users.  

SElinux uses pam (pam_selinux) to tell login programs what context they
should set for a user that logs in, i believe.

pam_selinux gets these from /etc/selinux/*/contexts/ { default_contexts
users/.* }, i think
> 
> Regards,
> Madhu

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 198 bytes --]

Re: Regarding SELinux User mapping

[c.r.madhusudhanan]

[-- Attachment #1: Type: text/plain, Size: 810 bytes --]

Hello Dominick, Stephen,

Thanks for the quick response. Meego doesnt use pam_selinux by default.

I will try to enable the pam_selinux support, and let you know the result.
Thanks for the help.

Regards,
Madhu

On Fri, May 27, 2011 at 6:31 PM, Dominick Grift <domg472@gmail.com> wrote:

>
>
> On Fri, 2011-05-27 at 18:20 +0530, c.r.madhusudhanan@gmail.com wrote:
> > Hi All,
> >
> > I am trying to map Linux user to different SELinux user (user_u, guest_u,
> > xguest_u), but when I login it shows only as
> > system_u:system_r:local_login_t for all users.
>
> SElinux uses pam (pam_selinux) to tell login programs what context they
> should set for a user that logs in, i believe.
>
> pam_selinux gets these from /etc/selinux/*/contexts/ { default_contexts
> users/.* }, i think
> >
> > Regards,
> > Madhu
>

[-- Attachment #2: Type: text/html, Size: 1234 bytes --]

Re: Regarding SELinux User mapping

[c.r.madhusudhanan]

[-- Attachment #1: Type: text/plain, Size: 1089 bytes --]

Hi Guys,

Thanks for the help, I am now able to map SELinux user to the Linux user
after enabling the pam_selinux.


Regards,
Madhu

On Fri, May 27, 2011 at 7:00 PM, c.r.madhusudhanan@gmail.com <
c.r.madhusudhanan@gmail.com> wrote:

> Hello Dominick, Stephen,
>
> Thanks for the quick response. Meego doesnt use pam_selinux by default.
>
> I will try to enable the pam_selinux support, and let you know the result.
> Thanks for the help.
>
> Regards,
> Madhu
>
>
> On Fri, May 27, 2011 at 6:31 PM, Dominick Grift <domg472@gmail.com> wrote:
>
>>
>>
>> On Fri, 2011-05-27 at 18:20 +0530, c.r.madhusudhanan@gmail.com wrote:
>> > Hi All,
>> >
>> > I am trying to map Linux user to different SELinux user (user_u,
>> guest_u,
>> > xguest_u), but when I login it shows only as
>> > system_u:system_r:local_login_t for all users.
>>
>> SElinux uses pam (pam_selinux) to tell login programs what context they
>> should set for a user that logs in, i believe.
>>
>> pam_selinux gets these from /etc/selinux/*/contexts/ { default_contexts
>> users/.* }, i think
>> >
>> > Regards,
>> > Madhu
>>
>
>

[-- Attachment #2: Type: text/html, Size: 1831 bytes --]

Re: Regarding SELinux User mapping

[Russell Coker]

On Fri, 27 May 2011, "c.r.madhusudhanan@gmail.com" 
<c.r.madhusudhanan@gmail.com> wrote:
> Thanks for the quick response. Meego doesnt use pam_selinux by default.
> 
> I will try to enable the pam_selinux support, and let you know the result.
> Thanks for the help.

In the early days we had SE Linux patches for all login programs, pam_selinux 
is a more recent development.  You should be able to find the old login 
patches somewhere, although given the evolution of APIs it might be better to 
take the pam_selinux code and develop your own login patch.

PAM isn't required for SE Linux support (or anything really), it's just a lot 
easier in most cases.

-- 
My Main Blog         http://etbe.coker.com.au/
My Documents Blog    http://doc.coker.com.au/

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.