* Regarding SELinux User mapping @ 2011-05-27 12:50 c.r.madhusudhanan 2011-05-27 13:00 ` Stephen Smalley 2011-05-27 13:01 ` Dominick Grift 0 siblings, 2 replies; 6+ messages in thread From: c.r.madhusudhanan @ 2011-05-27 12:50 UTC (permalink / raw) To: selinux [-- Attachment #1: Type: text/plain, Size: 490 bytes --] Hi All, I am trying to map Linux user to different SELinux user (user_u, guest_u, xguest_u), but when I login it shows only as system_u:system_r:local_login_t for all users. I used semanage to map. # semange login -l Login Name SELinux User __default__ user_u root root system_u system_u I am using selinux enabled kernel in Meego 1.2 , built user space packages from http://userspace.selinuxproject.org and using refpolicy-2.20101213. Regards, Madhu [-- Attachment #2: Type: text/html, Size: 621 bytes --] ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: Regarding SELinux User mapping 2011-05-27 12:50 Regarding SELinux User mapping c.r.madhusudhanan @ 2011-05-27 13:00 ` Stephen Smalley 2011-05-27 13:01 ` Dominick Grift 1 sibling, 0 replies; 6+ messages in thread From: Stephen Smalley @ 2011-05-27 13:00 UTC (permalink / raw) To: c.r.madhusudhanan@gmail.com; +Cc: selinux On Fri, 2011-05-27 at 18:20 +0530, c.r.madhusudhanan@gmail.com wrote: > I am trying to map Linux user to different SELinux user (user_u, > guest_u, xguest_u), but when I login it shows only as > system_u:system_r:local_login_t for all users. I used semanage to > map. > > # semange login -l > > Login Name SELinux User > > __default__ user_u > root root > system_u system_u > > > I am using selinux enabled kernel in Meego 1.2 , built user space > packages > from http://userspace.selinuxproject.org and using > refpolicy-2.20101213. Do you have pam_selinux in your pam configuration for login? Fedora has the following session modules in /etc/pam.d/login: # pam_selinux.so close should be the first session rule session required pam_selinux.so close session required pam_loginuid.so session optional pam_console.so # pam_selinux.so open should only be followed by sessions to be executed in the user context session required pam_selinux.so open session required pam_namespace.so session optional pam_keyinit.so force revoke session include system-auth Note that they call pam_selinux twice in the stack, once with 'close' and once with 'open', in order to distinguish what session modules should run with the login program's context vs what session modules should run with the user's context. -- Stephen Smalley National Security Agency -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with the words "unsubscribe selinux" without quotes as the message. ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: Regarding SELinux User mapping 2011-05-27 12:50 Regarding SELinux User mapping c.r.madhusudhanan 2011-05-27 13:00 ` Stephen Smalley @ 2011-05-27 13:01 ` Dominick Grift 2011-05-27 13:30 ` c.r.madhusudhanan 1 sibling, 1 reply; 6+ messages in thread From: Dominick Grift @ 2011-05-27 13:01 UTC (permalink / raw) To: c.r.madhusudhanan@gmail.com; +Cc: selinux [-- Attachment #1: Type: text/plain, Size: 511 bytes --] On Fri, 2011-05-27 at 18:20 +0530, c.r.madhusudhanan@gmail.com wrote: > Hi All, > > I am trying to map Linux user to different SELinux user (user_u, guest_u, > xguest_u), but when I login it shows only as > system_u:system_r:local_login_t for all users. SElinux uses pam (pam_selinux) to tell login programs what context they should set for a user that logs in, i believe. pam_selinux gets these from /etc/selinux/*/contexts/ { default_contexts users/.* }, i think > > Regards, > Madhu [-- Attachment #2: This is a digitally signed message part --] [-- Type: application/pgp-signature, Size: 198 bytes --] ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: Regarding SELinux User mapping 2011-05-27 13:01 ` Dominick Grift @ 2011-05-27 13:30 ` c.r.madhusudhanan 2011-05-27 15:09 ` c.r.madhusudhanan 2011-05-27 22:45 ` Russell Coker 0 siblings, 2 replies; 6+ messages in thread From: c.r.madhusudhanan @ 2011-05-27 13:30 UTC (permalink / raw) To: Dominick Grift, Stephen Smalley; +Cc: selinux [-- Attachment #1: Type: text/plain, Size: 810 bytes --] Hello Dominick, Stephen, Thanks for the quick response. Meego doesnt use pam_selinux by default. I will try to enable the pam_selinux support, and let you know the result. Thanks for the help. Regards, Madhu On Fri, May 27, 2011 at 6:31 PM, Dominick Grift <domg472@gmail.com> wrote: > > > On Fri, 2011-05-27 at 18:20 +0530, c.r.madhusudhanan@gmail.com wrote: > > Hi All, > > > > I am trying to map Linux user to different SELinux user (user_u, guest_u, > > xguest_u), but when I login it shows only as > > system_u:system_r:local_login_t for all users. > > SElinux uses pam (pam_selinux) to tell login programs what context they > should set for a user that logs in, i believe. > > pam_selinux gets these from /etc/selinux/*/contexts/ { default_contexts > users/.* }, i think > > > > Regards, > > Madhu > [-- Attachment #2: Type: text/html, Size: 1234 bytes --] ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: Regarding SELinux User mapping 2011-05-27 13:30 ` c.r.madhusudhanan @ 2011-05-27 15:09 ` c.r.madhusudhanan 2011-05-27 22:45 ` Russell Coker 1 sibling, 0 replies; 6+ messages in thread From: c.r.madhusudhanan @ 2011-05-27 15:09 UTC (permalink / raw) To: Dominick Grift, Stephen Smalley; +Cc: selinux [-- Attachment #1: Type: text/plain, Size: 1089 bytes --] Hi Guys, Thanks for the help, I am now able to map SELinux user to the Linux user after enabling the pam_selinux. Regards, Madhu On Fri, May 27, 2011 at 7:00 PM, c.r.madhusudhanan@gmail.com < c.r.madhusudhanan@gmail.com> wrote: > Hello Dominick, Stephen, > > Thanks for the quick response. Meego doesnt use pam_selinux by default. > > I will try to enable the pam_selinux support, and let you know the result. > Thanks for the help. > > Regards, > Madhu > > > On Fri, May 27, 2011 at 6:31 PM, Dominick Grift <domg472@gmail.com> wrote: > >> >> >> On Fri, 2011-05-27 at 18:20 +0530, c.r.madhusudhanan@gmail.com wrote: >> > Hi All, >> > >> > I am trying to map Linux user to different SELinux user (user_u, >> guest_u, >> > xguest_u), but when I login it shows only as >> > system_u:system_r:local_login_t for all users. >> >> SElinux uses pam (pam_selinux) to tell login programs what context they >> should set for a user that logs in, i believe. >> >> pam_selinux gets these from /etc/selinux/*/contexts/ { default_contexts >> users/.* }, i think >> > >> > Regards, >> > Madhu >> > > [-- Attachment #2: Type: text/html, Size: 1831 bytes --] ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: Regarding SELinux User mapping 2011-05-27 13:30 ` c.r.madhusudhanan 2011-05-27 15:09 ` c.r.madhusudhanan @ 2011-05-27 22:45 ` Russell Coker 1 sibling, 0 replies; 6+ messages in thread From: Russell Coker @ 2011-05-27 22:45 UTC (permalink / raw) To: c.r.madhusudhanan@gmail.com, selinux On Fri, 27 May 2011, "c.r.madhusudhanan@gmail.com" <c.r.madhusudhanan@gmail.com> wrote: > Thanks for the quick response. Meego doesnt use pam_selinux by default. > > I will try to enable the pam_selinux support, and let you know the result. > Thanks for the help. In the early days we had SE Linux patches for all login programs, pam_selinux is a more recent development. You should be able to find the old login patches somewhere, although given the evolution of APIs it might be better to take the pam_selinux code and develop your own login patch. PAM isn't required for SE Linux support (or anything really), it's just a lot easier in most cases. -- My Main Blog http://etbe.coker.com.au/ My Documents Blog http://doc.coker.com.au/ -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with the words "unsubscribe selinux" without quotes as the message. ^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2011-05-27 22:45 UTC | newest] Thread overview: 6+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2011-05-27 12:50 Regarding SELinux User mapping c.r.madhusudhanan 2011-05-27 13:00 ` Stephen Smalley 2011-05-27 13:01 ` Dominick Grift 2011-05-27 13:30 ` c.r.madhusudhanan 2011-05-27 15:09 ` c.r.madhusudhanan 2011-05-27 22:45 ` Russell Coker
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.