adduser script

adduser script

[Luke Kenneth Casson Leighton]

has anyone considered writing an adduser script modification
for selinux that adds users to /etc/selinux/users?


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

RE: adduser script

[Frank Mayer]

See seuser and the seuser* scripts in the setools package

owner-selinux@tycho.nsa.gov wrote:
> Subject: adduser script
> 
> 
> has anyone considered writing an adduser script modification
> for selinux that adds users to /etc/selinux/users?


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

RE: adduser script

[Ed Street]

Hello,

That should not be to difficult, just pass a context(s) switch or prompt for
it.

Ed


-----Original Message-----
From: owner-selinux@tycho.nsa.gov [mailto:owner-selinux@tycho.nsa.gov] On
Behalf Of Luke Kenneth Casson Leighton
Sent: Wednesday, May 19, 2004 5:17 AM
To: SE-Linux
Subject: adduser script

has anyone considered writing an adduser script modification
for selinux that adds users to /etc/selinux/users?

---

Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.687 / Virus Database: 448 - Release Date: 5/16/2004
 


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: adduser script

[Luke Kenneth Casson Leighton]

On Wed, May 19, 2004 at 07:56:33AM -0400, Ed Street wrote:
> Hello,
> 
> That should not be to difficult, just pass a context(s) switch or prompt for
> it.

 investigating more, i find a package adduser-ng (adduser next
 generation).

 it has a plugin system which has the ability to pass options up to
 the main commandline usage, and even the /etc/shadow setup is
 done as a plugin.

 ... it's written in perl.

 assuming i can get over my gratuitous and unnecessary lack of respect
 for ptooey^H^H^H^H^Herl, could someone advise me if it's a simple
 enough and acceptable procedure to:

	 - accept an option --selinux-roles="staff sysadm user system"
	   (or maybe staff_r etc. because it will be less perl coding for
	    ME!)

	 - parse the /etc/selinux/users file looking for the string
	   "user [$username] roles"

	 - replace the relevant line with the roles _r
	   (if i can be bothered)

	 - do a syscall to "make -C /etc/selinux install"

 and leave it at that - all pretty much hard-coded.

 - no checking / parsing of the roles because other roles may be
   added by the sysadmin


 thoughts, comments?
 
 how do i do a delete?
 _do_ i have to do a delete?

 if a role is left in the /etc/selinux/users and there is no passwd
 entry, does it matter?

 l.

> -----Original Message-----
> From: owner-selinux@tycho.nsa.gov [mailto:owner-selinux@tycho.nsa.gov] On
> Behalf Of Luke Kenneth Casson Leighton
> Sent: Wednesday, May 19, 2004 5:17 AM
> To: SE-Linux
> Subject: adduser script
> 
> has anyone considered writing an adduser script modification
> for selinux that adds users to /etc/selinux/users?
> 
> ---
> 
> Checked by AVG anti-virus system (http://www.grisoft.com).
> Version: 6.0.687 / Virus Database: 448 - Release Date: 5/16/2004
>  
> 

-- 
-- 
expecting email to be received and understood is a bit like
picking up the telephone and immediately dialing without
checking for a dial-tone; speaking immediately without listening
for either an answer or ring-tone; hanging up immediately and
believing that you have actually started a conversation.
--
<a href="http://lkcl.net">      lkcl.net      </a> <br />
<a href="mailto:lkcl@lkcl.net"> lkcl@lkcl.net </a> <br />


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

RE: adduser script

[Ed Street]

Hello,

That should work. One other thing you may want do is give the user a choice
in which role(s) to assign, that would eliminate any typo's and be newbie
friendly, say 1) user_r 2) staff_r 3 sysadm_r q) quit or something similar.
By default any abuser not in the users file is assigned user_r.

Ed

-----Original Message-----
From: Luke Kenneth Casson Leighton [mailto:lkcl@lkcl.net] 
Sent: Wednesday, May 19, 2004 9:33 AM
To: Ed Street
Cc: 'SE-Linux'
Subject: Re: adduser script

On Wed, May 19, 2004 at 07:56:33AM -0400, Ed Street wrote:
> Hello,
> 
> That should not be to difficult, just pass a context(s) switch or prompt
for
> it.

 investigating more, i find a package adduser-ng (adduser next
 generation).

 it has a plugin system which has the ability to pass options up to
 the main commandline usage, and even the /etc/shadow setup is
 done as a plugin.

 ... it's written in perl.

 assuming i can get over my gratuitous and unnecessary lack of respect
 for ptooey^H^H^H^H^Herl, could someone advise me if it's a simple
 enough and acceptable procedure to:

	 - accept an option --selinux-roles="staff sysadm user system"
	   (or maybe staff_r etc. because it will be less perl coding for
	    ME!)

	 - parse the /etc/selinux/users file looking for the string
	   "user [$username] roles"

	 - replace the relevant line with the roles _r
	   (if i can be bothered)

	 - do a syscall to "make -C /etc/selinux install"

 and leave it at that - all pretty much hard-coded.

 - no checking / parsing of the roles because other roles may be
   added by the sysadmin


 thoughts, comments?
 
 how do i do a delete?
 _do_ i have to do a delete?

 if a role is left in the /etc/selinux/users and there is no passwd
 entry, does it matter?

 l.
 

---

Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.687 / Virus Database: 448 - Release Date: 5/16/2004
 


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: adduser script

[Luke Kenneth Casson Leighton]

On Wed, May 19, 2004 at 07:56:11AM -0400, Frank Mayer wrote:
> See seuser and the seuser* scripts in the setools package
 
 ah _ha_.

 okay.

 these are a very good base for adoption / adaption into adduser.

 unfortunately, the programs call useradd directly, which is what
 adduser-ng does [in a plugin].

 frank, would you be willing to split out the functionality
 of seuseradd etc. that deals with /etc/selinux/users into
 _separate_ programs?

 and make seuseradd etc. call those programs?

 at the moment, the structure is like this:

 seuseradd ---> useradd [-> accesses /etc/passwd]
            |
			|-> direct access to /etc/selinux/users

 and adduser-ng does this, with plugins being optional:

 adduser-ng ---> useradd [-> accesses /etc/passwd]
             |
			 |-> exim4plugin [-> accesses /etc/aliases]
			 |
			 |-> eximplugin [-> accesses /etc/aliases]
			 |
			 |-> PasswdUser plugin [-> direct access to /etc/shadow]
   
  
  what i would like to see is this:

 seuseradd ---> useradd [-> accesses /etc/passwd]
            |
			|-> addseuser [-> direct access to /etc/selinux/users]


 then i could _very_ easily do this, with oh about 1/2 a days' work:

 adduser-ng ---> useradd [-> accesses /etc/passwd]
             |
			 |-> exim4plugin [-> accesses /etc/aliases]
			 |
			 |-> eximplugin [-> accesses /etc/aliases]
			 |
			 |-> PasswdUser plugin [-> direct access to /etc/shadow]
             |
			 |-> addseuser [-> direct access to /etc/selinux/users]


 where addseuser is the functionality of the present seuseradd
 that manages /etc/selinux/users, split out into a separate program.

 etc.  same for seuserdel etc.


 go on, go on, you know you want to :)

 pleeease?

 everyone gains, because then the [standard] program adduser could be
 used to manage selinux users.

 sincerely,

 l.


> owner-selinux@tycho.nsa.gov wrote:
> > Subject: adduser script
> > 
> > 
> > has anyone considered writing an adduser script modification
> > for selinux that adds users to /etc/selinux/users?
> 
> 
> --
> This message was distributed to subscribers of the selinux mailing list.
> If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
> the words "unsubscribe selinux" without quotes as the message.

-- 
-- 
expecting email to be received and understood is a bit like
picking up the telephone and immediately dialing without
checking for a dial-tone; speaking immediately without listening
for either an answer or ring-tone; hanging up immediately and
believing that you have actually started a conversation.
--
<a href="http://lkcl.net">      lkcl.net      </a> <br />
<a href="mailto:lkcl@lkcl.net"> lkcl@lkcl.net </a> <br />


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: adduser script

[Luke Kenneth Casson Leighton]

On Wed, May 19, 2004 at 09:44:40AM -0400, Ed Street wrote:
> Hello,
> 
> That should work. One other thing you may want do is give the user a choice
> in which role(s) to assign, that would eliminate any typo's and be newbie
> friendly, say 1) user_r 2) staff_r 3 sysadm_r q) quit or something similar.
> By default any abuser not in the users file is assigned user_r.
 
 ed, looks like tresys have already done the hard work with the seuseradd
 scripts as part of the setools package (in cvs on sf.net at least)

 the seuseradd scripts, however, duplicate the role of adduser, by
 1) calling useradd (which manages /etc/passwd) 2) modifying
 /etc/selinux/users direct.

 what is ideally required is a separate program that doesn't call
 useradd, then it's a trivial task to write a plugin for adduser-ng
 to call that separate program.

 l.


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: adduser script

[Luke Kenneth Casson Leighton]

On Wed, May 19, 2004 at 07:56:11AM -0400, Frank Mayer wrote:
> See seuser and the seuser* scripts in the setools package
> 

oh!  a bit more investigation: am i right in thinking that
seuser _is_ the program i was expecting (it is responsible
for modifying and managing /etc/selinux/*) and that the
seuser* scripts _are_ only calling seuser as required,
therefore seuser* _are_ already equivalent to adduser-ng?

l.

> owner-selinux@tycho.nsa.gov wrote:
> > Subject: adduser script
> > 
> > 
> > has anyone considered writing an adduser script modification
> > for selinux that adds users to /etc/selinux/users?
> 
> 
> --
> This message was distributed to subscribers of the selinux mailing list.
> If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
> the words "unsubscribe selinux" without quotes as the message.

-- 
-- 
expecting email to be received and understood is a bit like
picking up the telephone and immediately dialing without
checking for a dial-tone; speaking immediately without listening
for either an answer or ring-tone; hanging up immediately and
believing that you have actually started a conversation.
--
<a href="http://lkcl.net">      lkcl.net      </a> <br />
<a href="mailto:lkcl@lkcl.net"> lkcl@lkcl.net </a> <br />


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: adduser script

[Luke Kenneth Casson Leighton]

On Wed, May 19, 2004 at 01:32:43PM +0000, Luke Kenneth Casson Leighton wrote:

>  investigating more, i find a package adduser-ng (adduser next
>  generation).
> 
>  it has a plugin system which has the ability to pass options up to
>  the main commandline usage, and even the /etc/shadow setup is
>  done as a plugin.
> 
>  ... it's written in perl.
> 
>  assuming i can get over my gratuitous and unnecessary lack of respect
>  for ptooey^H^H^H^H^Herl, could someone advise me if it's a simple
>  enough and acceptable procedure to:
> 
> 	 - accept an option --selinux-roles="staff sysadm user system"
> 	   (or maybe staff_r etc. because it will be less perl coding for
> 	    ME!)
 
 ... scratch that: the seuser program (by tresys) has, i believe,
 all of the functionality and options necessary.

 therefore, all i have to do is present that functionality by
 way of an adduser-ng plugin.

 l.


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

RE: adduser script

[Frank Mayer]

Luke Kenneth Casson Leighton wrote:
> On Wed, May 19, 2004 at 07:56:11AM -0400, Frank Mayer wrote:
>> See seuser and the seuser* scripts in the setools package
>> 
> oh!  a bit more investigation: am i right in thinking that
> seuser _is_ the program i was expecting (it is responsible
> for modifying and managing /etc/selinux/*) and that the
> seuser* scripts _are_ only calling seuser as required,
> therefore seuser* _are_ already equivalent to adduser-ng?

Yes based on your description, although I'm not familiar with adduser-ng.  The
seuser program only manages the selinux aspect of users, and the scripts
integrates seuser and the system user* utilities.

Franks


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: adduser script

[Luke Kenneth Casson Leighton]

On Wed, May 19, 2004 at 12:10:06PM -0400, Frank Mayer wrote:
> Luke Kenneth Casson Leighton wrote:
> > On Wed, May 19, 2004 at 07:56:11AM -0400, Frank Mayer wrote:
> >> See seuser and the seuser* scripts in the setools package
> >> 
> > oh!  a bit more investigation: am i right in thinking that
> > seuser _is_ the program i was expecting (it is responsible
> > for modifying and managing /etc/selinux/*) and that the
> > seuser* scripts _are_ only calling seuser as required,
> > therefore seuser* _are_ already equivalent to adduser-ng?
> 
> Yes based on your description, although I'm not familiar with adduser-ng.  The
> seuser program only manages the selinux aspect of users, and the scripts
> integrates seuser and the system user* utilities.
 
 excellent.

 btw fyi:
 
	lkcl@debian:~$ apt-cache show adduser-ng

	Description: Add and remove users and groups
	 This package is meant to be a replacement for the adduser script.
	 It's written in perl with flexibility and modularity kept in mind.
	 .
	 The major advantages are:
	 .
	  * built-in plugins for user and groups administration,
	  * different set of User Interfaces,
	  * very flexible configuration,
	  * good documentation on how to write your own plugins.
	 .
	 Homepage: http://adduser.linux.pl



--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.