Re: I am attempting to add a secadm_r

[Luke Kenneth Casson Leighton <lkcl@lkcl.net>]

On Thu, Apr 07, 2005 at 01:39:36PM -0400, Stephen Smalley wrote:

> >  if secadm could be drastically restricted to pretty much only be
> >  able to run policy / labelling selinux command tools - even better.
> 
> Problematic at present, given that policy is modified in source form,
> unless you want to require all policy modifications to be done off-line
> and then only allow updated binary policy to be installed by the secadm.

 the arrangement that i have is complicated by the fact that
 when a new user is added, some additions to about three
 policy source files are also required, which defines some new
 domains under which the user is exclusively allowed access to
 a subdirectory of the transfer area and to that area _alone_.

 i am therefore giving serious consideration to writing this as a
 script, which the day-to-day operator will be allowed to run (yes,
 there could end up being hundreds of new users, each with their own
 separate and exclusively accessible transfer area)

 and setting up a domain under which this script can be run, and
 allowing the operator to run it.

 that is the _only_ way that i would normally like policy to
 be modifiable on this system - except possibly by sysadm_r.

 i could then give serious consideration to allowing staff_r the right
 to run this magic script.


 ... i get the impression that it might be better to have
 a sysadm_r role (as it presently is) which is allowed
 "EVVERRYTHING", and a second-tier role which is allowed
 "everything-sysadm-can-presently-do-except-policy-related-stuff".

 l.


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.