Re: Single home directory type for all roles.

[Daniel J Walsh <dwalsh@redhat.com>]

Stephen Smalley wrote:

>On Thu, 2004-12-09 at 14:38, Daniel J Walsh wrote:
>  
>
>>Currently few people use staff, because user can do everything staff can 
>>do so you are not protected by this protection.
>>You also do not protect yourself from staff users attacking other staff 
>>users.
>>    
>>
>
>Few Fedora SELinux users use staff_r because user_canbe_sysadm is
>enabled by default in the Fedora policy.  Disable it, and they'll start
>using staff_r, because they will have to do so.  Colin has separation
>between staff_r and user_r if he has disabled that tunable, which I
>expect he has.  As for staff vs. staff, SELinux can only separate
>different security contexts; otherwise, you are relying on DAC (of
>course, SELinux does control the Linux capabilities, so your ability to
>override DAC controls can be limited by SELinux).
>
>If you disabled user_canbe_sysadm, and provided integrated user
>management so that people could update their policy users configuration
>(whether via policy sources or using genpolusers) easily when they
>update their regular users databases, then you'd see greater use of
>staff_r.
>
>  
>
Agreed, but I still have the relabeling problem.  My goal is to move 
towards the separation of user and staff though
a default disabling of user_canbe_sysadm, without having find and 
relabel all files the user might have created.



--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.