Re: Single home directory type for all roles.

[Daniel J Walsh <dwalsh@redhat.com>]

Russell Coker wrote:

>On Thu, 2004-12-09 at 14:38 -0500, Daniel J Walsh wrote:
>  
>
>>If we move to this plan, we would turn off the compatability between 
>>user and staff.
>>So only staff users could su, usermod, newrole.  The reason they are the 
>>same now is because
>>of the labeling problem, and the inability to easily change from a user 
>>to a staff role.  Why would
>>you not have access to your old files, if you switch roles.  I agree 
>>this might be good in some cases
>>but can't we develop a less stringent rule that does not require relabeling.
>>    
>>
>
>If the aim is to have two roles with the same file access but different
>access to su etc then it would be better achieved by having two roles
>with the same default domain.
>
>So you could have user:staff_user_r:staff_t and user:staff_r:staff_t and
>only allow staff_su_t to be in role staff_r.
>
>  
>
Yes that might work, and that is really my goal.  I want to prevent 
"normal users" from
running certain tools based on their role.  Basically sudo, su, 
consolehelper ...



 

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.