Re: Why are we managing seusers file via libsemanage?

[Ivan Gyurdiev <ivg2@cornell.edu>]

>> I don't recall why we did this?
>>
>> I am now thinking this is not a good idea.  People were told to edit 
>> the /etc/selinux/POLICYTYPE/seusers file to change the default level 
>> at login, now we do this via libsemanage.  But doing this via 
>> libsemanage eliminates us from being able to distribute this 
>> information via say LDAP.
>>
> so that there could be a system + local (combined at commit time) iirc.
Actually that's a bad example for seusers, which are the one case where 
there is no system + local currently...
>
> the database design of libsemanage should be conducive to distributing 
> this info with LDAP and still adding it to the policy at commit time. 
> Ivan made the database implementation fairly flexible about changing 
> the storage backend while still pulling the data in and using it to 
> rebuild policies.
Yes, hopefully we should be able to write an LDAP backend for this data 
model.



--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.