Re: Why are we managing seusers file via libsemanage?

[Ivan Gyurdiev <ivg2@cornell.edu>]

Daniel J Walsh wrote:
> I don't recall why we did this?
>
> I am now thinking this is not a good idea.  People were told to edit 
> the /etc/selinux/POLICYTYPE/seusers file to change the default level 
> at login, now we do this via libsemanage.  But doing this via 
> libsemanage eliminates us from being able to distribute this 
> information via say LDAP.
I think the issue of management and of distribution are completely 
independent from each other (or if not, they should be made so). 
Distribution gets the data from A to B. Management interprets the data, 
and decides what to do with it.

I don't understand the way Unix updates the password for example - it 
doesn't make sense to me, I would appreciate an explanation from someone 
who knows better. It provides a shared read interface on the passwd file 
(with backend switching via nss). It doesn't provide a shared write 
interface - why? That seems to me like a design mistake, where 
distribution/backend is tied to management. Why should I care where the 
password is kept if all I want to do is update it. I don't think we 
should replicate that behavior, and copy the read/write code in 10 
places, like it's done for passwd - not until it's clear why this is the 
correct way to go.



--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.