Re: Why are we managing seusers file via libsemanage?

[Daniel J Walsh <dwalsh@redhat.com>]

Ivan Gyurdiev wrote:
> Daniel J Walsh wrote:
>> I don't recall why we did this?
>>
>> I am now thinking this is not a good idea.  People were told to edit 
>> the /etc/selinux/POLICYTYPE/seusers file to change the default level 
>> at login, now we do this via libsemanage.  But doing this via 
>> libsemanage eliminates us from being able to distribute this 
>> information via say LDAP.
> I think the issue of management and of distribution are completely 
> independent from each other (or if not, they should be made so). 
> Distribution gets the data from A to B. Management interprets the 
> data, and decides what to do with it.
>
> I don't understand the way Unix updates the password for example - it 
> doesn't make sense to me, I would appreciate an explanation from 
> someone who knows better. It provides a shared read interface on the 
> passwd file (with backend switching via nss). It doesn't provide a 
> shared write interface - why? That seems to me like a design mistake, 
> where distribution/backend is tied to management. Why should I care 
> where the password is kept if all I want to do is update it. I don't 
> think we should replicate that behavior, and copy the read/write code 
> in 10 places, like it's done for passwd - not until it's clear why 
> this is the correct way to go.
>
>
Ok well the seusers file should indicate that it is machine generated 
and should not be edited then, or can it be eliminated all together.  
Users will edit this file...

We still need a mechanism for managing setrans.conf but I understand why 
that is separate from libsemanage currently.  I also think we need to 
look into a  semachine type interface that indicates that maximum 
security level for a particular machine.


Dan

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.