semodule quirk

semodule quirk

[Serge E. Hallyn]

[ Oops, sent this earlier from an unsubscribed account ]

I've got a policy module which just creates a new type and role,
intended for use by a new (linux) user.  An selinux user cannot be
defined in the policy module (near as I can tell, else I get
	ERROR 'Users cannot be declared in MLS modules' at token ';

So I don't define an selinux user, and do:

	semodule -i my_module.pp
	semanage user -a -R whatever_r -P whatever whatever_u
	semanage login -a -s whatever_u whatever

But, if the module wants to label a home directory for the user,
contexts involving the new (selinux) user are of course not yet
valid until after I run semanage.  Likewise I can't create the
user using semanage until I've defined the role and type using
semodule.

So for now I split the module into two, one defining the role
and type and related .te rules but an empty .fc, and one with
basically empty .te, defining all the filecontexts, and I do

	semodule -i my_module.pp
	semanage user -a -R whatever_r -P whatever whatever_u
	semanage login -a -s whatever_u whatever
	semodule -i my_modulefc.pp

which works fine.

Is there a better solution allowing a single module?  Should
there be?  Practically speaking I'm fine with the tradeoff of
having to use two separate modules for being able to user
semanage user and login, it just seems weird  :)

-serge

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: semodule quirk

[Stephen Smalley]

On Fri, 2006-09-15 at 21:28 -0500, Serge E. Hallyn wrote:
> [ Oops, sent this earlier from an unsubscribed account ]
> 
> I've got a policy module which just creates a new type and role,
> intended for use by a new (linux) user.  An selinux user cannot be
> defined in the policy module (near as I can tell, else I get
> 	ERROR 'Users cannot be declared in MLS modules' at token ';
> 
> So I don't define an selinux user, and do:
> 
> 	semodule -i my_module.pp
> 	semanage user -a -R whatever_r -P whatever whatever_u
> 	semanage login -a -s whatever_u whatever
> 
> But, if the module wants to label a home directory for the user,
> contexts involving the new (selinux) user are of course not yet
> valid until after I run semanage.  Likewise I can't create the
> user using semanage until I've defined the role and type using
> semodule.
> 
> So for now I split the module into two, one defining the role
> and type and related .te rules but an empty .fc, and one with
> basically empty .te, defining all the filecontexts, and I do
> 
> 	semodule -i my_module.pp
> 	semanage user -a -R whatever_r -P whatever whatever_u
> 	semanage login -a -s whatever_u whatever
> 	semodule -i my_modulefc.pp
> 
> which works fine.
> 
> Is there a better solution allowing a single module?  Should
> there be?  Practically speaking I'm fine with the tradeoff of
> having to use two separate modules for being able to user
> semanage user and login, it just seems weird  :)

Fixing user support in MLS modules is the right solution.  Which I think
Darrel is very close to enabling, now that we have semantic MLS
representations.

-- 
Stephen Smalley
National Security Agency

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: semodule quirk

[Darrel Goeddel]

Stephen Smalley wrote:
> On Fri, 2006-09-15 at 21:28 -0500, Serge E. Hallyn wrote:
> 
>>[ Oops, sent this earlier from an unsubscribed account ]
>>
>>I've got a policy module which just creates a new type and role,
>>intended for use by a new (linux) user.  An selinux user cannot be
>>defined in the policy module (near as I can tell, else I get
>>	ERROR 'Users cannot be declared in MLS modules' at token ';
>>
>>So I don't define an selinux user, and do:
>>
>>	semodule -i my_module.pp
>>	semanage user -a -R whatever_r -P whatever whatever_u
>>	semanage login -a -s whatever_u whatever
>>
>>But, if the module wants to label a home directory for the user,
>>contexts involving the new (selinux) user are of course not yet
>>valid until after I run semanage.  Likewise I can't create the
>>user using semanage until I've defined the role and type using
>>semodule.
>>
>>So for now I split the module into two, one defining the role
>>and type and related .te rules but an empty .fc, and one with
>>basically empty .te, defining all the filecontexts, and I do
>>
>>	semodule -i my_module.pp
>>	semanage user -a -R whatever_r -P whatever whatever_u
>>	semanage login -a -s whatever_u whatever
>>	semodule -i my_modulefc.pp
>>
>>which works fine.
>>
>>Is there a better solution allowing a single module?  Should
>>there be?  Practically speaking I'm fine with the tradeoff of
>>having to use two separate modules for being able to user
>>semanage user and login, it just seems weird  :)
> 
> 
> Fixing user support in MLS modules is the right solution.  Which I think
> Darrel is very close to enabling, now that we have semantic MLS
> representations.

Yep, you have great timing - I was hacking on this over the weekend.  I have
something working.  It enables range_transitions and users with MLS info to
be placed in modules.  I still want to go over everything again to make sure
that I have things right.  I'll post the patch in a bit for comments/testing.

-- 

Darrel

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.