Re: User home directory creation with useradd (rhbz#217441)

[Linda Knippers <linda.knippers@hp.com>]

>>> The sys-admin is wanting to create an entry for a user who 
>>> can login.  They don't want to think about creating a home 
>>> directory, creating a group, a user, a home directory, a SE 
>>> Linux user, and a SE Linux login mapping entry.
>>> 
> 
> 
> Doesn't matter, semanage doesn't need any more feature creep than it has
> right now.

I don't want more stuff in semanage.  We should be able to do it from
useradd, and from one role.  Right now its a multi step operation and
we can't run useradd and semanage from the same role.  Only sysadm_r
can run useradd and only secadm_r can run semanage with the current
MLS policy.

I've also noticed that only secadm_r can change the selinux context
of a file (makes sense) but secadm_r can't change the mode bits of
the same file, only sysadm_r can.  That doesn't make sense to me.
I don't know if that's a bug, a feature or a configuration problem
on my system (and is somewhat off-topic) but its another example of
illogical behavior.  Seems like secadm_r can do SELinux things but
not other security administration unrelated to SELinux, and that
makes SELinux look like a wart rather than an integrated feature.

Ok, here's another example.  secadm_r can manage policy but can't
'touch /.autorelabel', only sysadm_r can do that.

-- ljk

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.