Re: User home directory creation with useradd (rhbz#217441)

[Karl MacMillan <kmacmillan@mentalrootkit.com>]

Casey Schaufler wrote:
> --- Linda Knippers <linda.knippers@hp.com> wrote:
> 
> 
>> I don't want more stuff in semanage.  We should be
>> able to do it from
>> useradd, and from one role.  Right now its a multi
>> step operation and
>> we can't run useradd and semanage from the same
>> role.  Only sysadm_r
>> can run useradd and only secadm_r can run semanage
>> with the current
>> MLS policy.
> 
> While this is inconvenient, it is consistant
> with the separation of roles. You might want
> a role explictitly for this function.
> Experiance on other systems has been that
> neither the secadm nor the sysadm roles are
> sufficient for adding a user by themselves,
> nor should they be.
> 

It should be configurable via policy, which means the code should be 
present in useradd. The vast majority of SELinux systems shipped don't 
have a secadm role. For that configuration the sysadm should be able to 
create a user and a user mapping in a single step.


Karl

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.