per role template confusion

per role template confusion

[Joe Nall]

Can someone explain the per role template implementation? I am confused.

During policy compilation, a .mod.role file is created that just  
references the roles in /usr/share/selinux/devel/include/rolemap  
regardless of the roles defined via semanage. Should semanage add  
roles to rolemap? Is there additional magic in semodule?

joe


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: per role template confusion

[Joshua Brindle]

Joe Nall wrote:
> Can someone explain the per role template implementation? I am confused.
>
> During policy compilation, a .mod.role file is created that just 
> references the roles in /usr/share/selinux/devel/include/rolemap 
> regardless of the roles defined via semanage. Should semanage add 
> roles to rolemap? Is there additional magic in semodule?
>
> joe 

Roles aren't created by semanage, only user->role mappings. The 
per_role_template creates derived types for each role (eg., 
staff_mozilla_t, sysadm_mozilla_t). These roles are defined in the 
policy only.


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: per role template confusion

[Joe Nall]

On Oct 9, 2008, at 3:24 PM, Joshua Brindle wrote:

> Joe Nall wrote:
>> Can someone explain the per role template implementation? I am  
>> confused.
>>
>> During policy compilation, a .mod.role file is created that just  
>> references the roles in /usr/share/selinux/devel/include/rolemap  
>> regardless of the roles defined via semanage. Should semanage add  
>> roles to rolemap? Is there additional magic in semodule?
>>
>> joe
>
> Roles aren't created by semanage, only user->role mappings. The  
> per_role_template creates derived types for each role (eg.,  
> staff_mozilla_t, sysadm_mozilla_t). These roles are defined in the  
> policy only.

Ok. I thought the role statement just did type mapping and did not  
realize there was an implicit role declaration.

I would still like an explanation of how this works and if/how new  
roles are handled with respect to per role templates.

joe


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: per role template confusion

[Christopher J. PeBenito]

On Thu, 2008-10-09 at 18:17 -0500, Joe Nall wrote:
> On Oct 9, 2008, at 3:24 PM, Joshua Brindle wrote:
> 
> > Joe Nall wrote:
> >> Can someone explain the per role template implementation? I am  
> >> confused.
> >>
> >> During policy compilation, a .mod.role file is created that just  
> >> references the roles in /usr/share/selinux/devel/include/rolemap  
> >> regardless of the roles defined via semanage. Should semanage add  
> >> roles to rolemap? Is there additional magic in semodule?
> >>
> >> joe
> >
> > Roles aren't created by semanage, only user->role mappings. The  
> > per_role_template creates derived types for each role (eg.,  
> > staff_mozilla_t, sysadm_mozilla_t). These roles are defined in the  
> > policy only.
> 
> Ok. I thought the role statement just did type mapping and did not  
> realize there was an implicit role declaration.
> 
> I would still like an explanation of how this works and if/how new  
> roles are handled with respect to per role templates.

For each entry in the rolemap file, the infrastructure calls the
[modulename]_per_role_template() for each module, if it exists.

If (u|r)bacsep succeeds, this will be dropped in favor of explicit
calls.

-- 
Chris PeBenito
Tresys Technology, LLC
(410) 290-1411 x150


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: per role template confusion

[Joe Nall]

On Oct 10, 2008, at 7:58 AM, Christopher J. PeBenito wrote:

> On Thu, 2008-10-09 at 18:17 -0500, Joe Nall wrote:
>> On Oct 9, 2008, at 3:24 PM, Joshua Brindle wrote:
>>
>>> Joe Nall wrote:
>>>> Can someone explain the per role template implementation? I am
>>>> confused.
>>>>
>>>> During policy compilation, a .mod.role file is created that just
>>>> references the roles in /usr/share/selinux/devel/include/rolemap
>>>> regardless of the roles defined via semanage. Should semanage add
>>>> roles to rolemap? Is there additional magic in semodule?
>>>>
>>>> joe
>>>
>>> Roles aren't created by semanage, only user->role mappings. The
>>> per_role_template creates derived types for each role (eg.,
>>> staff_mozilla_t, sysadm_mozilla_t). These roles are defined in the
>>> policy only.
>>
>> Ok. I thought the role statement just did type mapping and did not
>> realize there was an implicit role declaration.
>>
>> I would still like an explanation of how this works and if/how new
>> roles are handled with respect to per role templates.
>
> For each entry in the rolemap file, the infrastructure calls the
> [modulename]_per_role_template() for each module, if it exists.

The compilation infrastructure - correct?

So to add a new role I need to add it to the rolemap and rebuild the  
whole policy?

joe


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: per role template confusion

[Christopher J. PeBenito]

On Fri, 2008-10-10 at 09:03 -0500, Joe Nall wrote:
> On Oct 10, 2008, at 7:58 AM, Christopher J. PeBenito wrote:
> 
> > On Thu, 2008-10-09 at 18:17 -0500, Joe Nall wrote:
> >> On Oct 9, 2008, at 3:24 PM, Joshua Brindle wrote:
> >>
> >>> Joe Nall wrote:
> >>>> Can someone explain the per role template implementation? I am
> >>>> confused.
> >>>>
> >>>> During policy compilation, a .mod.role file is created that just
> >>>> references the roles in /usr/share/selinux/devel/include/rolemap
> >>>> regardless of the roles defined via semanage. Should semanage add
> >>>> roles to rolemap? Is there additional magic in semodule?
> >>>>
> >>>> joe
> >>>
> >>> Roles aren't created by semanage, only user->role mappings. The
> >>> per_role_template creates derived types for each role (eg.,
> >>> staff_mozilla_t, sysadm_mozilla_t). These roles are defined in the
> >>> policy only.
> >>
> >> Ok. I thought the role statement just did type mapping and did not
> >> realize there was an implicit role declaration.
> >>
> >> I would still like an explanation of how this works and if/how new
> >> roles are handled with respect to per role templates.
> >
> > For each entry in the rolemap file, the infrastructure calls the
> > [modulename]_per_role_template() for each module, if it exists.
> 
> The compilation infrastructure - correct?

I should have more specific: the refpolicy build infrastructure

> So to add a new role I need to add it to the rolemap and rebuild the  
> whole policy?

You only need to add it to the rolemap only if you want it to
automatically call all of the per_role_templates().  Otherwise you can
just call specific ones manually.

-- 
Chris PeBenito
Tresys Technology, LLC
(410) 290-1411 x150


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: per role template confusion

[Joe Nall]

On Oct 10, 2008, at 9:29 AM, Christopher J. PeBenito wrote:

> On Fri, 2008-10-10 at 09:03 -0500, Joe Nall wrote:
>> On Oct 10, 2008, at 7:58 AM, Christopher J. PeBenito wrote:
>>
>>> On Thu, 2008-10-09 at 18:17 -0500, Joe Nall wrote:
>>>> On Oct 9, 2008, at 3:24 PM, Joshua Brindle wrote:
>>>>
>>>>> Joe Nall wrote:
>>>>>> Can someone explain the per role template implementation? I am
>>>>>> confused.
>>>>>>
>>>>>> During policy compilation, a .mod.role file is created that just
>>>>>> references the roles in /usr/share/selinux/devel/include/rolemap
>>>>>> regardless of the roles defined via semanage. Should semanage add
>>>>>> roles to rolemap? Is there additional magic in semodule?
>>>>>>
>>>>>> joe
>>>>>
>>>>> Roles aren't created by semanage, only user->role mappings. The
>>>>> per_role_template creates derived types for each role (eg.,
>>>>> staff_mozilla_t, sysadm_mozilla_t). These roles are defined in the
>>>>> policy only.
>>>>
>>>> Ok. I thought the role statement just did type mapping and did not
>>>> realize there was an implicit role declaration.
>>>>
>>>> I would still like an explanation of how this works and if/how new
>>>> roles are handled with respect to per role templates.
>>>
>>> For each entry in the rolemap file, the infrastructure calls the
>>> [modulename]_per_role_template() for each module, if it exists.
>>
>> The compilation infrastructure - correct?
>
> I should have more specific: the refpolicy build infrastructure
>
>> So to add a new role I need to add it to the rolemap and rebuild the
>> whole policy?
>
> You only need to add it to the rolemap only if you want it to
> automatically call all of the per_role_templates().  Otherwise you can
> just call specific ones manually.

Can I use the depreciated role dominance to inherit from user_r if my  
roles are supersets of user_r? There are 51 (in fedora) per role  
templates that are missed with new roles - some of them are important :)

joe



--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: per role template confusion

[Daniel J Walsh]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Christopher J. PeBenito wrote:
> On Thu, 2008-10-09 at 18:17 -0500, Joe Nall wrote:
>> On Oct 9, 2008, at 3:24 PM, Joshua Brindle wrote:
>>
>>> Joe Nall wrote:
>>>> Can someone explain the per role template implementation? I am  
>>>> confused.
>>>>
>>>> During policy compilation, a .mod.role file is created that just  
>>>> references the roles in /usr/share/selinux/devel/include/rolemap  
>>>> regardless of the roles defined via semanage. Should semanage add  
>>>> roles to rolemap? Is there additional magic in semodule?
>>>>
>>>> joe
>>> Roles aren't created by semanage, only user->role mappings. The  
>>> per_role_template creates derived types for each role (eg.,  
>>> staff_mozilla_t, sysadm_mozilla_t). These roles are defined in the  
>>> policy only.
>> Ok. I thought the role statement just did type mapping and did not  
>> realize there was an implicit role declaration.
>>
>> I would still like an explanation of how this works and if/how new  
>> roles are handled with respect to per role templates.
> 
> For each entry in the rolemap file, the infrastructure calls the
> [modulename]_per_role_template() for each module, if it exists.
> 
This does NOT happen in Fedora.  I have patched this out and force
explicit calls to per_role_templates.  Calling them globably forces all
confined users to transition to per_role_templates even when you don't
want them to.

I believe this is a mistake.
> If (u|r)bacsep succeeds, this will be dropped in favor of explicit
> calls.
> 

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org

iEYEARECAAYFAkjvyKcACgkQrlYvE4MpobPzdgCffiTnFd8dU3PbVdYCklN0MCWK
QrcAoOdfb/vgix0G2smLpgSkb0InJEiI
=np8I
-----END PGP SIGNATURE-----

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.