Re: This patch add seusers support to SELinux

[Daniel J Walsh <dwalsh@redhat.com>]

On 06/18/2009 04:14 PM, Joshua Brindle wrote:
> Daniel J Walsh wrote:
>> On 06/18/2009 09:48 AM, Joshua Brindle wrote:
>>> Joshua Brindle wrote:
>>>> Daniel J Walsh wrote:
>>>>> The idea here is to break the seusers file up into lots of little
>>>>> seusers file that can be user specific, also adds the service field to
>>>>> be used by tools like pam_selinux to choose which is the correct
>>>>> context
>>>>> to log a user in as.
>>>>>
>>>>> Patch was added to facilitate IPA handing out SELinux content for
>>>>> selection of roles at login.
>>>>>
>>>>
>>>> This patch does not affect the behavior of getseuserbyname(), how is
>>>> this expected to work with existing applications?
>>>>
>> I think it only affects pam_selinux.
>
> The function name is very confusing if its only used for pam_selinux,
> I'd like it renamed but seeing that pam_selinux is already deployed with
> it I suppose that isn't an option.
>
> Signed-off-by: Joshua Brindle <method@manicmethod.com>
>
>>>
>>> Also, what is the format of this file? What should service be to test
>>> this on F11?
>>>
>
>
>
> --
> This message was distributed to subscribers of the selinux mailing list.
> If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov
> with
> the words "unsubscribe selinux" without quotes as the message.
It is not only for pam_selinux, but that is currently the only user.

Really all this function does is add a second variable when selecting a 
users default context. service is just a string that the caller can 
specify.  It just allows you to change the default context you would get 
on entry to the system.  So I guess you could get use similar calls to 
get different context depending on whether or not you are on the 
console.  Imagine a dbus service which would run with one context if you 
we logged onto the console versus a different context if you were logged 
in via ssh.


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.