Re: This patch add seusers support to SELinux

[Daniel J Walsh <dwalsh@redhat.com>]

On 06/19/2009 03:30 PM, Chris PeBenito wrote:
> On Fri, 2009-06-19 at 14:29 -0400, Daniel J Walsh wrote:
>> Basically this is the exact same file as the seusers file except it one
>> per Linux User where is the seusers file is one record per Linux User.
>>
>> If I have a distributed environment, I need to say stuff like
>>
>> engineers logging into people.redhat.com get guest_t:s0
>> Admins logging in get unconfined_t:SystemLow-SystemHigh
>>
>> In addition on some machines dwalsh is an admin and on others he is a
>> peon.  So using IPA we generate a mapping from MACHINE to User
>>
>> dwalsh on dwalsh_laptop gets unconfined_t
>> dwalsh on desktop gets user_t
>> dwalsh on people gets guest_t
>>
>> There is a potential use for service but it will probably default to *
>> for now.
>
> I don't have a problem with this idea, but I do have a problem with this
> not replacing the current seuser behavior.  Having two ways to map linux
> users to selinux users is an administration nightmare.  People will be
> confused about which one to use and you'll need to know precedence.
> What you describe above with the contents of each file just having a *
> service would be the same as the current seuser behavior.
>
Well I don't see administrators editing the new format, we have not even 
used it yet, since IPA has not shipped this functionality yet.

But there is precedence for this in the default_context versus the 
context/users files.



--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.