On 03/03/2010 01:37 AM, TaurusHarry wrote:
> Hi SELinux experts,
>
> Thanks a lot for taking a look at my question, how could I implement
> the bash "if-then-else" and "test" grammar in current refpolicy
> interface? For example, if I don't want the user_t to have the
> privilege to execute any kind of shell, what proper grammar should I
> use to implement something with the same logic as 'if ! test "X$1" =
> "Xuser_t"' in the corecomd_exec_shell interface:
>
> interface(`corecmd_exec_shell',`
> gen_require(`
> type bin_t, shell_exec_t;
> ')
>
> if ! test "X$1" = "Xuser_t"; then
> list_dirs_pattern($1, bin_t, bin_t)
> read_lnk_files_pattern($1, bin_t, bin_t)
> can_exec($1, shell_exec_t)
> fi
> ')
>
> Thank you very much!
>
> Best regards,
> Harry
>
> ------------------------------------------------------------------------
> 搜索本应是彩色的,快来体验新一代搜索引擎-必应,精美图片每天换哦! 立即试
> 用！ <http://cn.bing.com/?form=CRMADS%20>
>
>
> _______________________________________________
> refpolicy mailing list
> refpolicy@oss.tresys.com
> http://oss.tresys.com/mailman/listinfo/refpolicy
>   
No that would not work. You need to define a new user type that a user
can login with. user_nobin_t, or something. Then you are going to need
to define all the rules necessary for this user to login and execute the
shell_exec_t and any other programs that you want them to run.

You write this in policy not in shell scripting.