Re: CentOS 5 RBAC

[Roy Badami <roy.badami@roboreus.com>]

On 31/08/2011 18:48, Dominick Grift wrote:
> On Wed, Aug 31, 2011 at 06:01:15PM +0100, Roy Badami wrote:
>> I'm trying to understand the RBAC features in the version of the mls
>> (and also strict) policies that ship with CentOS 5.6 - I'm not sure
>> if this is the best place to ask or if there's a more appropriate
>> list.
> refpolicy@oss.tresys.com is more appropriate.

Thanks - I'll bear that one in mind.
>
> When you build mls policy you get a seperate secadm role when you build strict policy then sysadm role also has the capabilities that secadm role in mls has.

Yes, so looks like it does makes sense for me to use the mls policy in 
that case.  Unfortunately in the mls policy on el5 it appears that both 
sysadm_r and secadm_r can both administer security.  secadm_r is 
preveneted from performing other systems administration, but 
unfortunately sysadm_r is not prevented from changint the selinux 
policy, etc.  This wasn't how I was hoping it would work :-(

>
> well whether the modules are installed (semodule -l | grep secadm) that i guess would be defined manually in the modules.conf for strict. if the secadm module is installed then it could be that the role is just not mapped to staff_u unless policy is mls ( see above: users file snippet)
Ah, I'd been trying to figure out how to verify what modules really were 
present in the loaded binary policy - that's very useful, thanks!  As as 
your other pointers to bits of the policy.

Regards

roy

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.