From: dE <de.techno@gmail.com>
To: selinux@tycho.nsa.gov
Subject: Re: Presidency of user/role/type permissions.
Date: Thu, 15 May 2014 23:10:27 +0530 [thread overview]
Message-ID: <5374FC0B.1080804@gmail.com> (raw)
In-Reply-To: <53736433.1030107@redhat.com>
On 05/14/14 18:10, Daniel J Walsh wrote:
> As far as roles/type combinations, most system roles get assigned the
> system_r role. This is the vast majority of role/type combination.
> seinfo -rsystem_r -x | wc -l
> 776
>
> User roles are assigned based on the _run interfaces, and are built into
> higher level interfaces to get assigned automatically when you define a
> new user_r as a user.
>
> seinfo -ruser_r -x | wc -l
> 175
> seinfo -rguest_r -x | wc -l
> 95
Since the role has a set of allowed type it acts as an abstraction
between a new user and the types; simply assigning a user a certain role
is enough to define the allowed types a process can have under the user.
Since I don't know M4 macros, I would request you to clarify 1 more
question -- when a new type is defined, the macros are used to define
which roles will this new type be allowed in? Or is it the other way
around -- the definition of one of the role is modified so as to include
this new type?
next prev parent reply other threads:[~2014-05-15 17:43 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2014-05-13 9:48 Presidency of user/role/type permissions dE
2014-05-13 12:26 ` Christopher J. PeBenito
2014-05-13 13:52 ` Daniel J Walsh
2014-05-14 6:03 ` dE
2014-05-14 6:10 ` dE
2014-05-14 12:40 ` Daniel J Walsh
2014-05-15 17:40 ` dE [this message]
2014-05-15 19:08 ` Daniel J Walsh
2014-05-19 3:09 ` dE
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=5374FC0B.1080804@gmail.com \
--to=de.techno@gmail.com \
--cc=selinux@tycho.nsa.gov \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.