thx for the feedback Stephen, but i'm still unable to succeed,
i'm also getting some strange errors, so perhaps my installed policy isn't a
good one to start with :
# rpm -qa selinux-policy-targeted-sources
selinux-policy-targeted-sources-1.17.30-2.52.1
# rpm -qa|grep -i release
redhat-release-4AS-2
What i added to the policy :
############################################################################
###########
# /etc/selinux/targeted/src/policy/file_contexts/program/mytest.fc
############################################################################
###########
/var/hecou/fileA user_u:object_r:typeA_t
/var/hecou/fileB user_u:object_r:typeB_t
/var/hecou/fileC user_u:object_r:typeC_t
############################################################################
###########
# /etc/selinux/targeted/src/policy/domains/program/mytest.te
############################################################################
###########
# define filetypes
type typeA_t, file_type;
type typeB_t, file_type;
type typeC_t, file_type;
# define domains
type domainA_t, domain, file_type;
type domainB_t, domain, file_type;
type domainC_t, domain, file_type;
allow domainA_t typeA_t:file r_file_perms;
auditallow domainB_t typeB_t:file r_file_perms;
auditallow domainC_t typeC_t:file rw_file_perms;
# junk to tackle make-errors
bool read_default_t true;
bool user_rw_usb false;
bool user_rw_noexattrfile false;
bool user_direct_mouse false;
bool user_tcp_server false;
bool user_dmesg false;
type roleA_crond_t, domain, file_type, sysadmfile;
type roleB_crond_t, domain, file_type, sysadmfile;
# create roles
full_user_role(roleA);
full_user_role(roleB);
role roleA_r types {domainA_t unconfined_t};
role roleB_r types {domainA_t domainB_t domainC_t unconfined_t};
############################################################################
###########
# /etc/selinux/targeted/src/policy/users
############################################################################
###########
user userA roles roleA_r;
user userB roles roleB_r;
remember, my goal was :
fileA : may be read by roleA and roleB
fileB : may only be read by roleB ; audited
fileC : may be read and changed by roleB ; audited
and i executed the following actions :
DIR="/var/hecou"
mkdir ${DIR} ; chmod 777 ${DIR}
>${DIR}/fileA ; >${DIR}/fileB ; >${DIR}/fileC ; chmod 666 ${DIR}/*
useradd userA -m
useradd userB -m
the results :
- i had to add the 'junk' part to make it 'compile'. It seems to me that
the tests on the booleans would be better 'ifdef (user_rw_usb)' instead of
'if (user_rw_usb)', but maybe totaly not getting the picture. I also had to
define the roleA_crond_t and roleB_crond_t.
- if i test the policy with sepcut, i get a bunch of errors of the form :
assertion on line 28135 violated by allow unconfined_t domainA_t:process {
fork sigchld sigkill sigstop signull signal ptrace getsched setsched
getsession getpgid setpgid getcap setcap share getattr setexec setfscreate
noatsecure siginh setrlimit rlimitinh };
- setfiles /etc/selinux/targeted/src/policy/file_contexts/program/mytest.fc
/var/hecou
returns :
setfiles: read 3 specifications
setfiles: invalid context user_u:object_r:typeA_t on line number 4
setfiles: invalid context user_u:object_r:typeB_t on line number 5
setfiles: invalid context user_u:object_r:typeC_t on line number 6
i also have a silly question, in a security context (eg
user_u:object_r:typeA_t), what is the mening of user_u ?
hein
----- Original Message -----
From: "Stephen Smalley" <sds@xxxxxxxxxxxxx>
To: "Daniel J Walsh" <dwalsh@xxxxxxxxxx>
Cc: "Hein Coulier" <hein.coulier>; <fedora-selinux-list@xxxxxxxxxx>
Sent: Friday, May 06, 2005 3:17 PM
Subject: Re: using selinux to control user access to files
>
> For specific data files, it should be relatively straightforward; he
> just needs to instantiate the roles via full_user_role(), define a few
> new file types for the particular data he wants to restrict, and add
> specific allow rules and auditallow rules between the new user domains
> and the new file types. I agree that a higher level language or tool
> would make life simpler, but the mechanism is certainly capable of
> supporting the need.
>
> --
> Stephen Smalley <sds@xxxxxxxxxxxxx>
> National Security Agency
>
>
--
fedora-selinux-list mailing list
fedora-selinux-list@xxxxxxxxxx
http://www.redhat.com/mailman/listinfo/fedora-selinux-list
