On Mon, 2005-07-25 at 09:44 -0700, Todd Merritt wrote: > I've updated to the devel version of the strict policy, I tried > commenting out the can_execs from the base_user_macro.te and > user_macros.te, but I still don't see anything in the audit log when I > try running a number of programs in the bin_t domain. Is the some sort > of tracing that I can enable to see what policy is permitting execution > of a particular program ? > Now that I've gotten this working and understand the policy build process a little better, I realize that was a stupid question. I thought I'd post my solution just for posterity's sake. I had to move can_exec_any from base_user_macros.te into admin_macros.te, then comment out the can_execs from user_macros and then add the commands that I wanted. Todd > Thanks, > Todd > On Mon, 2005-07-25 at 10:39 -0400, Daniel J Walsh wrote: > > Todd Merritt wrote: > > > > >I'm getting started with selinux on FC 4. I'm using the strict policy, > > >but I'd like to restrict it further so that users can only execute a > > >handful of commands. I've tried replacing full_user_role(user_t) with > > >limit_user role, but the drew assertion errors when trying to load the > > >policy, and I tried removing restricting the can_exec in both full and > > >limited_user_role macros in macros/user_macros.te, but (at least from > > >looking at audit to allow) none of this seems to be getting me where I > > >want to be. What is the beast way to remove all access from user_t so > > >that I can add in the commands I want them to be able to run ? > > > > > > > > > > > First update to the latest rawhide strict policy. We have not been > > updating strict policy for FC4. > > Then you probably need to remove can_exec lines from base_user_macros. > > Problem is eliminating > > them might set you up with a solution where a user can not login. Are > > you doing this with a X Windows System, or > > a server? > > > > >Thanks, > > >Todd > > > > > > > > >-- > > >fedora-selinux-list mailing list > > >fedora-selinux-list@xxxxxxxxxx > > >http://www.redhat.com/mailman/listinfo/fedora-selinux-list > > > > > > > > > > > > -- > fedora-selinux-list mailing list > fedora-selinux-list@xxxxxxxxxx > http://www.redhat.com/mailman/listinfo/fedora-selinux-list -- fedora-selinux-list mailing list fedora-selinux-list@xxxxxxxxxx http://www.redhat.com/mailman/listinfo/fedora-selinux-list
