-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Christopher J. PeBenito wrote: > On Thu, 2008-10-09 at 18:17 -0500, Joe Nall wrote: >> On Oct 9, 2008, at 3:24 PM, Joshua Brindle wrote: >> >>> Joe Nall wrote: >>>> Can someone explain the per role template implementation? I am >>>> confused. >>>> >>>> During policy compilation, a .mod.role file is created that just >>>> references the roles in /usr/share/selinux/devel/include/rolemap >>>> regardless of the roles defined via semanage. Should semanage add >>>> roles to rolemap? Is there additional magic in semodule? >>>> >>>> joe >>> Roles aren't created by semanage, only user->role mappings. The >>> per_role_template creates derived types for each role (eg., >>> staff_mozilla_t, sysadm_mozilla_t). These roles are defined in the >>> policy only. >> Ok. I thought the role statement just did type mapping and did not >> realize there was an implicit role declaration. >> >> I would still like an explanation of how this works and if/how new >> roles are handled with respect to per role templates. > > For each entry in the rolemap file, the infrastructure calls the > [modulename]_per_role_template() for each module, if it exists. > This does NOT happen in Fedora. I have patched this out and force explicit calls to per_role_templates. Calling them globably forces all confined users to transition to per_role_templates even when you don't want them to. I believe this is a mistake. > If (u|r)bacsep succeeds, this will be dropped in favor of explicit > calls. > -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org iEYEARECAAYFAkjvyKcACgkQrlYvE4MpobPzdgCffiTnFd8dU3PbVdYCklN0MCWK QrcAoOdfb/vgix0G2smLpgSkb0InJEiI =np8I -----END PGP SIGNATURE----- -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to majordomo@xxxxxxxxxxxxx with the words "unsubscribe selinux" without quotes as the message.
