Chris PeBenito wrote:
On Fri, 2009-06-19 at 15:51 -0400, Daniel J Walsh wrote:
On 06/19/2009 03:30 PM, Chris PeBenito wrote:
On Fri, 2009-06-19 at 14:29 -0400, Daniel J Walsh wrote:
Basically this is the exact same file as the seusers file except it one
per Linux User where is the seusers file is one record per Linux User.
If I have a distributed environment, I need to say stuff like
engineers logging into people.redhat.com get guest_t:s0
Admins logging in get unconfined_t:SystemLow-SystemHigh
In addition on some machines dwalsh is an admin and on others he is a
peon. So using IPA we generate a mapping from MACHINE to User
dwalsh on dwalsh_laptop gets unconfined_t
dwalsh on desktop gets user_t
dwalsh on people gets guest_t
There is a potential use for service but it will probably default to *
for now.
I don't have a problem with this idea, but I do have a problem with this
not replacing the current seuser behavior. Having two ways to map linux
users to selinux users is an administration nightmare. People will be
confused about which one to use and you'll need to know precedence.
What you describe above with the contents of each file just having a *
service would be the same as the current seuser behavior.
Well I don't see administrators editing the new format, we have not even
used it yet, since IPA has not shipped this functionality yet.
I don't see how IPA's usage matters. If we go this way, in the future
there will be two ways for the seusers mapping, which is confusing.
Ping, does anyone else have an opinion on this using the context of the service
rather than the pam name of the service? I still think the context is more
appropriate.
Also, if we do this I think we should get rid of the old way of having seusers
since it isn't clear where to do seuser updates anymore and it isn't even noted
which of these take precedence.
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@xxxxxxxxxxxxx with
the words "unsubscribe selinux" without quotes as the message.
