On Sun, Aug 28, 2022 at 8:18 AM bauen1 <j2468h@xxxxxxxxxxxxxx> wrote: > > Update parameter table and add note to example. > This can very easily lead to confusion, because secilc does not reject > e.g. (selinuxuser "admin_1" admin low_low). > > Signed-off-by: Jonathan Hettwer (bauen1) <j2468h@xxxxxxxxx> > --- > secilc/docs/cil_user_statements.md | 5 +++-- > 1 file changed, 3 insertions(+), 2 deletions(-) > > diff --git a/secilc/docs/cil_user_statements.md b/secilc/docs/cil_user_statements.md > index d5674f12..45a52140 100644 > --- a/secilc/docs/cil_user_statements.md > +++ b/secilc/docs/cil_user_statements.md > @@ -429,7 +429,7 @@ Associates a GNU/Linux user to a previously declared [`user`](cil_user_statement > </tr> > <tr class="odd"> > <td align="left"><p><code>user_id</code></p></td> > -<td align="left"><p>A previously declared SELinux <code>user</code> identifier.</p></td> > +<td align="left"><p>A <b>string</b> referencing a previously declared SELinux <code>user</code> identifier.</p></td> > </tr> > <tr class="even"> > <td align="left"><p><code>userrange_id</code></p></td> > @@ -445,7 +445,8 @@ This example will associate `unconfined.admin` user with a GNU / Linux user "`ad > ```secil > (block unconfined > (user admin) > - (selinuxuser admin_1 admin low_low) > + ; XXX: Because the user_id is a string, the fully qualified identifier needs to be used here: > + (selinuxuser "admin_1" "unconfined.admin" low_low) I don't see this behavior. The following: (block b2 (user user2_u) (userrole user2_u ROLE) (userlevel user2_u (SENS)) (userrange user2_u ((SENS) (SENS (CAT)))) (userprefix user2_u user2) (selinuxuser name2 user2_u ((SENS) (SENS (CAT)))) ) Gives me: name2:b2.user2_u:SENS-SENS:CAT It works with quotes as well, but it doesn't require them. The following: (block b3 (user user3_u) (userrole user3_u ROLE) (userlevel user3_u (SENS)) (userrange user3_u ((SENS) (SENS (CAT)))) (userprefix user3_u user3) (selinuxuser "name3" "user3_u" ((SENS) (SENS (CAT)))) ) Gives me: name3:b3.user3_u:SENS-SENS:CAT Thanks, Jim
