I'm having trouble adding a new role to selinux on FC4. I added the following lines to domains/user.te:
limited_user_role(ua_pw_user)
role_tty_type_change(user, ua_pw_user) role_tty_type_change(sysadm, ua_pw_user)
and to macros/user_macros.te added
role ua_pw_user_r types $1;
to in_user_role.
and to appconfig/default_type: ua_pw_user_r:ua_pw_user_t
and to users: user tmerritt roles { user_r ua_pw_user_r };
Now when I try to switch to that role I get:
[tmerritt@host ~]$ id -Z tmerritt:user_r:user_t [tmerritt@host ~]$ newrole -r ua_pw_user_r Authenticating tmerritt. Password: tmerritt:ua_pw_user_r:ua_pw_user_t is not a valid context
Am I missing something obvious ?
Thanks, Todd
On Wed, 10 Aug 2005 07:50:48 PDT, Todd Merritt said:
limited_user_role(ua_pw_user)
[tmerritt@host ~]$ newrole -r ua_pw_user_r Authenticating tmerritt. Password: tmerritt:ua_pw_user_r:ua_pw_user_t is not a valid context
Am I missing something obvious ?
Umm... reloading the policy? I've been bitten by *that* one a few times.....
[root@tubb policy]# make load make: Nothing to be done for `load'.
On Wed, 2005-08-10 at 11:02 -0400, Valdis.Kletnieks@vt.edu wrote:
On Wed, 10 Aug 2005 07:50:48 PDT, Todd Merritt said:
limited_user_role(ua_pw_user)
[tmerritt@host ~]$ newrole -r ua_pw_user_r Authenticating tmerritt. Password: tmerritt:ua_pw_user_r:ua_pw_user_t is not a valid context
Am I missing something obvious ?
Umm... reloading the policy? I've been bitten by *that* one a few times.....
On Wed, 2005-08-10 at 07:50 -0700, Todd Merritt wrote:
I'm having trouble adding a new role to selinux on FC4. I added the following lines to domains/user.te:
limited_user_role(ua_pw_user)
role_tty_type_change(user, ua_pw_user) role_tty_type_change(sysadm, ua_pw_user)
and to macros/user_macros.te added
role ua_pw_user_r types $1;
to in_user_role.
and to appconfig/default_type: ua_pw_user_r:ua_pw_user_t
and to users: user tmerritt roles { user_r ua_pw_user_r };
Now when I try to switch to that role I get:
[tmerritt@host ~]$ id -Z tmerritt:user_r:user_t [tmerritt@host ~]$ newrole -r ua_pw_user_r Authenticating tmerritt. Password: tmerritt:ua_pw_user_r:ua_pw_user_t is not a valid context
Am I missing something obvious ?
Doesn't look like limited_user_role() adds a: role $1_r types $1_t; statement to authorize the role for the type.
On Wed, 2005-08-10 at 11:57 -0400, Stephen Smalley wrote:
Doesn't look like limited_user_role() adds a: role $1_r types $1_t; statement to authorize the role for the type.
Looks like the corresponding statement for full_user_role() is pushed all the way down to user_domain(). Likely should be brought up to limited_user_role() and thereby included in both limited_user_role() and full_user_role() at that level.
On Wed, 2005-08-10 at 12:05 -0400, Stephen Smalley wrote:
On Wed, 2005-08-10 at 11:57 -0400, Stephen Smalley wrote:
Doesn't look like limited_user_role() adds a: role $1_r types $1_t; statement to authorize the role for the type.
Looks like the corresponding statement for full_user_role() is pushed all the way down to user_domain(). Likely should be brought up to limited_user_role() and thereby included in both limited_user_role() and full_user_role() at that level.
It's getting in there from somewhere:
[root@tubb policy]# grep allow policy.conf |grep ua_pw_user_r allow user_r ua_pw_user_r; allow sysadm_r ua_pw_user_r;
But, after switching it to full_user role
allow system_r ua_pw_user_r;
is added to the policy and everything works.
Thanks, Todd
On Wed, 2005-08-10 at 09:26 -0700, Todd Merritt wrote:
It's getting in there from somewhere:
[root@tubb policy]# grep allow policy.conf |grep ua_pw_user_r allow user_r ua_pw_user_r; allow sysadm_r ua_pw_user_r;
But, after switching it to full_user role
allow system_r ua_pw_user_r;
is added to the policy and everything works.
The issue isn't the allow rule - it is the missing role statement, i.e. role ua_pw_user_r types ua_pw_user_t;
On Wed, 2005-08-10 at 12:30 -0400, Stephen Smalley wrote:
On Wed, 2005-08-10 at 09:26 -0700, Todd Merritt wrote:
It's getting in there from somewhere:
[root@tubb policy]# grep allow policy.conf |grep ua_pw_user_r allow user_r ua_pw_user_r; allow sysadm_r ua_pw_user_r;
But, after switching it to full_user role
allow system_r ua_pw_user_r;
is added to the policy and everything works.
The issue isn't the allow rule - it is the missing role statement, i.e. role ua_pw_user_r types ua_pw_user_t;
I realized that after I fired off the message, sorry about that.
selinux@lists.fedoraproject.org