Hi...<br><div class="gmail_quote">
<br>
Now I am trying to configuring RBAC using MLS (Multilevel Security) Policy for fedora 8.&nbsp; <br>Because i have read danwalsh jornal he side MLS policy is more use full for RBAC.<br><font color="#c00000" face="Arial"><i><b><br>
<a href="http://danwalsh.livejournal.com/?skip=40">http://danwalsh.livejournal.com/?skip=40</a><br>Using RBAC In FC5/MLS Policy</b></i></font><br><br>&nbsp;So i am using MLS policy for RBAC. Here i have installed MLS packages and changed to targeted policy in to mls policy.<br>

Then i have configured the roles for users but i couldn&#39;t set the roles
because when i am setting the roles it will display the error message.<br>
<br>
Steps to reproduce: <br>
<br>
1) Adding the SELinux audit user using semanage command.<br>
<br>
# semanage user -a -R staff_r -R auditadm_r -P staff audit_u<br>
<br>
2) Here i am checking SELinux user.<br>
<br>
[root@turtle2 ~]# semanage user -l<br>
<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Labeling&nbsp;&nbsp; MLS/&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; MLS/&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <br>
SELinux User&nbsp;&nbsp;&nbsp; Prefix&nbsp;&nbsp;&nbsp;&nbsp; MCS Level&nbsp; MCS Range&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; SELinux Roles<br>
<br>
audit_u&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; staff&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; SystemLow&nbsp; SystemLow&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; staff_r auditadm_r<br>
root&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; sysadm&nbsp;&nbsp;&nbsp;&nbsp; SystemLow&nbsp; SystemLow:SystemLow-SystemHigh system_r sysadm_r staff_r secadm_r auditadm_r<br>
staff_u&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; staff&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; SystemLow&nbsp; SystemLow:SystemLow-SystemHigh sysadm_r staff_r secadm_r auditadm_r<br>
sysadm_u&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; sysadm&nbsp;&nbsp;&nbsp;&nbsp; SystemLow&nbsp; SystemLow:SystemLow-SystemHigh sysadm_r<br>
system_u&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; user&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; SystemLow&nbsp; SystemLow:SystemLow-SystemHigh system_r<br>
user_u&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; user&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; SystemLow&nbsp; SystemLow&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; system_r user_r<br>
[root@turtle2 ~]# <br>
<br>
3) Now i am setting the Linux user to SELinux users, when i am setting the
SELinux user it will throw the error message as follows. <br>
<br>
[root@turtle2 ~]# semanage login -a -s audit -r SystemLow-SystemHigh prakash <br>
libsemanage.validate_handler: selinux user audit does not exist No such file or directory.<br>
libsemanage.validate_handler: seuser mapping [prakash -&gt; (audit, s0-s15:c0.c1023)] is invalid No such file or directory.<br>
libsemanage.dbase_llist_iterate: could not iterate over records No such file or directory.<br>
/usr/sbin/semanage: Could not add login mapping for prakash<br>
[root@turtle2 ~]# <br>
<br>
4) I am using sysadm_r&nbsp; root information as follows<br>
<br>
[root@turtle2 ~]# id<br>
uid=0(root) gid=0(root)
groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel)
context=root:sysadm_r:sysadm_t:SystemLow:SystemLow-SystemHigh<br>
[root@turtle2 ~]# <br>
<br>
5) This is i am getting audit log messages using ausearch command.<br>
<br>
[root@turtle2 ~]# ausearch -i -m AVC -sv no<br>
type=SYSCALL msg=audit(06/02/2008 22:09:05.165:6877768) : arch=i386
syscall=read success=no exit=-13(Permission denied) a0=3 a1=9098808
a2=400 a3=400 items=0 ppid=1 pid=2060 auid=unset uid=root gid=root
euid=root suid=root fsuid=root egid=root sgid=root fsgid=root
tty=(none) comm=gam_server exe=/usr/libexec/gam_server
subj=system_u:system_r:rpm_t:s0-s15:c0.c1023 key=(null) <br>
type=AVC msg=audit(06/02/2008 22:09:05.165:6877768) : avc:&nbsp; denied&nbsp; {
read } for&nbsp; pid=2060 comm=gam_server path=inotify dev=inotifyfs ino=1
scontext=system_u:system_r:rpm_t:s0-s15:c0.c1023
tcontext=system_u:object_r:inotifyfs_t:s0 tclass=dir <br>
<br>
I don&#39;t know why its throwing this error. I have searched in to google but i couldn&#39;t find. <br><br>Please help me what should i do.<br>
<br>
Thanks,<br><font color="#888888">
Prakash<br>
 
</font></div><br>