Roles in selinux

[William]

Hi,

On my Fedora 20 system, I list roles and I can see:

semanage user -l

                Labeling   MLS/       MLS/                          
SELinux User    Prefix     MCS Level  MCS Range
SELinux Roles

guest_u         user       s0         s0
guest_r
root            user       s0         s0-s0:c0.c1023
staff_r sysadm_r system_r unconfined_r
staff_u         user       s0         s0-s0:c0.c1023
staff_r sysadm_r system_r unconfined_r
sysadm_u        user       s0         s0-s0:c0.c1023
sysadm_r
system_u        user       s0         s0-s0:c0.c1023
system_r unconfined_r
unconfined_u    user       s0         s0-s0:c0.c1023
system_r unconfined_r
user_u          user       s0         s0
user_r
xguest_u        user       s0         s0
xguest_r


However http://www.selinuxproject.org/page/RefpolicyBasicRoleCreation
lists roles such as logadm_r etc. Is there a reason these are not in
f20?
-- 
William <william(a)firstyear.id.au&gt;

[Jean-David Beyer]

On 09/29/2014 02:32 AM, William wrote:
>  On my Fedora 20 system, I list roles and I can see: 
>  semanage user -l 
>                  Labeling   MLS/       MLS/                          
>  SELinux User    Prefix     MCS Level  MCS Range
>  SELinux Roles
>  
>  guest_u         user       s0         s0
>  guest_r
>  root            user       s0         s0-s0:c0.c1023
>  staff_r sysadm_r system_r unconfined_r
>  staff_u         user       s0         s0-s0:c0.c1023
>  staff_r sysadm_r system_r unconfined_r
>  sysadm_u        user       s0         s0-s0:c0.c1023
>  sysadm_r
>  system_u        user       s0         s0-s0:c0.c1023
>  system_r unconfined_r
>  unconfined_u    user       s0         s0-s0:c0.c1023
>  system_r unconfined_r
>  user_u          user       s0         s0
>  user_r
>  xguest_u        user       s0         s0
>  xguest_r 



On my Red Hat Enterprise Linux Server release 6.5 (Santiago) system, I get:
# semanage user -l

                Labeling   MLS/       MLS/
SELinux User    Prefix     MCS Level  MCS Range
SELinux Roles

git_shell_u     user       s0         s0
git_shell_r
guest_u         user       s0         s0                             guest_r
root            user       s0         s0-s0:c0.c1023
staff_r sysadm_r system_r unconfined_r
staff_u         user       s0         s0-s0:c0.c1023
staff_r sysadm_r system_r unconfined_r
sysadm_u        user       s0         s0-s0:c0.c1023
sysadm_r
system_u        user       s0         s0-s0:c0.c1023
system_r unconfined_r
unconfined_u    user       s0         s0-s0:c0.c1023
system_r unconfined_r
user_u          user       s0         s0                             user_r
xguest_u        user       s0         s0
xguest_r


-- 
  .~.  Jean-David Beyer          Registered Linux User 85642.
  /V\  PGP-Key:166D840A 0C610C8B Registered Machine  1935521.
 /( )\ Shrewsbury, New Jersey    http://linuxcounter.net
 ^^-^^ 06:15:01 up 8 days, 16:07, 3 users, load average: 5.54, 5.35, 5.26

[Miroslav Grepl]

On 09/29/2014 08:32 AM, William wrote:
>  Hi,
>
>  On my Fedora 20 system, I list roles and I can see:
>
>  semanage user -l
>
>                   Labeling   MLS/       MLS/
>  SELinux User    Prefix     MCS Level  MCS Range
>  SELinux Roles
>
>  guest_u         user       s0         s0
>  guest_r
>  root            user       s0         s0-s0:c0.c1023
>  staff_r sysadm_r system_r unconfined_r
>  staff_u         user       s0         s0-s0:c0.c1023
>  staff_r sysadm_r system_r unconfined_r
>  sysadm_u        user       s0         s0-s0:c0.c1023
>  sysadm_r
>  system_u        user       s0         s0-s0:c0.c1023
>  system_r unconfined_r
>  unconfined_u    user       s0         s0-s0:c0.c1023
>  system_r unconfined_r
>  user_u          user       s0         s0
>  user_r
>  xguest_u        user       s0         s0
>  xguest_r
>
>
>  However http://www.selinuxproject.org/page/RefpolicyBasicRoleCreation
>  lists roles such as logadm_r etc. Is there a reason these are not in
>  f20? 
This is what we define for the default SELinux users. You can list all 
roles using

$ seinfo -r

and you can assign them to a user using semanage-user.

[William]

On Mon, 2014-09-29 at 14:17 +0200, Miroslav Grepl wrote:
>  On 09/29/2014 08:32 AM, William wrote:
>  > Hi,
>  >
>  > On my Fedora 20 system, I list roles and I can see:
>  >
>  > semanage user -l
>  >
>  >                  Labeling   MLS/       MLS/
>  > SELinux User    Prefix     MCS Level  MCS Range
>  > SELinux Roles
>  >
>  > guest_u         user       s0         s0
>  > guest_r
>  > root            user       s0         s0-s0:c0.c1023
>  > staff_r sysadm_r system_r unconfined_r
>  > staff_u         user       s0         s0-s0:c0.c1023
>  > staff_r sysadm_r system_r unconfined_r
>  > sysadm_u        user       s0         s0-s0:c0.c1023
>  > sysadm_r
>  > system_u        user       s0         s0-s0:c0.c1023
>  > system_r unconfined_r
>  > unconfined_u    user       s0         s0-s0:c0.c1023
>  > system_r unconfined_r
>  > user_u          user       s0         s0
>  > user_r
>  > xguest_u        user       s0         s0
>  > xguest_r
>  >
>  >
>  > However http://www.selinuxproject.org/page/RefpolicyBasicRoleCreation
>  > lists roles such as logadm_r etc. Is there a reason these are not in
>  > f20?
>  This is what we define for the default SELinux users. You can list all 
>  roles using
>  
>  $ seinfo -r
>  
>  and you can assign them to a user using semanage-user. 
As promised:

Roles: 14
   auditadm_r
   dbadm_r
   guest_r
   staff_r
   user_r
   logadm_r
   object_r
   secadm_r
   sysadm_r
   system_r
   webadm_r
   xguest_r
   nx_server_r
   unconfined_r

I'll do my research from here. Thanks for the pointer.

Perhaps there should be a consistent semanage role  set of commands?