Re: default_type limitations

2018-01-19 Thread Stephen Smalley
On Fri, 2018-01-19 at 11:19 +0100, Dominick Grift wrote: > The default_type functionality is too limited because it assumes that > all login programs associate the same type with a given role > > This is not the case > > For example: > > default_type for local_login: joe.role:joe.type >

Re: default_type limitations

2018-01-19 Thread Dominick Grift
On Fri, Jan 19, 2018 at 11:43:33AM +0100, Dominick Grift wrote: > On Fri, Jan 19, 2018 at 11:34:37AM +0100, Dominick Grift wrote: > > On Fri, Jan 19, 2018 at 11:19:51AM +0100, Dominick Grift wrote: > > > The default_type functionality is too limited because it assumes that all > > > login

Re: default_type limitations

2018-01-19 Thread Dominick Grift
On Fri, Jan 19, 2018 at 11:34:37AM +0100, Dominick Grift wrote: > On Fri, Jan 19, 2018 at 11:19:51AM +0100, Dominick Grift wrote: > > The default_type functionality is too limited because it assumes that all > > login programs associate the same type with a given role > > > > This is not the

Re: default_type limitations

2018-01-19 Thread Dominick Grift
On Fri, Jan 19, 2018 at 11:19:51AM +0100, Dominick Grift wrote: > The default_type functionality is too limited because it assumes that all > login programs associate the same type with a given role > > This is not the case > > For example: > > default_type for local_login: joe.role:joe.type >

default_type limitations

2018-01-19 Thread Dominick Grift
The default_type functionality is too limited because it assumes that all login programs associate the same type with a given role This is not the case For example: default_type for local_login: joe.role:joe.type default_type for sshd: joe.role:joe_ssh_server.type default_type for cockpit