strict policy

[Todd Merritt]

On Mon, 2005-07-25 at 10:39 -0400, Daniel J Walsh wrote:
> Todd Merritt wrote:
> 
> >I'm getting started with selinux on FC 4.  I'm using the strict policy,
> >but I'd like to restrict it further so that users can only execute a
> >handful of commands.  I've tried replacing full_user_role(user_t) with
> >limit_user role, but the drew assertion errors when trying to load the
> >policy, and I tried removing restricting the can_exec in both full and
> >limited_user_role macros in macros/user_macros.te, but (at least from
> >looking at audit to allow) none of this seems to be getting me where I
> >want to be.  What is the beast way to remove all access from user_t so
> >that I can add in the commands I want them to be able to run ?
> >
> >  
> >
> First update to the latest rawhide strict policy.  We have not been 
> updating strict policy for FC4. 
> Then you probably need to remove can_exec lines from base_user_macros.   
> Problem is eliminating
> them might set you up with a solution where a user can not login.  Are 
> you doing this with a X Windows System, or
> a server?
> 
server.  I have it set up as permissive right now, I'm planning on
running audit2allow to add access to the few commands that users should
be allowed to run.

Thanks,
Todd