[redhat-lspp] Re: MLS enforcing PTYs, sshd, and newrole

[Stephen Smalley]

On Tue, 2006-10-24 at 16:37 -0400, James Antill wrote:
> On Mon, 2006-10-23 at 12:14 -0400, James Antill wrote:
> > On Thu, 2006-10-19 at 09:30 -0400, Stephen Smalley wrote:
> > > pam_selinux used to have support to let the user pick from the list of
> > > reachable contexts for the user.  So you could just restore that
> > > support.
> >
> >  So, in summary of the discussion, having pam_selinux let the user pick
> > the TE and Sensitivity separately (much as it does now if
> > get_ordered_context_list_with_level() fails) is the valid approach?
> 
>  Ok, I've done a patch to PAM which which adds a config_role option to
> the pam_selinux module ... which if turned on takes the users default
> context and allows them to change the role and/or level (if mls is
> enabled). Entering a blank line sticks with the default.
> 
>  It's available from:
> 
> http://people.redhat.com/jantill/pam-config_role/
> 
> ...the rpms there have been built on FC5.

Doesn't this provide a way of bypassing the per-Linux-user level
restrictions defined by the seusers mapping (vs. per-SELinux-user)?

-- 
Stephen Smalley
National Security Agency