Re: Groups in the alternative user solution

[Stephen Smalley <sds@xxxxxxxxxxxxx>]

On Thu, 2005-06-30 at 09:27 -0400, Ivan Gyurdiev wrote:
> What about Casey's suggestion in this thread:
> 
> > 
> >     root:*:sysadm
> >     fred:wheel:wand
> >     *:wheel:staff
> >     *:*:normal
> > 
> > Fred would be in "wand" if only in group wheel,
> > in "normal" if in groups wheel and dev. Fun.
> 
> Not sure I understand... 
> So if Fred is in more groups other than wheel, 
> he maps to normal? What's the rationale for that?

I didn't understand the reasoning there either, particularly as we
aren't dealing with the effective GID but the entire authorized group
list for the user since we are only doing this once at login/su time.

> Controlling information disclosure? Does that * 
> take precedence to fred? What about conflicts? 
> This seems complicated..

I was originally thinking more along the lines of just selecting the
first matching entry (order-dependent), and group match just required
membership in the listed group, not an exact match (if you are going to
support group-based matching).

-- 
Stephen Smalley
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@xxxxxxxxxxxxx with
the words "unsubscribe selinux" without quotes as the message.