On Mon, 17 Dec 2001 lonnie@outstep.com wrote:

> I am still trying to work out my issues with getting the network working as I
> am getting messages like "cannot send dump request" and "Error adding address
> 192.168.1.5 for eth0".

Check your kernel configuration for your network driver and your network options. Did you enable the Netlink support? This seems to be necessary on RH7.2.

> My question is really about setting up the user policies. I have a special
> project in which I need to confile the users to their HOME directories so that
> they can NEVER navigate out of them. I also need to allow them to run just a
> single application such as StarOffice, but still not let them navigate out of
> their HOME directories even through the application.

I raised concerns about the practical feasibility of this kind of policy in my previous response to you. However, if you really want to go down this road, you'll need to significantly pare down the example policy. You'll want to have a kernel with the Development Module option running in permissive mode so that you can easily experiment with policy changes without breaking your system.

You'll need to remove many of the file-related rules in policy/domains/every.te. This file contains rules that are applied to every domain and assumes a relatively open environment with regard to read/search access to standard filesystem locations. When you remove those rules, you'll find that many of the system domains will no longer have permissions that they need, so you will need to add back more specific rules to the individual files in policy/domains/system/*.te and policy/domains/program/*.te that grant these permissions to just the domains that need them. Then you can work on pruning the user_domain macro in policy/domains/user/user.te to something more minimal.

--
Stephen D. Smalley, NAI Labs
ssmalley@nai.com




--
You have received this message because you are subscribed to the selinux list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.