Newbie Questions

Submit your RBAC policies or suggest policy improvements

Newbie Questions

Postby eRAZOR » Wed Dec 29, 2004 2:27 pm

I'm new to RBAC and I've got a couple questions.

1. Yesterday I did my first full learning mode run and generated the policy afterwards. Upon inspecting the result I spotted lots of cases where filename were used that seemed to be generated. I most of these cases I replaced the specific filename with a wildcard version.

Example before:

Code: Select all
role root uG
subject /  {
   /            
...
   /tmp/cyrus-daily-cronjob.XXXXuf6MjP   rwc
...
}


after:

Code: Select all
role root uG
subject /  {
   /            
...
   /tmp/cyrus-daily-cronjob.*   rwc
...
}


Any thoughts?


2. I've checked out the example config in gradm2 for information about the role based policy file format. As I understood it, a role is defined by "role <rolename> <role modes>" followed by a number of subject definitions and terminated by the next role definition or EOF. Is that correct?
eRAZOR
 
Posts: 8
Joined: Wed Dec 29, 2004 9:03 am

Postby spender » Wed Dec 29, 2004 3:02 pm

1) that change is fine. If you're using CVS you shouldn't have as many of those kinds of problems, and running the applications involved more times should virtually eliminate all such problems.

2) your understanding is correct regarding roles.
spender
 
Posts: 2185
Joined: Wed Feb 20, 2002 8:00 pm


Return to RBAC policy development

cron