Creating a new role

Roles are part of SELinux policies. In order to create a new role, it isn't possible to just invoke a few semanage commands. Instead, an SELinux policy module will need to be created.

How to do it…

The SELinux policy needs to be updated in order to create a new role. The following steps can be used to do just that:

1. Create a new policy module named after the role to be created, such as pgsqladm (for a PostgreSQL administration role).

2. In the policy module, call the userdom_login_user_template interface:

   userdom_login_user_template(pgsqladm)

3. Assign the proper privileges to the pgsqladm_r role and pgsqladm_t type:

   postgresql_admin(pgsqladm_t, pgsqladm_r)

4. Edit the default_type file in /etc/selinux/mcs/contexts/ to make pgsqladm_t the default type for the pgsqladm_r role:

   pgsqladm_r:pgsqladm_t

5. Edit the default_contexts file in /etc/selinux/mcs/contexts/ to inform the system to which types a transition has to be made when a user switch is triggered by an application. For instance, for...