wiki:experiences:igraltist:rc
=>  Releases

Current version
Git/Latestdiff: 1.5.6

Latest Snapshots
Produced after each commit or rebase to new upstream version

GIT
RSBAC source code, can be unstable sometimes

=>  Events

No events planned

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revision Previous revision
Next revision
Previous revision
wiki:experiences:igraltist:rc [2012/07/22 22:44]
127.0.0.1 (old revision restored)
wiki:experiences:igraltist:rc [2012/07/28 12:20]
127.0.0.1 (old revision restored)
Line 1: Line 1:
 [[wiki:​experiences/​igraltist#​rc|Back to igraltist'​s experiences /RSBAC RC]] [[wiki:​experiences/​igraltist#​rc|Back to igraltist'​s experiences /RSBAC RC]]
 +
  
  
Line 12: Line 13:
   *Auditor 3   *Auditor 3
 to run the system. to run the system.
 +
 +The permission for this roles are predefined. All this roles can be modify.
 +This page show only snippets or some ideas of using the RC module not a whole working setup for a server or desktop.
 +
 +For a daemon or any script there are always two roles specified.
 +  - an initial RC role
 +  - a force RC role.
 +
 +For example the Apache daemon(names can differ) ​ read configuration files as user with UID 0 (root user) and then switch to UID 33 (www-data).
 +This is a good example for using the RC module. We can use two RC roles. The first RC role for reading the configuration files etc. and the the second RC role for serving the content.
  
  
-The permission for this roles are hardcoded in RSBAC code itself. Otherwise the system wont work. 
-Bevor set any specific RC role for a service you can detach the default running ``Boot-Role``. 
-For this you can create a Role ``Init``. 
  
-On a binary are always two roles, an initial- and force-role.\\ 
-The initial-role is used to start a service, for this its need permission to read the necessary configurationfiles.\\ 
-The force-role is used to run this service, there is usally no reason for permission to read the configurationfiles as example. 
  
-However, if a service not chown to other user, the process is running alway with the initial-role. 
-This is surly the case for the init process. 
-So thatswhy this setup firstly. 
  
  
Line 43: Line 45:
  
  
-===== Init ===== 
 == RC role for init process == == RC role for init process ==
  
-The ``init`` never change to a force roleso therefor ​no reason to build such one.+The ``init`` never change to a RC force role so therefore ​no reason to build such one.
  
-Save this as shell script.+Example:
 <​code>​ <​code>​
 # init detached BOOT_ROLE 999999 ​ # init detached BOOT_ROLE 999999 ​
Line 54: Line 55:
 ROLE=100 ROLE=100
 FILE="/​sbin/​init"​ FILE="/​sbin/​init"​
-NAME="Init"+NAME="INIT_F" ​ # names convention, I use for all RC role upper letters and suffix _F (force role) and _I (initial role)
  
 # create role # create role
Line 96: Line 97:
  
  
-===== Toplevel Directories ======+ 
 +== SSH RC role == 
 + 
 +The sshd has some special behavior. 
 +The daemon only need a RC initial role and apply those to /​usr/​sbin/​sshd and as RC force apply the inherit from user role. 
 + 
  
  
//
wiki/experiences/igraltist/rc.txt · Last modified: 2012/07/28 12:20 by 127.0.0.1

wiki/experiences/igraltist/rc.txt · Last modified: 2012/07/28 12:20 by 127.0.0.1
This website is kindly hosted by m-privacy