SELinux Cookbook

Creating a new role

Roles are part of SELinux policies. In order to create a new role, it isn't possible to just invoke a few semanage commands. Instead, an SELinux policy module will need to be created.

How to do it…

The SELinux policy needs to be updated in order to create a new role. The following steps can be used to do just that:

1. Create a new policy module named after the role to be created, such as pgsqladm (for a PostgreSQL administration role).
2. In the policy module, call the userdom_login_user_template interface:

   userdom_login_user_template(pgsqladm)

3. Assign the proper privileges to the pgsqladm_r role and pgsqladm_t type:

   postgresql_admin(pgsqladm_t, pgsqladm_r)

4. Edit the default_type file in /etc/selinux/mcs/contexts/ to make pgsqladm_t the default ...