5.1 role and user statements

To configure RBAC, there are 2 SPDL configuration elements, role and user.

• role name of role
  This means configurations is going to be done for specified role. Access right is given to corresponding domain. And the configuration filename must be role name.sp.
• user user name
  This allows user to use role. user_u user name is special, it is the default role of users that is not configured to use domain.How to allow to use sysadm_r, see section 5.3.

5.1.1 Example

Let's see example.

1:{
2:role webmaster_r;
3:user webmaster;
4:allow /var/www/** r,w,s;
}

Line 2 means, configurations between {} is for webmaster_r role.
Line 3 means, user name webmaster can use webmaster_r role.
Following, access rights are given to domain webmaster_t domain(Remember that webmaster_r role behaves as webmaster_t domain in SELinux system). Line 4 means, webmaster_t domain(This equals user that logined as webmaster_r role)is allowed to read, write under /var/www.

5.1.2 user_u user name

Let's see example of user_u user name.

Assume all configurations for RBAC are following.
* In sysadm_r.sp
{
role sysadm_r;
user root;
..
}	
* In webmaster_r.sp
{
role webmaster_r;
user webmaster
..
}
* In user_r.sp
{
role user_r;
user user_u;
..
}

In above, 3 roles are configured. You can see, user root and webmaster are assigned role. In this case user_u is all users except root and webmaster.