RBAC

RBAC, Role Based Access Control, 是SELinux的另一个重要的特性。但他并不是一种独立的控制方式，而是对TEAC的一种补充。其主要的作用是，构建SELinux提供的进程级的MAC机制与Linux的用户系统的映射关系。

RBAC工作原理

RBAC并不提供强制访问控制，而是通过user，role，type之间的对应关系，来控制type_transition策略能否成功。

role vs. type

role based最基本的就是定义role到type到对应关系。使用role语句可以实现：role role_name [types type_set];。例如：

role user_r types user_t;
role user_r types { staff_t, admin_t };

• role定义是累积的，即后面的对应关系不会覆盖前面语句定义的对应关系，而只会追加这种关系
• role语句通常定义在type声明附近，以确保该对应关系被及时定义

定义子role (period)
A period is used to indicate restrictions on the set of types that may be assigned to a role. For example, the set of types for a role called apache.cgi must be a subset of the type set of a role called apache.

role语句定义的基本逻辑就是，定义了role=>{ types }集合的映射关系。当发生type transition时，如果转换后的{role，type}组合未定义，则视为权限错误。从这个层面看，role对应的是主体type，即domain type，而非object type。

特殊的role: object_r

object_r是内核SELinux模块预定义的一个role，无需在policy中声明。而这个object_r被专门用来定义客体的安全上下文。

user vs. role

user是对role的再一次扩充，通过user将role与Linux user的映射关系建立起来。SELinux的用户系统独立于Linux用户系统。通过seusers文件或者semanage user命令可以定义他们之间的映射关系。但实际可定义的自由度并没有那么高。

The design decision for SELinux to have a distinct user identifier (rather than share that of Linux) is motivated by the desire to create an immutable SELinux user identifier.

定义一个user与role的映射关系，可以使用user语句：user user_name roles { role_set };
user语句所体现的逻辑和role语句类似，即定义了user=>{ roles }集合的映射关系。当应用启动时发生role transition时，如果转换后的{user, role}未定义，则视为权限错误。

当SELinux通过RBAC，建立起user=>role=>type的映射关系以后，还获得了一个好处。Linux系统的用户数可能很多，而用户的类型很少。用户并不是为了定义权限的，不同的用户之间的使用数据需要隔离。但往往一类用户的权限是相同的。例如超级用户，管理员用户，普通用户等等。系统的权限集最小粒度由domain定义。可能每个进程的权限不同，也可能一组进程的权限相同。但往往domain的数量也很庞大。如果没有RBAC，我们需要定义user到domain到映射。这样也不是不能做，但却不太优雅。每次新增用户时，需要为新增用户绑定一堆domain。定义了role之后，role相当于较稳定的一层抽象，role到types的映射关系是在定义type时候就定义了的。增加新user的时候，只要定义user到role的映射即可。这就是引入RBAC的原因。

PHN2ZyBpZD0iZGpkaWlmNXVnZ3UiIHdpZHRoPSIxMDAlIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHN0eWxlPSJtYXgtd2lkdGg6IDI2OS43NjU2MjVweDsiIHZpZXdCb3g9IjAgMCAyNjkuNzY1NjI1IDIyNC44NDM3NSI+PHN0eWxlPgoKCiNkamRpaWY1dWdndSAubGFiZWwgewogIGZvbnQtZmFtaWx5OiAndHJlYnVjaGV0IG1zJywgdmVyZGFuYSwgYXJpYWw7CiAgY29sb3I6ICMzMzM7IH0KCiNkamRpaWY1dWdndSAubm9kZSByZWN0LAojZGpkaWlmNXVnZ3UgLm5vZGUgY2lyY2xlLAojZGpkaWlmNXVnZ3UgLm5vZGUgZWxsaXBzZSwKI2RqZGlpZjV1Z2d1IC5ub2RlIHBvbHlnb24gewogIGZpbGw6ICNFQ0VDRkY7CiAgc3Ryb2tlOiAjOTM3MERCOwogIHN0cm9rZS13aWR0aDogMXB4OyB9CgojZGpkaWlmNXVnZ3UgLm5vZGUuY2xpY2thYmxlIHsKICBjdXJzb3I6IHBvaW50ZXI7IH0KCiNkamRpaWY1dWdndSAuYXJyb3doZWFkUGF0aCB7CiAgZmlsbDogIzMzMzMzMzsgfQoKI2RqZGlpZjV1Z2d1IC5lZGdlUGF0aCAucGF0aCB7CiAgc3Ryb2tlOiAjMzMzMzMzOwogIHN0cm9rZS13aWR0aDogMS41cHg7IH0KCiNkamRpaWY1dWdndSAuZWRnZUxhYmVsIHsKICBiYWNrZ3JvdW5kLWNvbG9yOiAjZThlOGU4OyB9CgojZGpkaWlmNXVnZ3UgLmNsdXN0ZXIgcmVjdCB7CiAgZmlsbDogI2ZmZmZkZSAhaW1wb3J0YW50OwogIHN0cm9rZTogI2FhYWEzMyAhaW1wb3J0YW50OwogIHN0cm9rZS13aWR0aDogMXB4ICFpbXBvcnRhbnQ7IH0KCiNkamRpaWY1dWdndSAuY2x1c3RlciB0ZXh0IHsKICBmaWxsOiAjMzMzOyB9CgojZGpkaWlmNXVnZ3UgZGl2Lm1lcm1haWRUb29sdGlwIHsKICBwb3NpdGlvbjogYWJzb2x1dGU7CiAgdGV4dC1hbGlnbjogY2VudGVyOwogIG1heC13aWR0aDogMjAwcHg7CiAgcGFkZGluZzogMnB4OwogIGZvbnQtZmFtaWx5OiAndHJlYnVjaGV0IG1zJywgdmVyZGFuYSwgYXJpYWw7CiAgZm9udC1zaXplOiAxMnB4OwogIGJhY2tncm91bmQ6ICNmZmZmZGU7CiAgYm9yZGVyOiAxcHggc29saWQgI2FhYWEzMzsKICBib3JkZXItcmFkaXVzOiAycHg7CiAgcG9pbnRlci1ldmVudHM6IG5vbmU7CiAgei1pbmRleDogMTAwOyB9CgojZGpkaWlmNXVnZ3UgLmFjdG9yIHsKICBzdHJva2U6ICNDQ0NDRkY7CiAgZmlsbDogI0VDRUNGRjsgfQoKI2RqZGlpZjV1Z2d1IHRleHQuYWN0b3IgewogIGZpbGw6IGJsYWNrOwogIHN0cm9rZTogbm9uZTsgfQoKI2RqZGlpZjV1Z2d1IC5hY3Rvci1saW5lIHsKICBzdHJva2U6IGdyZXk7IH0KCiNkamRpaWY1dWdndSAubWVzc2FnZUxpbmUwIHsKICBzdHJva2Utd2lkdGg6IDEuNTsKICBzdHJva2UtZGFzaGFycmF5OiAnMiAyJzsKICBzdHJva2U6ICMzMzM7IH0KCiNkamRpaWY1dWdndSAubWVzc2FnZUxpbmUxIHsKICBzdHJva2Utd2lkdGg6IDEuNTsKICBzdHJva2UtZGFzaGFycmF5OiAnMiAyJzsKICBzdHJva2U6ICMzMzM7IH0KCiNkamRpaWY1dWdndSAjYXJyb3doZWFkIHsKICBmaWxsOiAjMzMzOyB9CgojZGpkaWlmNXVnZ3UgI2Nyb3NzaGVhZCBwYXRoIHsKICBmaWxsOiAjMzMzICFpbXBvcnRhbnQ7CiAgc3Ryb2tlOiAjMzMzICFpbXBvcnRhbnQ7IH0KCiNkamRpaWY1dWdndSAubWVzc2FnZVRleHQgewogIGZpbGw6ICMzMzM7CiAgc3Ryb2tlOiBub25lOyB9CgojZGpkaWlmNXVnZ3UgLmxhYmVsQm94IHsKICBzdHJva2U6ICNDQ0NDRkY7CiAgZmlsbDogI0VDRUNGRjsgfQoKI2RqZGlpZjV1Z2d1IC5sYWJlbFRleHQgewogIGZpbGw6IGJsYWNrOwogIHN0cm9rZTogbm9uZTsgfQoKI2RqZGlpZjV1Z2d1IC5sb29wVGV4dCB7CiAgZmlsbDogYmxhY2s7CiAgc3Ryb2tlOiBub25lOyB9CgojZGpkaWlmNXVnZ3UgLmxvb3BMaW5lIHsKICBzdHJva2Utd2lkdGg6IDI7CiAgc3Ryb2tlLWRhc2hhcnJheTogJzIgMic7CiAgc3Ryb2tlOiAjQ0NDQ0ZGOyB9CgojZGpkaWlmNXVnZ3UgLm5vdGUgewogIHN0cm9rZTogI2FhYWEzMzsKICBmaWxsOiAjZmZmNWFkOyB9CgojZGpkaWlmNXVnZ3UgLm5vdGVUZXh0IHsKICBmaWxsOiBibGFjazsKICBzdHJva2U6IG5vbmU7CiAgZm9udC1mYW1pbHk6ICd0cmVidWNoZXQgbXMnLCB2ZXJkYW5hLCBhcmlhbDsKICBmb250LXNpemU6IDE0cHg7IH0KCiNkamRpaWY1dWdndSAuYWN0aXZhdGlvbjAgewogIGZpbGw6ICNmNGY0ZjQ7CiAgc3Ryb2tlOiAjNjY2OyB9CgojZGpkaWlmNXVnZ3UgLmFjdGl2YXRpb24xIHsKICBmaWxsOiAjZjRmNGY0OwogIHN0cm9rZTogIzY2NjsgfQoKI2RqZGlpZjV1Z2d1IC5hY3RpdmF0aW9uMiB7CiAgZmlsbDogI2Y0ZjRmNDsKICBzdHJva2U6ICM2NjY7IH0KCgojZGpkaWlmNXVnZ3UgLnNlY3Rpb24gewogIHN0cm9rZTogbm9uZTsKICBvcGFjaXR5OiAwLjI7IH0KCiNkamRpaWY1dWdndSAuc2VjdGlvbjAgewogIGZpbGw6IHJnYmEoMTAyLCAxMDIsIDI1NSwgMC40OSk7IH0KCiNkamRpaWY1dWdndSAuc2VjdGlvbjIgewogIGZpbGw6ICNmZmY0MDA7IH0KCiNkamRpaWY1dWdndSAuc2VjdGlvbjEsCiNkamRpaWY1dWdndSAuc2VjdGlvbjMgewogIGZpbGw6IHdoaXRlOwogIG9wYWNpdHk6IDAuMjsgfQoKI2RqZGlpZjV1Z2d1IC5zZWN0aW9uVGl0bGUwIHsKICBmaWxsOiAjMzMzOyB9CgojZGpkaWlmNXVnZ3UgLnNlY3Rpb25UaXRsZTEgewogIGZpbGw6ICMzMzM7IH0KCiNkamRpaWY1dWdndSAuc2VjdGlvblRpdGxlMiB7CiAgZmlsbDogIzMzMzsgfQoKI2RqZGlpZjV1Z2d1IC5zZWN0aW9uVGl0bGUzIHsKICBmaWxsOiAjMzMzOyB9CgojZGpkaWlmNXVnZ3UgLnNlY3Rpb25UaXRsZSB7CiAgdGV4dC1hbmNob3I6IHN0YXJ0OwogIGZvbnQtc2l6ZTogMTFweDsKICB0ZXh0LWhlaWdodDogMTRweDsgfQoKCiNkamRpaWY1dWdndSAuZ3JpZCAudGljayB7CiAgc3Ryb2tlOiBsaWdodGdyZXk7CiAgb3BhY2l0eTogMC4zOwogIHNoYXBlLXJlbmRlcmluZzogY3Jpc3BFZGdlczsgfQoKI2RqZGlpZjV1Z2d1IC5ncmlkIHBhdGggewogIHN0cm9rZS13aWR0aDogMDsgfQoKCiNkamRpaWY1dWdndSAudG9kYXkgewogIGZpbGw6IG5vbmU7CiAgc3Ryb2tlOiByZWQ7CiAgc3Ryb2tlLXdpZHRoOiAycHg7IH0KCgoKI2RqZGlpZjV1Z2d1IC50YXNrIHsKICBzdHJva2Utd2lkdGg6IDI7IH0KCiNkamRpaWY1dWdndSAudGFza1RleHQgewogIHRleHQtYW5jaG9yOiBtaWRkbGU7CiAgZm9udC1zaXplOiAxMXB4OyB9CgojZGpkaWlmNXVnZ3UgLnRhc2tUZXh0T3V0c2lkZVJpZ2h0IHsKICBmaWxsOiBibGFjazsKICB0ZXh0LWFuY2hvcjogc3RhcnQ7CiAgZm9udC1zaXplOiAxMXB4OyB9CgojZGpkaWlmNXVnZ3UgLnRhc2tUZXh0T3V0c2lkZUxlZnQgewogIGZpbGw6IGJsYWNrOwogIHRleHQtYW5jaG9yOiBlbmQ7CiAgZm9udC1zaXplOiAxMXB4OyB9CgoKI2RqZGlpZjV1Z2d1IC50YXNrVGV4dDAsCiNkamRpaWY1dWdndSAudGFza1RleHQxLAojZGpkaWlmNXVnZ3UgLnRhc2tUZXh0MiwKI2RqZGlpZjV1Z2d1IC50YXNrVGV4dDMgewogIGZpbGw6IHdoaXRlOyB9CgojZGpkaWlmNXVnZ3UgLnRhc2swLAojZGpkaWlmNXVnZ3UgLnRhc2sxLAojZGpkaWlmNXVnZ3UgLnRhc2syLAojZGpkaWlmNXVnZ3UgLnRhc2szIHsKICBmaWxsOiAjOGE5MGRkOwogIHN0cm9rZTogIzUzNGZiYzsgfQoKI2RqZGlpZjV1Z2d1IC50YXNrVGV4dE91dHNpZGUwLAojZGpkaWlmNXVnZ3UgLnRhc2tUZXh0T3V0c2lkZTIgewogIGZpbGw6IGJsYWNrOyB9CgojZGpkaWlmNXVnZ3UgLnRhc2tUZXh0T3V0c2lkZTEsCiNkamRpaWY1dWdndSAudGFza1RleHRPdXRzaWRlMyB7CiAgZmlsbDogYmxhY2s7IH0KCgojZGpkaWlmNXVnZ3UgLmFjdGl2ZTAsCiNkamRpaWY1dWdndSAuYWN0aXZlMSwKI2RqZGlpZjV1Z2d1IC5hY3RpdmUyLAojZGpkaWlmNXVnZ3UgLmFjdGl2ZTMgewogIGZpbGw6ICNiZmM3ZmY7CiAgc3Ryb2tlOiAjNTM0ZmJjOyB9CgojZGpkaWlmNXVnZ3UgLmFjdGl2ZVRleHQwLAojZGpkaWlmNXVnZ3UgLmFjdGl2ZVRleHQxLAojZGpkaWlmNXVnZ3UgLmFjdGl2ZVRleHQyLAojZGpkaWlmNXVnZ3UgLmFjdGl2ZVRleHQzIHsKICBmaWxsOiBibGFjayAhaW1wb3J0YW50OyB9CgoKI2RqZGlpZjV1Z2d1IC5kb25lMCwKI2RqZGlpZjV1Z2d1IC5kb25lMSwKI2RqZGlpZjV1Z2d1IC5kb25lMiwKI2RqZGlpZjV1Z2d1IC5kb25lMyB7CiAgc3Ryb2tlOiBncmV5OwogIGZpbGw6IGxpZ2h0Z3JleTsKICBzdHJva2Utd2lkdGg6IDI7IH0KCiNkamRpaWY1dWdndSAuZG9uZVRleHQwLAojZGpkaWlmNXVnZ3UgLmRvbmVUZXh0MSwKI2RqZGlpZjV1Z2d1IC5kb25lVGV4dDIsCiNkamRpaWY1dWdndSAuZG9uZVRleHQzIHsKICBmaWxsOiBibGFjayAhaW1wb3J0YW50OyB9CgoKI2RqZGlpZjV1Z2d1IC5jcml0MCwKI2RqZGlpZjV1Z2d1IC5jcml0MSwKI2RqZGlpZjV1Z2d1IC5jcml0MiwKI2RqZGlpZjV1Z2d1IC5jcml0MyB7CiAgc3Ryb2tlOiAjZmY4ODg4OwogIGZpbGw6IHJlZDsKICBzdHJva2Utd2lkdGg6IDI7IH0KCiNkamRpaWY1dWdndSAuYWN0aXZlQ3JpdDAsCiNkamRpaWY1dWdndSAuYWN0aXZlQ3JpdDEsCiNkamRpaWY1dWdndSAuYWN0aXZlQ3JpdDIsCiNkamRpaWY1dWdndSAuYWN0aXZlQ3JpdDMgewogIHN0cm9rZTogI2ZmODg4ODsKICBmaWxsOiAjYmZjN2ZmOwogIHN0cm9rZS13aWR0aDogMjsgfQoKI2RqZGlpZjV1Z2d1IC5kb25lQ3JpdDAsCiNkamRpaWY1dWdndSAuZG9uZUNyaXQxLAojZGpkaWlmNXVnZ3UgLmRvbmVDcml0MiwKI2RqZGlpZjV1Z2d1IC5kb25lQ3JpdDMgewogIHN0cm9rZTogI2ZmODg4ODsKICBmaWxsOiBsaWdodGdyZXk7CiAgc3Ryb2tlLXdpZHRoOiAyOwogIGN1cnNvcjogcG9pbnRlcjsKICBzaGFwZS1yZW5kZXJpbmc6IGNyaXNwRWRnZXM7IH0KCiNkamRpaWY1dWdndSAuZG9uZUNyaXRUZXh0MCwKI2RqZGlpZjV1Z2d1IC5kb25lQ3JpdFRleHQxLAojZGpkaWlmNXVnZ3UgLmRvbmVDcml0VGV4dDIsCiNkamRpaWY1dWdndSAuZG9uZUNyaXRUZXh0MyB7CiAgZmlsbDogYmxhY2sgIWltcG9ydGFudDsgfQoKI2RqZGlpZjV1Z2d1IC5hY3RpdmVDcml0VGV4dDAsCiNkamRpaWY1dWdndSAuYWN0aXZlQ3JpdFRleHQxLAojZGpkaWlmNXVnZ3UgLmFjdGl2ZUNyaXRUZXh0MiwKI2RqZGlpZjV1Z2d1IC5hY3RpdmVDcml0VGV4dDMgewogIGZpbGw6IGJsYWNrICFpbXBvcnRhbnQ7IH0KCiNkamRpaWY1dWdndSAudGl0bGVUZXh0IHsKICB0ZXh0LWFuY2hvcjogbWlkZGxlOwogIGZvbnQtc2l6ZTogMThweDsKICBmaWxsOiBibGFjazsgfQoKI2RqZGlpZjV1Z2d1IGcuY2xhc3NHcm91cCB0ZXh0IHsKICBmaWxsOiAjOTM3MERCOwogIHN0cm9rZTogbm9uZTsKICBmb250LWZhbWlseTogJ3RyZWJ1Y2hldCBtcycsIHZlcmRhbmEsIGFyaWFsOwogIGZvbnQtc2l6ZTogMTBweDsgfQoKI2RqZGlpZjV1Z2d1IGcuY2xhc3NHcm91cCByZWN0IHsKICBmaWxsOiAjRUNFQ0ZGOwogIHN0cm9rZTogIzkzNzBEQjsgfQoKI2RqZGlpZjV1Z2d1IGcuY2xhc3NHcm91cCBsaW5lIHsKICBzdHJva2U6ICM5MzcwREI7CiAgc3Ryb2tlLXdpZHRoOiAxOyB9CgojZGpkaWlmNXVnZ3UgLmNsYXNzTGFiZWwgLmJveCB7CiAgc3Ryb2tlOiBub25lOwogIHN0cm9rZS13aWR0aDogMDsKICBmaWxsOiAjRUNFQ0ZGOwogIG9wYWNpdHk6IDAuNTsgfQoKI2RqZGlpZjV1Z2d1IC5jbGFzc0xhYmVsIC5sYWJlbCB7CiAgZmlsbDogIzkzNzBEQjsKICBmb250LXNpemU6IDEwcHg7IH0KCiNkamRpaWY1dWdndSAucmVsYXRpb24gewogIHN0cm9rZTogIzkzNzBEQjsKICBzdHJva2Utd2lkdGg6IDE7CiAgZmlsbDogbm9uZTsgfQoKI2RqZGlpZjV1Z2d1ICNjb21wb3NpdGlvblN0YXJ0IHsKICBmaWxsOiAjOTM3MERCOwogIHN0cm9rZTogIzkzNzBEQjsKICBzdHJva2Utd2lkdGg6IDE7IH0KCiNkamRpaWY1dWdndSAjY29tcG9zaXRpb25FbmQgewogIGZpbGw6ICM5MzcwREI7CiAgc3Ryb2tlOiAjOTM3MERCOwogIHN0cm9rZS13aWR0aDogMTsgfQoKI2RqZGlpZjV1Z2d1ICNhZ2dyZWdhdGlvblN0YXJ0IHsKICBmaWxsOiAjRUNFQ0ZGOwogIHN0cm9rZTogIzkzNzBEQjsKICBzdHJva2Utd2lkdGg6IDE7IH0KCiNkamRpaWY1dWdndSAjYWdncmVnYXRpb25FbmQgewogIGZpbGw6ICNFQ0VDRkY7CiAgc3Ryb2tlOiAjOTM3MERCOwogIHN0cm9rZS13aWR0aDogMTsgfQoKI2RqZGlpZjV1Z2d1ICNkZXBlbmRlbmN5U3RhcnQgewogIGZpbGw6ICM5MzcwREI7CiAgc3Ryb2tlOiAjOTM3MERCOwogIHN0cm9rZS13aWR0aDogMTsgfQoKI2RqZGlpZjV1Z2d1ICNkZXBlbmRlbmN5RW5kIHsKICBmaWxsOiAjOTM3MERCOwogIHN0cm9rZTogIzkzNzBEQjsKICBzdHJva2Utd2lkdGg6IDE7IH0KCiNkamRpaWY1dWdndSAjZXh0ZW5zaW9uU3RhcnQgewogIGZpbGw6ICM5MzcwREI7CiAgc3Ryb2tlOiAjOTM3MERCOwogIHN0cm9rZS13aWR0aDogMTsgfQoKI2RqZGlpZjV1Z2d1ICNleHRlbnNpb25FbmQgewogIGZpbGw6ICM5MzcwREI7CiAgc3Ryb2tlOiAjOTM3MERCOwogIHN0cm9rZS13aWR0aDogMTsgfQoKI2RqZGlpZjV1Z2d1IC5jb21taXQtaWQsCiNkamRpaWY1dWdndSAuY29tbWl0LW1zZywKI2RqZGlpZjV1Z2d1IC5icmFuY2gtbGFiZWwgewogIGZpbGw6IGxpZ2h0Z3JleTsKICBjb2xvcjogbGlnaHRncmV5OyB9CgoKCiNkamRpaWY1dWdndSAubGFiZWx7CiAgY29sb3I6IzE4QjE0RTsKfQojZGpkaWlmNXVnZ3UgLnRlLW1kLWNvbnRhaW5lci0tZGFyayAubm9kZSByZWN0IHsKICBmaWxsOiByZWQ7Cn0KCiNkamRpaWY1dWdndSAubm9kZSByZWN0LAojZGpkaWlmNXVnZ3UgLm5vZGUgY2lyY2xlLAojZGpkaWlmNXVnZ3UgLm5vZGUgZWxsaXBzZSwKI2RqZGlpZjV1Z2d1IC5ub2RlIHBvbHlnb24gewogIGZpbGw6ICNGOUZGRkI7OwogIHN0cm9rZTogIzJEQkQ2MDsKICBzdHJva2Utd2lkdGg6IDEuNXB4Owp9CiNkamRpaWY1dWdndSAuYXJyb3doZWFkUGF0aHsKICBmaWxsOiAjMkRCRDYwOwp9CiNkamRpaWY1dWdndSAuZWRnZVBhdGggLnBhdGggewogIHN0cm9rZTogIzJEQkQ2MDsKICBzdHJva2Utd2lkdGg6IDFweDsKfQojZGpkaWlmNXVnZ3UgLmVkZ2VMYWJlbCB7CiAgYmFja2dyb3VuZC1jb2xvcjogI2ZmZjsKfQojZGpkaWlmNXVnZ3UgLmNsdXN0ZXIgcmVjdCB7CiAgZmlsbDogI0Y5RkZGQiAhaW1wb3J0YW50OwogIHN0cm9rZTogIzJEQkQ2MCAhaW1wb3J0YW50OwogIHN0cm9rZS13aWR0aDogMXB4ICFpbXBvcnRhbnQ7Cn0KCiNkamRpaWY1dWdndSAuY2x1c3RlciB0ZXh0IHsKICBmaWxsOiAjRjlGRkZCOwp9CgojZGpkaWlmNXVnZ3UgZGl2Lm1lcm1haWRUb29sdGlwIHsKICBiYWNrZ3JvdW5kOiAjRjlGRkZCOwogIGJvcmRlcjogMXB4IHNvbGlkICMyREJENjA7Cn0KCgojZGpkaWlmNXVnZ3UgLmFjdG9yIHsKICBzdHJva2U6ICMyREJENjA7CiAgZmlsbDogI0Y5RkZGQjsKfQoKI2RqZGlpZjV1Z2d1IHRleHQuYWN0b3IgewogIGZpbGw6ICMyREJENjA7CiAgc3Ryb2tlOiBub25lOwp9CgojZGpkaWlmNXVnZ3UgLmFjdG9yLWxpbmUgewogIHN0cm9rZTogIzJEQkQ2MDsKfQoKI2RqZGlpZjV1Z2d1IC5tZXNzYWdlTGluZTAgewogIHN0cm9rZS13aWR0aDogMS41OwogIHN0cm9rZS1kYXNoYXJyYXk6ICcyIDInOwogIG1hcmtlci1lbmQ6ICd1cmwoI2Fycm93aGVhZCknOwogIHN0cm9rZTogIzJEQkQ2MDsKfQoKI2RqZGlpZjV1Z2d1IC5tZXNzYWdlTGluZTEgewogIHN0cm9rZS13aWR0aDogMS41OwogIHN0cm9rZS1kYXNoYXJyYXk6ICcyIDInOwogIHN0cm9rZTogIzJEQkQ2MDsKfQoKI2RqZGlpZjV1Z2d1ICNhcnJvd2hlYWQgewogIGZpbGw6ICMyREJENjA7Cn0KCiNkamRpaWY1dWdndSAjY3Jvc3NoZWFkIHBhdGggewogIGZpbGw6ICMyREJENjAgIWltcG9ydGFudDsKICBzdHJva2U6ICMyREJENjAgIWltcG9ydGFudDsKfQoKI2RqZGlpZjV1Z2d1IC5tZXNzYWdlVGV4dCB7CiAgZmlsbDogIzJEQkQ2MDsKICBzdHJva2U6IG5vbmU7Cn0KCiNkamRpaWY1dWdndSAubGFiZWxCb3ggewogIHN0cm9rZTogIzJEQkQ2MDsKICBmaWxsOiAjRjlGRkZCOwp9CgojZGpkaWlmNXVnZ3UgLmxhYmVsVGV4dCB7CiAgZmlsbDogIzJEQkQ2MDsKICBzdHJva2U6ICMyREJENjA7Cn0KCiNkamRpaWY1dWdndSAubG9vcFRleHQgewogIGZpbGw6ICMyREJENjA7CiAgc3Ryb2tlOiAjMkRCRDYwOwp9CgojZGpkaWlmNXVnZ3UgLmxvb3BMaW5lIHsKICBzdHJva2Utd2lkdGg6IDI7CiAgc3Ryb2tlLWRhc2hhcnJheTogJzIgMic7CiAgbWFya2VyLWVuZDogJ3VybCgjYXJyb3doZWFkKSc7CiAgc3Ryb2tlOiAjMkRCRDYwOwp9CgojZGpkaWlmNXVnZ3UgLm5vdGUgewogIHN0cm9rZTogIzJEQkQ2MDsKICBmaWxsOiAjRjlGRkZCOwp9CgojZGpkaWlmNXVnZ3UgLm5vdGVUZXh0IHsKICBmaWxsOiAjMkRCRDYwOwogIHN0cm9rZTogIzJEQkQ2MDsKfQoKCiNkamRpaWY1dWdndSAuc2VjdGlvbnsKICBvcGFjaXR5OjE7Cn0KI2RqZGlpZjV1Z2d1IC5zZWN0aW9uMCwjZGpkaWlmNXVnZ3UgIC5zZWN0aW9uMiB7CiAgZmlsbDogI0VDRjdGMDsKfQoKI2RqZGlpZjV1Z2d1IC5zZWN0aW9uMSwKI2RqZGlpZjV1Z2d1IC5zZWN0aW9uMyB7CiAgZmlsbDogI0ZGRjsKfQojZGpkaWlmNXVnZ3UgLnRhc2tUZXh0MCwKI2RqZGlpZjV1Z2d1IC50YXNrVGV4dDEsCiNkamRpaWY1dWdndSAudGFza1RleHQyLAojZGpkaWlmNXVnZ3UgLnRhc2tUZXh0MyB7CiAgZmlsbDogI2ZmZjsKfQoKI2RqZGlpZjV1Z2d1IC50YXNrMCwKI2RqZGlpZjV1Z2d1IC50YXNrMSwKI2RqZGlpZjV1Z2d1IC50YXNrMiwKI2RqZGlpZjV1Z2d1IC50YXNrMyB7CiAgZmlsbDogIzJEQkQ2MDsKICBzdHJva2U6ICMzNTlGNUE7Cn0KPC9zdHlsZT48c3R5bGU+I2RqZGlpZjV1Z2d1IHsKICAgIGNvbG9yOiByZ2IoMjQ0LCAyNDQsIDI0NCk7CiAgICBmb250OiBub3JtYWwgbm9ybWFsIG5vcm1hbCBub3JtYWwgMTRweC8yMi4zOTk5OTk2MTg1MzAyNzNweCBtb25vc3BhY2U7CiAgfTwvc3R5bGU+PGcgdHJhbnNmb3JtPSJ0cmFuc2xhdGUoLTEyLCAtMTIpIj48ZyBjbGFzcz0ib3V0cHV0Ij48ZyBjbGFzcz0iY2x1c3RlcnMiPjwvZz48ZyBjbGFzcz0iZWRnZVBhdGhzIj48ZyBjbGFzcz0iZWRnZVBhdGgiIHN0eWxlPSJvcGFjaXR5OiAxOyI+PHBhdGggY2xhc3M9InBhdGgiIGQ9Ik01Mi43ODk0MzMxNzYzODUzNjYsMTA2LjI4MTI1TDkwLjUsMzguMTQwNjI1TDExNS41LDM4LjE0MDYyNSIgbWFya2VyLWVuZD0idXJsKCNhcnJvd2hlYWQzMzEpIiBzdHlsZT0ic3Ryb2tlOiAjMzMzOyBzdHJva2Utd2lkdGg6IDEuNXB4O2ZpbGw6bm9uZSI+PC9wYXRoPjxkZWZzPjxtYXJrZXIgaWQ9ImFycm93aGVhZDMzMSIgdmlld0JveD0iMCAwIDEwIDEwIiByZWZYPSI5IiByZWZZPSI1IiBtYXJrZXJVbml0cz0ic3Ryb2tlV2lkdGgiIG1hcmtlcldpZHRoPSI4IiBtYXJrZXJIZWlnaHQ9IjYiIG9yaWVudD0iYXV0byI+PHBhdGggZD0iTSAwIDAgTCAxMCA1IEwgMCAxMCB6IiBjbGFzcz0iYXJyb3doZWFkUGF0aCIgc3R5bGU9InN0cm9rZS13aWR0aDogMXB4OyBzdHJva2UtZGFzaGFycmF5OiAxcHgsIDBweDsiPjwvcGF0aD48L21hcmtlcj48L2RlZnM+PC9nPjxnIGNsYXNzPSJlZGdlUGF0aCIgc3R5bGU9Im9wYWNpdHk6IDE7Ij48cGF0aCBjbGFzcz0icGF0aCIgZD0iTTY1LjUsMTI0LjQyMTg3NUw5MC41LDEyNC40MjE4NzVMMTE1LjUsMTI0LjQyMTg3NSIgbWFya2VyLWVuZD0idXJsKCNhcnJvd2hlYWQzMzIpIiBzdHlsZT0ic3Ryb2tlOiAjMzMzOyBzdHJva2Utd2lkdGg6IDEuNXB4O2ZpbGw6bm9uZSI+PC9wYXRoPjxkZWZzPjxtYXJrZXIgaWQ9ImFycm93aGVhZDMzMiIgdmlld0JveD0iMCAwIDEwIDEwIiByZWZYPSI5IiByZWZZPSI1IiBtYXJrZXJVbml0cz0ic3Ryb2tlV2lkdGgiIG1hcmtlcldpZHRoPSI4IiBtYXJrZXJIZWlnaHQ9IjYiIG9yaWVudD0iYXV0byI+PHBhdGggZD0iTSAwIDAgTCAxMCA1IEwgMCAxMCB6IiBjbGFzcz0iYXJyb3doZWFkUGF0aCIgc3R5bGU9InN0cm9rZS13aWR0aDogMXB4OyBzdHJva2UtZGFzaGFycmF5OiAxcHgsIDBweDsiPjwvcGF0aD48L21hcmtlcj48L2RlZnM+PC9nPjxnIGNsYXNzPSJlZGdlUGF0aCIgc3R5bGU9Im9wYWNpdHk6IDE7Ij48cGF0aCBjbGFzcz0icGF0aCIgZD0iTTUyLjc4OTQzMzE3NjM4NTM2NiwxNDIuNTYyNUw5MC41LDIxMC43MDMxMjVMMTE1LjUsMjEwLjcwMzEyNSIgbWFya2VyLWVuZD0idXJsKCNhcnJvd2hlYWQzMzMpIiBzdHlsZT0ic3Ryb2tlOiAjMzMzOyBzdHJva2Utd2lkdGg6IDEuNXB4O2ZpbGw6bm9uZSI+PC9wYXRoPjxkZWZzPjxtYXJrZXIgaWQ9ImFycm93aGVhZDMzMyIgdmlld0JveD0iMCAwIDEwIDEwIiByZWZYPSI5IiByZWZZPSI1IiBtYXJrZXJVbml0cz0ic3Ryb2tlV2lkdGgiIG1hcmtlcldpZHRoPSI4IiBtYXJrZXJIZWlnaHQ9IjYiIG9yaWVudD0iYXV0byI+PHBhdGggZD0iTSAwIDAgTCAxMCA1IEwgMCAxMCB6IiBjbGFzcz0iYXJyb3doZWFkUGF0aCIgc3R5bGU9InN0cm9rZS13aWR0aDogMXB4OyBzdHJva2UtZGFzaGFycmF5OiAxcHgsIDBweDsiPjwvcGF0aD48L21hcmtlcj48L2RlZnM+PC9nPjxnIGNsYXNzPSJlZGdlUGF0aCIgc3R5bGU9Im9wYWNpdHk6IDE7Ij48cGF0aCBjbGFzcz0icGF0aCIgZD0iTTE0Ny4yNzc3Mzk4OTI3MDE5MywxMDYuMjgxMjVMMTg0LjMyODEyNSwzOC4xNDA2MjVMMjA5LjMyODEyNSwzOC4xNDA2MjUiIG1hcmtlci1lbmQ9InVybCgjYXJyb3doZWFkMzM0KSIgc3R5bGU9InN0cm9rZTogIzMzMzsgc3Ryb2tlLXdpZHRoOiAxLjVweDtmaWxsOm5vbmUiPjwvcGF0aD48ZGVmcz48bWFya2VyIGlkPSJhcnJvd2hlYWQzMzQiIHZpZXdCb3g9IjAgMCAxMCAxMCIgcmVmWD0iOSIgcmVmWT0iNSIgbWFya2VyVW5pdHM9InN0cm9rZVdpZHRoIiBtYXJrZXJXaWR0aD0iOCIgbWFya2VySGVpZ2h0PSI2IiBvcmllbnQ9ImF1dG8iPjxwYXRoIGQ9Ik0gMCAwIEwgMTAgNSBMIDAgMTAgeiIgY2xhc3M9ImFycm93aGVhZFBhdGgiIHN0eWxlPSJzdHJva2Utd2lkdGg6IDFweDsgc3Ryb2tlLWRhc2hhcnJheTogMXB4LCAwcHg7Ij48L3BhdGg+PC9tYXJrZXI+PC9kZWZzPjwvZz48ZyBjbGFzcz0iZWRnZVBhdGgiIHN0eWxlPSJvcGFjaXR5OiAxOyI+PHBhdGggY2xhc3M9InBhdGgiIGQ9Ik0xNTkuMzI4MTI1LDEyNC40MjE4NzVMMTg0LjMyODEyNSwxMjQuNDIxODc1TDIwOS4zMjgxMjUsMTI0LjQyMTg3NSIgbWFya2VyLWVuZD0idXJsKCNhcnJvd2hlYWQzMzUpIiBzdHlsZT0ic3Ryb2tlOiAjMzMzOyBzdHJva2Utd2lkdGg6IDEuNXB4O2ZpbGw6bm9uZSI+PC9wYXRoPjxkZWZzPjxtYXJrZXIgaWQ9ImFycm93aGVhZDMzNSIgdmlld0JveD0iMCAwIDEwIDEwIiByZWZYPSI5IiByZWZZPSI1IiBtYXJrZXJVbml0cz0ic3Ryb2tlV2lkdGgiIG1hcmtlcldpZHRoPSI4IiBtYXJrZXJIZWlnaHQ9IjYiIG9yaWVudD0iYXV0byI+PHBhdGggZD0iTSAwIDAgTCAxMCA1IEwgMCAxMCB6IiBjbGFzcz0iYXJyb3doZWFkUGF0aCIgc3R5bGU9InN0cm9rZS13aWR0aDogMXB4OyBzdHJva2UtZGFzaGFycmF5OiAxcHgsIDBweDsiPjwvcGF0aD48L21hcmtlcj48L2RlZnM+PC9nPjxnIGNsYXNzPSJlZGdlUGF0aCIgc3R5bGU9Im9wYWNpdHk6IDE7Ij48cGF0aCBjbGFzcz0icGF0aCIgZD0iTTE0Ny4yNzc3Mzk4OTI3MDE5MywxNDIuNTYyNUwxODQuMzI4MTI1LDIxMC43MDMxMjVMMjA5LjMyODEyNSwyMTAuNzAzMTI1IiBtYXJrZXItZW5kPSJ1cmwoI2Fycm93aGVhZDMzNikiIHN0eWxlPSJzdHJva2U6ICMzMzM7IHN0cm9rZS13aWR0aDogMS41cHg7ZmlsbDpub25lIj48L3BhdGg+PGRlZnM+PG1hcmtlciBpZD0iYXJyb3doZWFkMzM2IiB2aWV3Qm94PSIwIDAgMTAgMTAiIHJlZlg9IjkiIHJlZlk9IjUiIG1hcmtlclVuaXRzPSJzdHJva2VXaWR0aCIgbWFya2VyV2lkdGg9IjgiIG1hcmtlckhlaWdodD0iNiIgb3JpZW50PSJhdXRvIj48cGF0aCBkPSJNIDAgMCBMIDEwIDUgTCAwIDEwIHoiIGNsYXNzPSJhcnJvd2hlYWRQYXRoIiBzdHlsZT0ic3Ryb2tlLXdpZHRoOiAxcHg7IHN0cm9rZS1kYXNoYXJyYXk6IDFweCwgMHB4OyI+PC9wYXRoPjwvbWFya2VyPjwvZGVmcz48L2c+PC9nPjxnIGNsYXNzPSJlZGdlTGFiZWxzIj48ZyBjbGFzcz0iZWRnZUxhYmVsIiBzdHlsZT0ib3BhY2l0eTogMTsiIHRyYW5zZm9ybT0iIj48ZyB0cmFuc2Zvcm09InRyYW5zbGF0ZSgwLDApIiBjbGFzcz0ibGFiZWwiPjxyZWN0IHJ4PSIwIiByeT0iMCIgd2lkdGg9IjAiIGhlaWdodD0iMCIgc3R5bGU9ImZpbGw6I2U4ZThlODsiPjwvcmVjdD48dGV4dD48dHNwYW4geG1sOnNwYWNlPSJwcmVzZXJ2ZSIgZHk9IjFlbSIgeD0iMSI+PC90c3Bhbj48L3RleHQ+PC9nPjwvZz48ZyBjbGFzcz0iZWRnZUxhYmVsIiBzdHlsZT0ib3BhY2l0eTogMTsiIHRyYW5zZm9ybT0iIj48ZyB0cmFuc2Zvcm09InRyYW5zbGF0ZSgwLDApIiBjbGFzcz0ibGFiZWwiPjxyZWN0IHJ4PSIwIiByeT0iMCIgd2lkdGg9IjAiIGhlaWdodD0iMCIgc3R5bGU9ImZpbGw6I2U4ZThlODsiPjwvcmVjdD48dGV4dD48dHNwYW4geG1sOnNwYWNlPSJwcmVzZXJ2ZSIgZHk9IjFlbSIgeD0iMSI+PC90c3Bhbj48L3RleHQ+PC9nPjwvZz48ZyBjbGFzcz0iZWRnZUxhYmVsIiBzdHlsZT0ib3BhY2l0eTogMTsiIHRyYW5zZm9ybT0iIj48ZyB0cmFuc2Zvcm09InRyYW5zbGF0ZSgwLDApIiBjbGFzcz0ibGFiZWwiPjxyZWN0IHJ4PSIwIiByeT0iMCIgd2lkdGg9IjAiIGhlaWdodD0iMCIgc3R5bGU9ImZpbGw6I2U4ZThlODsiPjwvcmVjdD48dGV4dD48dHNwYW4geG1sOnNwYWNlPSJwcmVzZXJ2ZSIgZHk9IjFlbSIgeD0iMSI+PC90c3Bhbj48L3RleHQ+PC9nPjwvZz48ZyBjbGFzcz0iZWRnZUxhYmVsIiBzdHlsZT0ib3BhY2l0eTogMTsiIHRyYW5zZm9ybT0iIj48ZyB0cmFuc2Zvcm09InRyYW5zbGF0ZSgwLDApIiBjbGFzcz0ibGFiZWwiPjxyZWN0IHJ4PSIwIiByeT0iMCIgd2lkdGg9IjAiIGhlaWdodD0iMCIgc3R5bGU9ImZpbGw6I2U4ZThlODsiPjwvcmVjdD48dGV4dD48dHNwYW4geG1sOnNwYWNlPSJwcmVzZXJ2ZSIgZHk9IjFlbSIgeD0iMSI+PC90c3Bhbj48L3RleHQ+PC9nPjwvZz48ZyBjbGFzcz0iZWRnZUxhYmVsIiBzdHlsZT0ib3BhY2l0eTogMTsiIHRyYW5zZm9ybT0iIj48ZyB0cmFuc2Zvcm09InRyYW5zbGF0ZSgwLDApIiBjbGFzcz0ibGFiZWwiPjxyZWN0IHJ4PSIwIiByeT0iMCIgd2lkdGg9IjAiIGhlaWdodD0iMCIgc3R5bGU9ImZpbGw6I2U4ZThlODsiPjwvcmVjdD48dGV4dD48dHNwYW4geG1sOnNwYWNlPSJwcmVzZXJ2ZSIgZHk9IjFlbSIgeD0iMSI+PC90c3Bhbj48L3RleHQ+PC9nPjwvZz48ZyBjbGFzcz0iZWRnZUxhYmVsIiBzdHlsZT0ib3BhY2l0eTogMTsiIHRyYW5zZm9ybT0iIj48ZyB0cmFuc2Zvcm09InRyYW5zbGF0ZSgwLDApIiBjbGFzcz0ibGFiZWwiPjxyZWN0IHJ4PSIwIiByeT0iMCIgd2lkdGg9IjAiIGhlaWdodD0iMCIgc3R5bGU9ImZpbGw6I2U4ZThlODsiPjwvcmVjdD48dGV4dD48dHNwYW4geG1sOnNwYWNlPSJwcmVzZXJ2ZSIgZHk9IjFlbSIgeD0iMSI+PC90c3Bhbj48L3RleHQ+PC9nPjwvZz48L2c+PGcgY2xhc3M9Im5vZGVzIj48ZyBjbGFzcz0ibm9kZSIgc3R5bGU9Im9wYWNpdHk6IDE7IiBpZD0iQSIgdHJhbnNmb3JtPSJ0cmFuc2xhdGUoNDIuNzUsMTI0LjQyMTg3NSkiPjxyZWN0IHJ4PSIwIiByeT0iMCIgeD0iLTIyLjc1IiB5PSItMTguMTQwNjI1IiB3aWR0aD0iNDUuNSIgaGVpZ2h0PSIzNi4yODEyNSI+PC9yZWN0PjxnIGNsYXNzPSJsYWJlbCIgdHJhbnNmb3JtPSJ0cmFuc2xhdGUoMCwwKSI+PGcgdHJhbnNmb3JtPSJ0cmFuc2xhdGUoLTEyLjc1LC04LjE0MDYyNSkiPjx0ZXh0Pjx0c3BhbiB4bWw6c3BhY2U9InByZXNlcnZlIiBkeT0iMWVtIiB4PSIxIj51c2VyPC90c3Bhbj48L3RleHQ+PC9nPjwvZz48L2c+PGcgY2xhc3M9Im5vZGUiIHN0eWxlPSJvcGFjaXR5OiAxOyIgaWQ9IkIiIHRyYW5zZm9ybT0idHJhbnNsYXRlKDEzNy40MTQwNjI1LDM4LjE0MDYyNSkiPjxyZWN0IHJ4PSIwIiByeT0iMCIgeD0iLTIxLjkxNDA2MjUiIHk9Ii0xOC4xNDA2MjUiIHdpZHRoPSI0My44MjgxMjUiIGhlaWdodD0iMzYuMjgxMjUiPjwvcmVjdD48ZyBjbGFzcz0ibGFiZWwiIHRyYW5zZm9ybT0idHJhbnNsYXRlKDAsMCkiPjxnIHRyYW5zZm9ybT0idHJhbnNsYXRlKC0xMS45MTQwNjI1LC04LjE0MDYyNSkiPjx0ZXh0Pjx0c3BhbiB4bWw6c3BhY2U9InByZXNlcnZlIiBkeT0iMWVtIiB4PSIxIj5yb2xlPC90c3Bhbj48L3RleHQ+PC9nPjwvZz48L2c+PGcgY2xhc3M9Im5vZGUiIHN0eWxlPSJvcGFjaXR5OiAxOyIgaWQ9IkMiIHRyYW5zZm9ybT0idHJhbnNsYXRlKDEzNy40MTQwNjI1LDEyNC40MjE4NzUpIj48cmVjdCByeD0iMCIgcnk9IjAiIHg9Ii0yMS45MTQwNjI1IiB5PSItMTguMTQwNjI1IiB3aWR0aD0iNDMuODI4MTI1IiBoZWlnaHQ9IjM2LjI4MTI1Ij48L3JlY3Q+PGcgY2xhc3M9ImxhYmVsIiB0cmFuc2Zvcm09InRyYW5zbGF0ZSgwLDApIj48ZyB0cmFuc2Zvcm09InRyYW5zbGF0ZSgtMTEuOTE0MDYyNSwtOC4xNDA2MjUpIj48dGV4dD48dHNwYW4geG1sOnNwYWNlPSJwcmVzZXJ2ZSIgZHk9IjFlbSIgeD0iMSI+cm9sZTwvdHNwYW4+PC90ZXh0PjwvZz48L2c+PC9nPjxnIGNsYXNzPSJub2RlIiBzdHlsZT0ib3BhY2l0eTogMTsiIGlkPSJEIiB0cmFuc2Zvcm09InRyYW5zbGF0ZSgxMzcuNDE0MDYyNSwyMTAuNzAzMTI1KSI+PHJlY3Qgcng9IjAiIHJ5PSIwIiB4PSItMjEuOTE0MDYyNSIgeT0iLTE4LjE0MDYyNSIgd2lkdGg9IjQzLjgyODEyNSIgaGVpZ2h0PSIzNi4yODEyNSI+PC9yZWN0PjxnIGNsYXNzPSJsYWJlbCIgdHJhbnNmb3JtPSJ0cmFuc2xhdGUoMCwwKSI+PGcgdHJhbnNmb3JtPSJ0cmFuc2xhdGUoLTExLjkxNDA2MjUsLTguMTQwNjI1KSI+PHRleHQ+PHRzcGFuIHhtbDpzcGFjZT0icHJlc2VydmUiIGR5PSIxZW0iIHg9IjEiPnJvbGU8L3RzcGFuPjwvdGV4dD48L2c+PC9nPjwvZz48ZyBjbGFzcz0ibm9kZSIgc3R5bGU9Im9wYWNpdHk6IDE7IiBpZD0iRSIgdHJhbnNmb3JtPSJ0cmFuc2xhdGUoMjQxLjU0Njg3NSwzOC4xNDA2MjUpIj48cmVjdCByeD0iMCIgcnk9IjAiIHg9Ii0zMi4yMTg3NSIgeT0iLTE4LjE0MDYyNSIgd2lkdGg9IjY0LjQzNzUiIGhlaWdodD0iMzYuMjgxMjUiPjwvcmVjdD48ZyBjbGFzcz0ibGFiZWwiIHRyYW5zZm9ybT0idHJhbnNsYXRlKDAsMCkiPjxnIHRyYW5zZm9ybT0idHJhbnNsYXRlKC0yMi4yMTg3NSwtOC4xNDA2MjUpIj48dGV4dD48dHNwYW4geG1sOnNwYWNlPSJwcmVzZXJ2ZSIgZHk9IjFlbSIgeD0iMSI+ZG9tYWluPC90c3Bhbj48L3RleHQ+PC9nPjwvZz48L2c+PGcgY2xhc3M9Im5vZGUiIHN0eWxlPSJvcGFjaXR5OiAxOyIgaWQ9IkYiIHRyYW5zZm9ybT0idHJhbnNsYXRlKDI0MS41NDY4NzUsMTI0LjQyMTg3NSkiPjxyZWN0IHJ4PSIwIiByeT0iMCIgeD0iLTMyLjIxODc1IiB5PSItMTguMTQwNjI1IiB3aWR0aD0iNjQuNDM3NSIgaGVpZ2h0PSIzNi4yODEyNSI+PC9yZWN0PjxnIGNsYXNzPSJsYWJlbCIgdHJhbnNmb3JtPSJ0cmFuc2xhdGUoMCwwKSI+PGcgdHJhbnNmb3JtPSJ0cmFuc2xhdGUoLTIyLjIxODc1LC04LjE0MDYyNSkiPjx0ZXh0Pjx0c3BhbiB4bWw6c3BhY2U9InByZXNlcnZlIiBkeT0iMWVtIiB4PSIxIj5kb21haW48L3RzcGFuPjwvdGV4dD48L2c+PC9nPjwvZz48ZyBjbGFzcz0ibm9kZSIgc3R5bGU9Im9wYWNpdHk6IDE7IiBpZD0iRyIgdHJhbnNmb3JtPSJ0cmFuc2xhdGUoMjQxLjU0Njg3NSwyMTAuNzAzMTI1KSI+PHJlY3Qgcng9IjAiIHJ5PSIwIiB4PSItMzIuMjE4NzUiIHk9Ii0xOC4xNDA2MjUiIHdpZHRoPSI2NC40Mzc1IiBoZWlnaHQ9IjM2LjI4MTI1Ij48L3JlY3Q+PGcgY2xhc3M9ImxhYmVsIiB0cmFuc2Zvcm09InRyYW5zbGF0ZSgwLDApIj48ZyB0cmFuc2Zvcm09InRyYW5zbGF0ZSgtMjIuMjE4NzUsLTguMTQwNjI1KSI+PHRleHQ+PHRzcGFuIHhtbDpzcGFjZT0icHJlc2VydmUiIGR5PSIxZW0iIHg9IjEiPmRvbWFpbjwvdHNwYW4+PC90ZXh0PjwvZz48L2c+PC9nPjwvZz48L2c+PC9nPjwvc3ZnPg==

Linux用户 vs. SELinux user

• 当前系统的用户可以通过查看/etc/passwd文件获取，也可以参考列出 Linux 系统上所有用户的 3 种方法.
• 查看SELinux的用户可以通过命令semanage user -l.

               标记中        MLS/       MLS/                          
SELinux 用户      前缀         MCS 级别     MCS 范围                         SELinux 角色

guest_u         user       s0         s0                             guest_r
root            user       s0         s0-s0:c0.c1023                 staff_r sysadm_r system_r unconfined_r
staff_u         user       s0         s0-s0:c0.c1023                 staff_r sysadm_r unconfined_r
sysadm_u        user       s0         s0-s0:c0.c1023                 sysadm_r
system_u        user       s0         s0-s0:c0.c1023                 system_r unconfined_r
unconfined_u    user       s0         s0-s0:c0.c1023                 system_r unconfined_r
user_u          user       s0         s0                             user_r
xguest_u        user       s0         s0                             xguest_r

• 查看两者的映射关系可以通过命令semanage login -l.

登录名                  SELinux 用户           MLS/MCS 范围           服务

__default__          unconfined_u         s0-s0:c0.c1023       *
john                 user_u               s0                   *
root                 unconfined_u         s0-s0:c0.c1023       *

Linux用户和SELinux用户的初始映射关系由seusers文件指定。这个文件不属于策略二进制的一部分，而可以直接修改生效。当然更优雅的办法是通过semanage命令来修改。
另外，在修改了context以后，或者新建了用户以后，必须要使用注销登录的方法，才能使新的context生效，而只使用su命令切换用户，并不会切换context。推测注销登录使用的是PAM登录程序，而su命令中，并没有重新加载user context的功能。
Linux用户登录后，获取shell安全上下文的步骤，可以参考文献【2】。简述如下：

1. 根据seusers文件，映射SELinux用户，如果没有seusers文件，系统就无法启动了。如果seusers文件没有对应的用户描述，则统一映射为__default__用户。如果__default__用户描述不存在，则无法登录。
2. 根据SELinux的搜索优先级，找到对应SELinux用户的安全上下文。

勘误
在[1]中，对Linux用户和SELinux的映射关系有如下描述：
On login, if there is an SELinux user identifier that is exactly the same as the Linux user identifier, the matching SELinux user identifier becomes the user identifier in the security context for the initial shell process. In this way, if a Linux user identifier also exists as a user identifier in the SELinux policy, all login processes will set the initial shell process security context user identifier to that matching Linux identity.
经实验证明，并非如此：

• 定义了一个guest_u用户，登录后，其shell的安全上下文仍为：
  
• 但事实证明，明明就有guest_u这个用户
  

总结

现在可以引用[1]中的一幅图来总结一下RBAC的工作原理了。

• Linux系统有一个用户较joe
• SELinuxcelue中规定joe和user_r绑定，user_r和user_t绑定
• 当joe登录时，系统根据seusers（此处与图不同，参见上一章勘误），找到对应的SELinux user，找不到就是__default__, __default__没有就不能登录了
• 根据以下context文件顺序，决定其shell的安全上下文，即joe:user_r:user_t
  • /etc/selinux/specified-policy/contexts/users
  • /etc/selinux/specified-policy/contexts/default_contexts
  • /etc/selinux/specified-policy/contexts/failsafe_context
  • sid kernel的安全上下文
• joe执行了一个应用，开始进行domain_transition, 要从user_t切换到passwd_t
  • 如果定义了role user_r types passwd_t和role user_r types user_t，则这次domain transition可以成功
  • 否则任意一个未定义，domain transition都会失败

高阶用法

role_transition

role transition和domain transition非常类似，也是在某个domain进程在执行某个可执行文件时，即exec系统调用时，切换进程主体的安全上下文。domain transition切换的时domain，role transtion切换的是role。实现方式通过以下两条语句：

allow staff_r sysadm_r; # 允许从staff_r切换到sysadm_r
role_transition sysadm_r http_exec_t system_r; # sysadm_r进程执行http_exec_t类型文件时，role切换为system_r

role_dominance

可以利用role来定义其他role，即role dominance。

dominance { role super_r {role sysadm_r; role secadm_r; }

上面例子中的super_r称为dominant role，它可以从它关联的role中即成types。但它只能继承该条语句之前关联的types。我们之前说role语句是可以累积的。那么在role_dominance语句之后定义的types，并不能动态的添加到dominant role上。

相关工具

跟role相关的主要是semnage的一些用法，另外[1]还介绍了一个apol的可视化工具，可以检索user和role的数据。我理解semanage通过命令行也都可以实现。

1. 前文介绍过的semanage user -l和semanage login -l, 前者用来查看所有SELinux的用户，后者用来查看Linux用户和SELinux用户两者的映射关系.
2. Modify the default user on the system to the guest_u user

• semanage login -m -s guest_u __default__

3. 修改user和role的对应关系

• semanage user -m -R "message_filter_r unconfined_r" user_u

4. 添加一个用户并指定SELinux用户

• useradd joe -Z user_u

参考文献

[1] SELinux by Example_ Using Security Enhanced Linux

[2] SELinux初始化登录用户安全上下文的方法

RBAC%2C%20Role%20Based%20Access%20Control%2C%20%E6%98%AFSELinux%E7%9A%84%E5%8F%A6%E4%B8%80%E4%B8%AA%E9%87%8D%E8%A6%81%E7%9A%84%E7%89%B9%E6%80%A7%E3%80%82%E4%BD%86%E4%BB%96%E5%B9%B6%E4%B8%8D%E6%98%AF%E4%B8%80%E7%A7%8D%E7%8B%AC%E7%AB%8B%E7%9A%84%E6%8E%A7%E5%88%B6%E6%96%B9%E5%BC%8F%EF%BC%8C%E8%80%8C%E6%98%AF%E5%AF%B9TEAC%E7%9A%84%E4%B8%80%E7%A7%8D%E8%A1%A5%E5%85%85%E3%80%82%E5%85%B6%E4%B8%BB%E8%A6%81%E7%9A%84%E4%BD%9C%E7%94%A8%E6%98%AF%EF%BC%8C%E6%9E%84%E5%BB%BASELinux%E6%8F%90%E4%BE%9B%E7%9A%84%E8%BF%9B%E7%A8%8B%E7%BA%A7%E7%9A%84MAC%E6%9C%BA%E5%88%B6%E4%B8%8ELinux%E7%9A%84%E7%94%A8%E6%88%B7%E7%B3%BB%E7%BB%9F%E7%9A%84%E6%98%A0%E5%B0%84%E5%85%B3%E7%B3%BB%E3%80%82%0A%0A%23%20RBAC%E5%B7%A5%E4%BD%9C%E5%8E%9F%E7%90%86%0ARBAC%E5%B9%B6%E4%B8%8D%E6%8F%90%E4%BE%9B%E5%BC%BA%E5%88%B6%E8%AE%BF%E9%97%AE%E6%8E%A7%E5%88%B6%EF%BC%8C%E8%80%8C%E6%98%AF%E9%80%9A%E8%BF%87user%EF%BC%8Crole%EF%BC%8Ctype%E4%B9%8B%E9%97%B4%E7%9A%84%E5%AF%B9%E5%BA%94%E5%85%B3%E7%B3%BB%EF%BC%8C%E6%9D%A5%E6%8E%A7%E5%88%B6type_transition%E7%AD%96%E7%95%A5%E8%83%BD%E5%90%A6%E6%88%90%E5%8A%9F%E3%80%82%0A%23%23%20role%20vs.%20type%0Arole%20based%E6%9C%80%E5%9F%BA%E6%9C%AC%E7%9A%84%E5%B0%B1%E6%98%AF%E5%AE%9A%E4%B9%89role%E5%88%B0type%E5%88%B0%E5%AF%B9%E5%BA%94%E5%85%B3%E7%B3%BB%E3%80%82%E4%BD%BF%E7%94%A8role%E8%AF%AD%E5%8F%A5%E5%8F%AF%E4%BB%A5%E5%AE%9E%E7%8E%B0%EF%BC%9A%60role%20role_name%20%5Btypes%20type_set%5D%3B%60%E3%80%82%E4%BE%8B%E5%A6%82%EF%BC%9A%0A%60%60%60%0Arole%20user_r%20types%20user_t%3B%0Arole%20user_r%20types%20%7B%20staff_t%2C%20admin_t%20%7D%3B%0A%60%60%60%0A-%20role%E5%AE%9A%E4%B9%89%E6%98%AF%E7%B4%AF%E7%A7%AF%E7%9A%84%EF%BC%8C%E5%8D%B3%E5%90%8E%E9%9D%A2%E7%9A%84%E5%AF%B9%E5%BA%94%E5%85%B3%E7%B3%BB%E4%B8%8D%E4%BC%9A%E8%A6%86%E7%9B%96%E5%89%8D%E9%9D%A2%E8%AF%AD%E5%8F%A5%E5%AE%9A%E4%B9%89%E7%9A%84%E5%AF%B9%E5%BA%94%E5%85%B3%E7%B3%BB%EF%BC%8C%E8%80%8C%E5%8F%AA%E4%BC%9A%E8%BF%BD%E5%8A%A0%E8%BF%99%E7%A7%8D%E5%85%B3%E7%B3%BB%0A-%20role%E8%AF%AD%E5%8F%A5%E9%80%9A%E5%B8%B8%E5%AE%9A%E4%B9%89%E5%9C%A8type%E5%A3%B0%E6%98%8E%E9%99%84%E8%BF%91%EF%BC%8C%E4%BB%A5%E7%A1%AE%E4%BF%9D%E8%AF%A5%E5%AF%B9%E5%BA%94%E5%85%B3%E7%B3%BB%E8%A2%AB%E5%8F%8A%E6%97%B6%E5%AE%9A%E4%B9%89%0A%0A%3E%20**%E5%AE%9A%E4%B9%89%E5%AD%90role%20(period)**%0A%3E%20A%20period%20is%20used%20to%20indicate%20restrictions%20on%20the%20set%20of%20types%20that%20may%20be%20assigned%20to%20a%20role.%20For%20example%2C%20the%20set%20of%20types%20for%20a%20role%20called%20***apache.cgi***%20must%20be%20a%20***subset***%20of%20the%20type%20set%20of%20a%20role%20called%20***apache***.%0A%0Arole%E8%AF%AD%E5%8F%A5%E5%AE%9A%E4%B9%89%E7%9A%84%E5%9F%BA%E6%9C%AC%E9%80%BB%E8%BE%91%E5%B0%B1%E6%98%AF%EF%BC%8C%E5%AE%9A%E4%B9%89%E4%BA%86role%3D%3E%7B%20types%20%7D%E9%9B%86%E5%90%88%E7%9A%84%E6%98%A0%E5%B0%84%E5%85%B3%E7%B3%BB%E3%80%82%E5%BD%93%E5%8F%91%E7%94%9Ftype%20transition%E6%97%B6%EF%BC%8C%E5%A6%82%E6%9E%9C%E8%BD%AC%E6%8D%A2%E5%90%8E%E7%9A%84%7Brole%EF%BC%8Ctype%7D%E7%BB%84%E5%90%88%E6%9C%AA%E5%AE%9A%E4%B9%89%EF%BC%8C%E5%88%99%E8%A7%86%E4%B8%BA%E6%9D%83%E9%99%90%E9%94%99%E8%AF%AF%E3%80%82%E4%BB%8E%E8%BF%99%E4%B8%AA%E5%B1%82%E9%9D%A2%E7%9C%8B%EF%BC%8Crole%E5%AF%B9%E5%BA%94%E7%9A%84%E6%98%AF%E4%B8%BB%E4%BD%93type%EF%BC%8C%E5%8D%B3domain%20type%EF%BC%8C%E8%80%8C%E9%9D%9Eobject%20type%E3%80%82%0A%0A%0A%23%23%23%20%E7%89%B9%E6%AE%8A%E7%9A%84role%3A%20object_r%0Aobject_r%E6%98%AF%E5%86%85%E6%A0%B8SELinux%E6%A8%A1%E5%9D%97%E9%A2%84%E5%AE%9A%E4%B9%89%E7%9A%84%E4%B8%80%E4%B8%AArole%EF%BC%8C%E6%97%A0%E9%9C%80%E5%9C%A8policy%E4%B8%AD%E5%A3%B0%E6%98%8E%E3%80%82%E8%80%8C%E8%BF%99%E4%B8%AAobject_r%E8%A2%AB%E4%B8%93%E9%97%A8%E7%94%A8%E6%9D%A5%E5%AE%9A%E4%B9%89%E5%AE%A2%E4%BD%93%E7%9A%84%E5%AE%89%E5%85%A8%E4%B8%8A%E4%B8%8B%E6%96%87%E3%80%82%0A%23%23%20user%20vs.%20role%0Auser%E6%98%AF%E5%AF%B9role%E7%9A%84%E5%86%8D%E4%B8%80%E6%AC%A1%E6%89%A9%E5%85%85%EF%BC%8C%E9%80%9A%E8%BF%87user%E5%B0%86role%E4%B8%8ELinux%20user%E7%9A%84%E6%98%A0%E5%B0%84%E5%85%B3%E7%B3%BB%E5%BB%BA%E7%AB%8B%E8%B5%B7%E6%9D%A5%E3%80%82SELinux%E7%9A%84%E7%94%A8%E6%88%B7%E7%B3%BB%E7%BB%9F%E7%8B%AC%E7%AB%8B%E4%BA%8ELinux%E7%94%A8%E6%88%B7%E7%B3%BB%E7%BB%9F%E3%80%82%E9%80%9A%E8%BF%87seusers%E6%96%87%E4%BB%B6%E6%88%96%E8%80%85%60semanage%20user%60%E5%91%BD%E4%BB%A4%E5%8F%AF%E4%BB%A5%E5%AE%9A%E4%B9%89%E4%BB%96%E4%BB%AC%E4%B9%8B%E9%97%B4%E7%9A%84%E6%98%A0%E5%B0%84%E5%85%B3%E7%B3%BB%E3%80%82%E4%BD%86%E5%AE%9E%E9%99%85%E5%8F%AF%E5%AE%9A%E4%B9%89%E7%9A%84%E8%87%AA%E7%94%B1%E5%BA%A6%E5%B9%B6%E6%B2%A1%E6%9C%89%E9%82%A3%E4%B9%88%E9%AB%98%E3%80%82%0A%3E%20The%20design%20decision%20for%20SELinux%20to%20have%20a%20distinct%20user%20identifier%20(rather%20than%20share%20that%20of%20Linux)%20is%20motivated%20by%20the%20desire%20to%20create%20an%20immutable%20SELinux%20user%20identifier.%0A%0A%E5%AE%9A%E4%B9%89%E4%B8%80%E4%B8%AAuser%E4%B8%8Erole%E7%9A%84%E6%98%A0%E5%B0%84%E5%85%B3%E7%B3%BB%EF%BC%8C%E5%8F%AF%E4%BB%A5%E4%BD%BF%E7%94%A8user%E8%AF%AD%E5%8F%A5%EF%BC%9A%60user%20user_name%20roles%20%7B%20role_set%20%7D%3B%60%0Auser%E8%AF%AD%E5%8F%A5%E6%89%80%E4%BD%93%E7%8E%B0%E7%9A%84%E9%80%BB%E8%BE%91%E5%92%8Crole%E8%AF%AD%E5%8F%A5%E7%B1%BB%E4%BC%BC%EF%BC%8C%E5%8D%B3%E5%AE%9A%E4%B9%89%E4%BA%86user%3D%3E%7B%20roles%20%7D%E9%9B%86%E5%90%88%E7%9A%84%E6%98%A0%E5%B0%84%E5%85%B3%E7%B3%BB%E3%80%82%E5%BD%93%E5%BA%94%E7%94%A8%E5%90%AF%E5%8A%A8%E6%97%B6%E5%8F%91%E7%94%9Frole%20transition%E6%97%B6%EF%BC%8C%E5%A6%82%E6%9E%9C%E8%BD%AC%E6%8D%A2%E5%90%8E%E7%9A%84%7Buser%2C%20role%7D%E6%9C%AA%E5%AE%9A%E4%B9%89%EF%BC%8C%E5%88%99%E8%A7%86%E4%B8%BA%E6%9D%83%E9%99%90%E9%94%99%E8%AF%AF%E3%80%82%0A%0A%E5%BD%93SELinux%E9%80%9A%E8%BF%87RBAC%EF%BC%8C%E5%BB%BA%E7%AB%8B%E8%B5%B7user%3D%3Erole%3D%3Etype%E7%9A%84%E6%98%A0%E5%B0%84%E5%85%B3%E7%B3%BB%E4%BB%A5%E5%90%8E%EF%BC%8C%E8%BF%98%E8%8E%B7%E5%BE%97%E4%BA%86%E4%B8%80%E4%B8%AA%E5%A5%BD%E5%A4%84%E3%80%82Linux%E7%B3%BB%E7%BB%9F%E7%9A%84%E7%94%A8%E6%88%B7%E6%95%B0%E5%8F%AF%E8%83%BD%E5%BE%88%E5%A4%9A%EF%BC%8C%E8%80%8C%E7%94%A8%E6%88%B7%E7%9A%84%E7%B1%BB%E5%9E%8B%E5%BE%88%E5%B0%91%E3%80%82%E7%94%A8%E6%88%B7%E5%B9%B6%E4%B8%8D%E6%98%AF%E4%B8%BA%E4%BA%86%E5%AE%9A%E4%B9%89%E6%9D%83%E9%99%90%E7%9A%84%EF%BC%8C%E4%B8%8D%E5%90%8C%E7%9A%84%E7%94%A8%E6%88%B7%E4%B9%8B%E9%97%B4%E7%9A%84%E4%BD%BF%E7%94%A8%E6%95%B0%E6%8D%AE%E9%9C%80%E8%A6%81%E9%9A%94%E7%A6%BB%E3%80%82%E4%BD%86%E5%BE%80%E5%BE%80%E4%B8%80%E7%B1%BB%E7%94%A8%E6%88%B7%E7%9A%84%E6%9D%83%E9%99%90%E6%98%AF%E7%9B%B8%E5%90%8C%E7%9A%84%E3%80%82%E4%BE%8B%E5%A6%82%E8%B6%85%E7%BA%A7%E7%94%A8%E6%88%B7%EF%BC%8C%E7%AE%A1%E7%90%86%E5%91%98%E7%94%A8%E6%88%B7%EF%BC%8C%E6%99%AE%E9%80%9A%E7%94%A8%E6%88%B7%E7%AD%89%E7%AD%89%E3%80%82%E7%B3%BB%E7%BB%9F%E7%9A%84%E6%9D%83%E9%99%90%E9%9B%86%E6%9C%80%E5%B0%8F%E7%B2%92%E5%BA%A6%E7%94%B1domain%E5%AE%9A%E4%B9%89%E3%80%82%E5%8F%AF%E8%83%BD%E6%AF%8F%E4%B8%AA%E8%BF%9B%E7%A8%8B%E7%9A%84%E6%9D%83%E9%99%90%E4%B8%8D%E5%90%8C%EF%BC%8C%E4%B9%9F%E5%8F%AF%E8%83%BD%E4%B8%80%E7%BB%84%E8%BF%9B%E7%A8%8B%E7%9A%84%E6%9D%83%E9%99%90%E7%9B%B8%E5%90%8C%E3%80%82%E4%BD%86%E5%BE%80%E5%BE%80domain%E7%9A%84%E6%95%B0%E9%87%8F%E4%B9%9F%E5%BE%88%E5%BA%9E%E5%A4%A7%E3%80%82%E5%A6%82%E6%9E%9C%E6%B2%A1%E6%9C%89RBAC%EF%BC%8C%E6%88%91%E4%BB%AC%E9%9C%80%E8%A6%81%E5%AE%9A%E4%B9%89user%E5%88%B0domain%E5%88%B0%E6%98%A0%E5%B0%84%E3%80%82%E8%BF%99%E6%A0%B7%E4%B9%9F%E4%B8%8D%E6%98%AF%E4%B8%8D%E8%83%BD%E5%81%9A%EF%BC%8C%E4%BD%86%E5%8D%B4%E4%B8%8D%E5%A4%AA%E4%BC%98%E9%9B%85%E3%80%82%E6%AF%8F%E6%AC%A1%E6%96%B0%E5%A2%9E%E7%94%A8%E6%88%B7%E6%97%B6%EF%BC%8C%E9%9C%80%E8%A6%81%E4%B8%BA%E6%96%B0%E5%A2%9E%E7%94%A8%E6%88%B7%E7%BB%91%E5%AE%9A%E4%B8%80%E5%A0%86domain%E3%80%82%E5%AE%9A%E4%B9%89%E4%BA%86role%E4%B9%8B%E5%90%8E%EF%BC%8Crole%E7%9B%B8%E5%BD%93%E4%BA%8E%E8%BE%83%E7%A8%B3%E5%AE%9A%E7%9A%84%E4%B8%80%E5%B1%82%E6%8A%BD%E8%B1%A1%EF%BC%8Crole%E5%88%B0types%E7%9A%84%E6%98%A0%E5%B0%84%E5%85%B3%E7%B3%BB%E6%98%AF%E5%9C%A8%E5%AE%9A%E4%B9%89type%E6%97%B6%E5%80%99%E5%B0%B1%E5%AE%9A%E4%B9%89%E4%BA%86%E7%9A%84%E3%80%82%E5%A2%9E%E5%8A%A0%E6%96%B0user%E7%9A%84%E6%97%B6%E5%80%99%EF%BC%8C%E5%8F%AA%E8%A6%81%E5%AE%9A%E4%B9%89user%E5%88%B0role%E7%9A%84%E6%98%A0%E5%B0%84%E5%8D%B3%E5%8F%AF%E3%80%82%E8%BF%99%E5%B0%B1%E6%98%AF%E5%BC%95%E5%85%A5RBAC%E7%9A%84%E5%8E%9F%E5%9B%A0%E3%80%82%0A%0A%60%60%60mermaid%0Agraph%20LR%0AA%5Buser%5D%20--%3E%20B%5Brole%5D%0AA%20--%3E%20C%5Brole%5D%0AA%20--%3E%20D%5Brole%5D%0AC%20--%3E%20E%5Bdomain%5D%0AC%20--%3E%20F%5Bdomain%5D%0AC%20--%3E%20G%5Bdomain%5D%0A%60%60%60%0A%0A%23%23%23%20Linux%E7%94%A8%E6%88%B7%20vs.%20SELinux%20user%0A-%20%E5%BD%93%E5%89%8D%E7%B3%BB%E7%BB%9F%E7%9A%84%E7%94%A8%E6%88%B7%E5%8F%AF%E4%BB%A5%E9%80%9A%E8%BF%87%E6%9F%A5%E7%9C%8B%2Fetc%2Fpasswd%E6%96%87%E4%BB%B6%E8%8E%B7%E5%8F%96%EF%BC%8C%E4%B9%9F%E5%8F%AF%E4%BB%A5%E5%8F%82%E8%80%83%5B%E5%88%97%E5%87%BA%20Linux%20%E7%B3%BB%E7%BB%9F%E4%B8%8A%E6%89%80%E6%9C%89%E7%94%A8%E6%88%B7%E7%9A%84%203%20%E7%A7%8D%E6%96%B9%E6%B3%95%5D(https%3A%2F%2Fzhuanlan.zhihu.com%2Fp%2F41161408).%0A-%20%E6%9F%A5%E7%9C%8BSELinux%E7%9A%84%E7%94%A8%E6%88%B7%E5%8F%AF%E4%BB%A5%E9%80%9A%E8%BF%87%E5%91%BD%E4%BB%A4%60semanage%20user%20-l%60.%0A%60%60%60shell%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%E6%A0%87%E8%AE%B0%E4%B8%AD%20%20%20%20%20%20%20%20MLS%2F%20%20%20%20%20%20%20MLS%2F%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%0ASELinux%20%E7%94%A8%E6%88%B7%20%20%20%20%20%20%E5%89%8D%E7%BC%80%20%20%20%20%20%20%20%20%20MCS%20%E7%BA%A7%E5%88%AB%20%20%20%20%20MCS%20%E8%8C%83%E5%9B%B4%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20SELinux%20%E8%A7%92%E8%89%B2%0A%0Aguest_u%20%20%20%20%20%20%20%20%20user%20%20%20%20%20%20%20s0%20%20%20%20%20%20%20%20%20s0%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20guest_r%0Aroot%20%20%20%20%20%20%20%20%20%20%20%20user%20%20%20%20%20%20%20s0%20%20%20%20%20%20%20%20%20s0-s0%3Ac0.c1023%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20staff_r%20sysadm_r%20system_r%20unconfined_r%0Astaff_u%20%20%20%20%20%20%20%20%20user%20%20%20%20%20%20%20s0%20%20%20%20%20%20%20%20%20s0-s0%3Ac0.c1023%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20staff_r%20sysadm_r%20unconfined_r%0Asysadm_u%20%20%20%20%20%20%20%20user%20%20%20%20%20%20%20s0%20%20%20%20%20%20%20%20%20s0-s0%3Ac0.c1023%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20sysadm_r%0Asystem_u%20%20%20%20%20%20%20%20user%20%20%20%20%20%20%20s0%20%20%20%20%20%20%20%20%20s0-s0%3Ac0.c1023%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20system_r%20unconfined_r%0Aunconfined_u%20%20%20%20user%20%20%20%20%20%20%20s0%20%20%20%20%20%20%20%20%20s0-s0%3Ac0.c1023%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20system_r%20unconfined_r%0Auser_u%20%20%20%20%20%20%20%20%20%20user%20%20%20%20%20%20%20s0%20%20%20%20%20%20%20%20%20s0%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20user_r%0Axguest_u%20%20%20%20%20%20%20%20user%20%20%20%20%20%20%20s0%20%20%20%20%20%20%20%20%20s0%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20xguest_r%0A%60%60%60%0A-%20%E6%9F%A5%E7%9C%8B%E4%B8%A4%E8%80%85%E7%9A%84%E6%98%A0%E5%B0%84%E5%85%B3%E7%B3%BB%E5%8F%AF%E4%BB%A5%E9%80%9A%E8%BF%87%E5%91%BD%E4%BB%A4%60semanage%20login%20-l%60.%0A%60%60%60shell%0A%E7%99%BB%E5%BD%95%E5%90%8D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20SELinux%20%E7%94%A8%E6%88%B7%20%20%20%20%20%20%20%20%20%20%20MLS%2FMCS%20%E8%8C%83%E5%9B%B4%20%20%20%20%20%20%20%20%20%20%20%E6%9C%8D%E5%8A%A1%0A%0A__default__%20%20%20%20%20%20%20%20%20%20unconfined_u%20%20%20%20%20%20%20%20%20s0-s0%3Ac0.c1023%20%20%20%20%20%20%20*%0Ajohn%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20user_u%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20s0%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20*%0Aroot%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20unconfined_u%20%20%20%20%20%20%20%20%20s0-s0%3Ac0.c1023%20%20%20%20%20%20%20*%0A%60%60%60%0A%0ALinux%E7%94%A8%E6%88%B7%E5%92%8CSELinux%E7%94%A8%E6%88%B7%E7%9A%84%E5%88%9D%E5%A7%8B%E6%98%A0%E5%B0%84%E5%85%B3%E7%B3%BB%E7%94%B1seusers%E6%96%87%E4%BB%B6%E6%8C%87%E5%AE%9A%E3%80%82%E8%BF%99%E4%B8%AA%E6%96%87%E4%BB%B6%E4%B8%8D%E5%B1%9E%E4%BA%8E%E7%AD%96%E7%95%A5%E4%BA%8C%E8%BF%9B%E5%88%B6%E7%9A%84%E4%B8%80%E9%83%A8%E5%88%86%EF%BC%8C%E8%80%8C%E5%8F%AF%E4%BB%A5%E7%9B%B4%E6%8E%A5%E4%BF%AE%E6%94%B9%E7%94%9F%E6%95%88%E3%80%82%E5%BD%93%E7%84%B6%E6%9B%B4%E4%BC%98%E9%9B%85%E7%9A%84%E5%8A%9E%E6%B3%95%E6%98%AF%E9%80%9A%E8%BF%87semanage%E5%91%BD%E4%BB%A4%E6%9D%A5%E4%BF%AE%E6%94%B9%E3%80%82%0A%E5%8F%A6%E5%A4%96%EF%BC%8C%E5%9C%A8%E4%BF%AE%E6%94%B9%E4%BA%86context%E4%BB%A5%E5%90%8E%EF%BC%8C%E6%88%96%E8%80%85%E6%96%B0%E5%BB%BA%E4%BA%86%E7%94%A8%E6%88%B7%E4%BB%A5%E5%90%8E%EF%BC%8C%E5%BF%85%E9%A1%BB%E8%A6%81%E4%BD%BF%E7%94%A8%E6%B3%A8%E9%94%80%E7%99%BB%E5%BD%95%E7%9A%84%E6%96%B9%E6%B3%95%EF%BC%8C%E6%89%8D%E8%83%BD%E4%BD%BF%E6%96%B0%E7%9A%84context%E7%94%9F%E6%95%88%EF%BC%8C%E8%80%8C%E5%8F%AA%E4%BD%BF%E7%94%A8su%E5%91%BD%E4%BB%A4%E5%88%87%E6%8D%A2%E7%94%A8%E6%88%B7%EF%BC%8C%E5%B9%B6%E4%B8%8D%E4%BC%9A%E5%88%87%E6%8D%A2context%E3%80%82%E6%8E%A8%E6%B5%8B%E6%B3%A8%E9%94%80%E7%99%BB%E5%BD%95%E4%BD%BF%E7%94%A8%E7%9A%84%E6%98%AFPAM%E7%99%BB%E5%BD%95%E7%A8%8B%E5%BA%8F%EF%BC%8C%E8%80%8Csu%E5%91%BD%E4%BB%A4%E4%B8%AD%EF%BC%8C%E5%B9%B6%E6%B2%A1%E6%9C%89%E9%87%8D%E6%96%B0%E5%8A%A0%E8%BD%BDuser%20context%E7%9A%84%E5%8A%9F%E8%83%BD%E3%80%82%0ALinux%E7%94%A8%E6%88%B7%E7%99%BB%E5%BD%95%E5%90%8E%EF%BC%8C%E8%8E%B7%E5%8F%96shell%E5%AE%89%E5%85%A8%E4%B8%8A%E4%B8%8B%E6%96%87%E7%9A%84%E6%AD%A5%E9%AA%A4%EF%BC%8C%E5%8F%AF%E4%BB%A5%E5%8F%82%E8%80%83%E6%96%87%E7%8C%AE%E3%80%902%E3%80%91%E3%80%82%E7%AE%80%E8%BF%B0%E5%A6%82%E4%B8%8B%EF%BC%9A%0A1.%20%E6%A0%B9%E6%8D%AEseusers%E6%96%87%E4%BB%B6%EF%BC%8C%E6%98%A0%E5%B0%84SELinux%E7%94%A8%E6%88%B7%EF%BC%8C%E5%A6%82%E6%9E%9C%E6%B2%A1%E6%9C%89seusers%E6%96%87%E4%BB%B6%EF%BC%8C%E7%B3%BB%E7%BB%9F%E5%B0%B1%E6%97%A0%E6%B3%95%E5%90%AF%E5%8A%A8%E4%BA%86%E3%80%82%E5%A6%82%E6%9E%9Cseusers%E6%96%87%E4%BB%B6%E6%B2%A1%E6%9C%89%E5%AF%B9%E5%BA%94%E7%9A%84%E7%94%A8%E6%88%B7%E6%8F%8F%E8%BF%B0%EF%BC%8C%E5%88%99%E7%BB%9F%E4%B8%80%E6%98%A0%E5%B0%84%E4%B8%BA%60__default__%60%E7%94%A8%E6%88%B7%E3%80%82%E5%A6%82%E6%9E%9C%60__default__%60%E7%94%A8%E6%88%B7%E6%8F%8F%E8%BF%B0%E4%B8%8D%E5%AD%98%E5%9C%A8%EF%BC%8C%E5%88%99%E6%97%A0%E6%B3%95%E7%99%BB%E5%BD%95%E3%80%82%0A2.%20%E6%A0%B9%E6%8D%AESELinux%E7%9A%84%E6%90%9C%E7%B4%A2%E4%BC%98%E5%85%88%E7%BA%A7%EF%BC%8C%E6%89%BE%E5%88%B0%E5%AF%B9%E5%BA%94SELinux%E7%94%A8%E6%88%B7%E7%9A%84%E5%AE%89%E5%85%A8%E4%B8%8A%E4%B8%8B%E6%96%87%E3%80%82%0A%0A%3E%20**%E5%8B%98%E8%AF%AF**%0A%3E%20%E5%9C%A8%5B1%5D%E4%B8%AD%EF%BC%8C%E5%AF%B9Linux%E7%94%A8%E6%88%B7%E5%92%8CSELinux%E7%9A%84%E6%98%A0%E5%B0%84%E5%85%B3%E7%B3%BB%E6%9C%89%E5%A6%82%E4%B8%8B%E6%8F%8F%E8%BF%B0%EF%BC%9A%0A%3E%20On%20login%2C%20if%20there%20is%20an%20SELinux%20user%20identifier%20that%20is%20exactly%20the%20same%20as%20the%20Linux%20user%20identifier%2C%20the%20matching%20SELinux%20user%20identifier%20becomes%20the%20user%20identifier%20in%20the%20security%20context%20for%20the%20initial%20shell%20process.%20In%20this%20way%2C%20if%20a%20Linux%20user%20identifier%20also%20exists%20as%20a%20user%20identifier%20in%20the%20SELinux%20policy%2C%20all%20login%20processes%20will%20set%20the%20initial%20shell%20process%20security%20context%20user%20identifier%20to%20that%20matching%20Linux%20identity.%0A%3E%20%E7%BB%8F%E5%AE%9E%E9%AA%8C%E8%AF%81%E6%98%8E%EF%BC%8C%E5%B9%B6%E9%9D%9E%E5%A6%82%E6%AD%A4%EF%BC%9A%0A%3E%20-%20%E5%AE%9A%E4%B9%89%E4%BA%86%E4%B8%80%E4%B8%AAguest_u%E7%94%A8%E6%88%B7%EF%BC%8C%E7%99%BB%E5%BD%95%E5%90%8E%EF%BC%8C%E5%85%B6shell%E7%9A%84%E5%AE%89%E5%85%A8%E4%B8%8A%E4%B8%8B%E6%96%87%E4%BB%8D%E4%B8%BA%EF%BC%9A%0A%3E%20!%5B1ca6909a350aa84947ea565bb4c8eaa2.png%5D(evernotecid%3A%2F%2FACEAA21A-C764-4256-94C6-40CA536E96D7%2Fappyinxiangcom%2F161681%2FENResource%2Fp6434)%0A%3E%20-%20%E4%BD%86%E4%BA%8B%E5%AE%9E%E8%AF%81%E6%98%8E%EF%BC%8C%E6%98%8E%E6%98%8E%E5%B0%B1%E6%9C%89guest_u%E8%BF%99%E4%B8%AA%E7%94%A8%E6%88%B7%0A%3E%20!%5B7737fbc74190005733b9f01b60178907.png%5D(evernotecid%3A%2F%2FACEAA21A-C764-4256-94C6-40CA536E96D7%2Fappyinxiangcom%2F161681%2FENResource%2Fp6436)%0A%3E%20%E6%8E%A8%E6%B5%8B%EF%BC%8C%E5%8F%AF%E8%83%BD%E6%98%AF%E5%9B%A0%E4%B8%BASELinux%E4%B9%9F%E4%B8%80%E7%9B%B4%E5%9C%A8%E5%8F%91%E5%B1%95%E6%94%B9%E8%BF%9B%E4%B8%AD%E3%80%82%5B1%5Dd%20%E6%88%90%E4%B9%A6%E6%97%B6%E9%97%B4%E6%98%AF2006%E5%B9%B4%EF%BC%8C%E5%BD%BC%E6%97%B6%E8%BF%98%E6%98%AFFC%EF%BC%88Fedora%20Core%EF%BC%895%E7%9A%84%E5%B9%B4%E4%BB%A3%EF%BC%8C%E7%8E%B0%E5%9C%A8%E6%9C%80%E6%96%B0%E7%89%88%E5%B7%B2%E7%BB%8F%E6%98%AFFedora%2033%EF%BC%8C2020%E5%B9%B410%E6%9C%88%E4%BB%BD%E5%8F%91%E5%B8%83%E3%80%82%0A%0A%23%23%20%E6%80%BB%E7%BB%93%0A%E7%8E%B0%E5%9C%A8%E5%8F%AF%E4%BB%A5%E5%BC%95%E7%94%A8%5B1%5D%E4%B8%AD%E7%9A%84%E4%B8%80%E5%B9%85%E5%9B%BE%E6%9D%A5%E6%80%BB%E7%BB%93%E4%B8%80%E4%B8%8BRBAC%E7%9A%84%E5%B7%A5%E4%BD%9C%E5%8E%9F%E7%90%86%E4%BA%86%E3%80%82%0A!%5B115b4d2e2576fd1b93937d66425645d5.png%5D(evernotecid%3A%2F%2FACEAA21A-C764-4256-94C6-40CA536E96D7%2Fappyinxiangcom%2F161681%2FENResource%2Fp6373)%0A-%20Linux%E7%B3%BB%E7%BB%9F%E6%9C%89%E4%B8%80%E4%B8%AA%E7%94%A8%E6%88%B7%E8%BE%83joe%0A-%20SELinuxcelue%E4%B8%AD%E8%A7%84%E5%AE%9Ajoe%E5%92%8Cuser_r%E7%BB%91%E5%AE%9A%EF%BC%8Cuser_r%E5%92%8Cuser_t%E7%BB%91%E5%AE%9A%0A-%20%E5%BD%93joe%E7%99%BB%E5%BD%95%E6%97%B6%EF%BC%8C%E7%B3%BB%E7%BB%9F%E6%A0%B9%E6%8D%AEseusers%EF%BC%88%E6%AD%A4%E5%A4%84%E4%B8%8E%E5%9B%BE%E4%B8%8D%E5%90%8C%EF%BC%8C%E5%8F%82%E8%A7%81%E4%B8%8A%E4%B8%80%E7%AB%A0%E5%8B%98%E8%AF%AF%EF%BC%89%EF%BC%8C%E6%89%BE%E5%88%B0%E5%AF%B9%E5%BA%94%E7%9A%84SELinux%20user%EF%BC%8C%E6%89%BE%E4%B8%8D%E5%88%B0%E5%B0%B1%E6%98%AF__default__%2C%20__default__%E6%B2%A1%E6%9C%89%E5%B0%B1%E4%B8%8D%E8%83%BD%E7%99%BB%E5%BD%95%E4%BA%86%0A-%20%E6%A0%B9%E6%8D%AE%E4%BB%A5%E4%B8%8Bcontext%E6%96%87%E4%BB%B6%E9%A1%BA%E5%BA%8F%EF%BC%8C%E5%86%B3%E5%AE%9A%E5%85%B6shell%E7%9A%84%E5%AE%89%E5%85%A8%E4%B8%8A%E4%B8%8B%E6%96%87%EF%BC%8C%E5%8D%B3joe%3Auser_r%3Auser_t%0A%20%20%20%20-%20%2Fetc%2Fselinux%2Fspecified-policy%2Fcontexts%2Fusers%0A%20%20%20%20-%20%2Fetc%2Fselinux%2Fspecified-policy%2Fcontexts%2Fdefault_contexts%0A%20%20%20%20-%20%2Fetc%2Fselinux%2Fspecified-policy%2Fcontexts%2Ffailsafe_context%0A%20%20%20%20-%20sid%20kernel%E7%9A%84%E5%AE%89%E5%85%A8%E4%B8%8A%E4%B8%8B%E6%96%87%0A-%20joe%E6%89%A7%E8%A1%8C%E4%BA%86%E4%B8%80%E4%B8%AA%E5%BA%94%E7%94%A8%EF%BC%8C%E5%BC%80%E5%A7%8B%E8%BF%9B%E8%A1%8Cdomain_transition%2C%20%E8%A6%81%E4%BB%8Euser_t%E5%88%87%E6%8D%A2%E5%88%B0passwd_t%0A%20%20%20%20-%20%E5%A6%82%E6%9E%9C%E5%AE%9A%E4%B9%89%E4%BA%86%60role%20user_r%20types%20passwd_t%60%E5%92%8C%60role%20user_r%20types%20user_t%60%EF%BC%8C%E5%88%99%E8%BF%99%E6%AC%A1domain%20transition%E5%8F%AF%E4%BB%A5%E6%88%90%E5%8A%9F%0A%20%20%20%20-%20%E5%90%A6%E5%88%99%E4%BB%BB%E6%84%8F%E4%B8%80%E4%B8%AA%E6%9C%AA%E5%AE%9A%E4%B9%89%EF%BC%8Cdomain%20transition%E9%83%BD%E4%BC%9A%E5%A4%B1%E8%B4%A5%0A%0A%23%20%E9%AB%98%E9%98%B6%E7%94%A8%E6%B3%95%0A%23%23%20role_transition%0Arole%20transition%E5%92%8Cdomain%20transition%E9%9D%9E%E5%B8%B8%E7%B1%BB%E4%BC%BC%EF%BC%8C%E4%B9%9F%E6%98%AF%E5%9C%A8%E6%9F%90%E4%B8%AAdomain%E8%BF%9B%E7%A8%8B%E5%9C%A8%E6%89%A7%E8%A1%8C%E6%9F%90%E4%B8%AA%E5%8F%AF%E6%89%A7%E8%A1%8C%E6%96%87%E4%BB%B6%E6%97%B6%EF%BC%8C%E5%8D%B3exec%E7%B3%BB%E7%BB%9F%E8%B0%83%E7%94%A8%E6%97%B6%EF%BC%8C%E5%88%87%E6%8D%A2%E8%BF%9B%E7%A8%8B%E4%B8%BB%E4%BD%93%E7%9A%84%E5%AE%89%E5%85%A8%E4%B8%8A%E4%B8%8B%E6%96%87%E3%80%82domain%20transition%E5%88%87%E6%8D%A2%E7%9A%84%E6%97%B6domain%EF%BC%8Crole%20transtion%E5%88%87%E6%8D%A2%E7%9A%84%E6%98%AFrole%E3%80%82%E5%AE%9E%E7%8E%B0%E6%96%B9%E5%BC%8F%E9%80%9A%E8%BF%87%E4%BB%A5%E4%B8%8B%E4%B8%A4%E6%9D%A1%E8%AF%AD%E5%8F%A5%EF%BC%9A%0A%60%60%60%0Aallow%20staff_r%20sysadm_r%3B%20%23%20%E5%85%81%E8%AE%B8%E4%BB%8Estaff_r%E5%88%87%E6%8D%A2%E5%88%B0sysadm_r%0Arole_transition%20sysadm_r%20http_exec_t%20system_r%3B%20%23%20sysadm_r%E8%BF%9B%E7%A8%8B%E6%89%A7%E8%A1%8Chttp_exec_t%E7%B1%BB%E5%9E%8B%E6%96%87%E4%BB%B6%E6%97%B6%EF%BC%8Crole%E5%88%87%E6%8D%A2%E4%B8%BAsystem_r%0A%60%60%60%0A%23%23%20role_dominance%0A%E5%8F%AF%E4%BB%A5%E5%88%A9%E7%94%A8role%E6%9D%A5%E5%AE%9A%E4%B9%89%E5%85%B6%E4%BB%96role%EF%BC%8C%E5%8D%B3role%20dominance%E3%80%82%0A%60%60%60%0Adominance%20%7B%20role%20super_r%20%7Brole%20sysadm_r%3B%20role%20secadm_r%3B%20%7D%0A%60%60%60%0A%E4%B8%8A%E9%9D%A2%E4%BE%8B%E5%AD%90%E4%B8%AD%E7%9A%84super_r%E7%A7%B0%E4%B8%BAdominant%20role%EF%BC%8C%E5%AE%83%E5%8F%AF%E4%BB%A5%E4%BB%8E%E5%AE%83%E5%85%B3%E8%81%94%E7%9A%84role%E4%B8%AD%E5%8D%B3%E6%88%90types%E3%80%82%E4%BD%86%E5%AE%83%E5%8F%AA%E8%83%BD%E7%BB%A7%E6%89%BF%E8%AF%A5%E6%9D%A1%E8%AF%AD%E5%8F%A5%E4%B9%8B%E5%89%8D%E5%85%B3%E8%81%94%E7%9A%84types%E3%80%82%E6%88%91%E4%BB%AC%E4%B9%8B%E5%89%8D%E8%AF%B4role%E8%AF%AD%E5%8F%A5%E6%98%AF%E5%8F%AF%E4%BB%A5%E7%B4%AF%E7%A7%AF%E7%9A%84%E3%80%82%E9%82%A3%E4%B9%88%E5%9C%A8role_dominance%E8%AF%AD%E5%8F%A5%E4%B9%8B%E5%90%8E%E5%AE%9A%E4%B9%89%E7%9A%84types%EF%BC%8C%E5%B9%B6%E4%B8%8D%E8%83%BD%E5%8A%A8%E6%80%81%E7%9A%84%E6%B7%BB%E5%8A%A0%E5%88%B0dominant%20role%E4%B8%8A%E3%80%82%0A%23%20%E7%9B%B8%E5%85%B3%E5%B7%A5%E5%85%B7%0A%E8%B7%9Frole%E7%9B%B8%E5%85%B3%E7%9A%84%E4%B8%BB%E8%A6%81%E6%98%AFsemnage%E7%9A%84%E4%B8%80%E4%BA%9B%E7%94%A8%E6%B3%95%EF%BC%8C%E5%8F%A6%E5%A4%96%5B1%5D%E8%BF%98%E4%BB%8B%E7%BB%8D%E4%BA%86%E4%B8%80%E4%B8%AAapol%E7%9A%84%E5%8F%AF%E8%A7%86%E5%8C%96%E5%B7%A5%E5%85%B7%EF%BC%8C%E5%8F%AF%E4%BB%A5%E6%A3%80%E7%B4%A2user%E5%92%8Crole%E7%9A%84%E6%95%B0%E6%8D%AE%E3%80%82%E6%88%91%E7%90%86%E8%A7%A3semanage%E9%80%9A%E8%BF%87%E5%91%BD%E4%BB%A4%E8%A1%8C%E4%B9%9F%E9%83%BD%E5%8F%AF%E4%BB%A5%E5%AE%9E%E7%8E%B0%E3%80%82%0A1.%20%E5%89%8D%E6%96%87%E4%BB%8B%E7%BB%8D%E8%BF%87%E7%9A%84%60semanage%20user%20-l%60%E5%92%8C%60semanage%20login%20-l%60%2C%20%E5%89%8D%E8%80%85%E7%94%A8%E6%9D%A5%E6%9F%A5%E7%9C%8B%E6%89%80%E6%9C%89SELinux%E7%9A%84%E7%94%A8%E6%88%B7%EF%BC%8C%E5%90%8E%E8%80%85%E7%94%A8%E6%9D%A5%E6%9F%A5%E7%9C%8BLinux%E7%94%A8%E6%88%B7%E5%92%8CSELinux%E7%94%A8%E6%88%B7%E4%B8%A4%E8%80%85%E7%9A%84%E6%98%A0%E5%B0%84%E5%85%B3%E7%B3%BB.%0A2.%20Modify%20the%20default%20user%20on%20the%20system%20to%20the%20guest_u%20user%0A%20%20-%20%60semanage%20login%20-m%20-s%20guest_u%20__default__%60%0A3.%20%E4%BF%AE%E6%94%B9user%E5%92%8Crole%E7%9A%84%E5%AF%B9%E5%BA%94%E5%85%B3%E7%B3%BB%0A%20%20-%20%60semanage%20user%20-m%20-R%20%22message_filter_r%20unconfined_r%22%20user_u%60%0A4.%20%E6%B7%BB%E5%8A%A0%E4%B8%80%E4%B8%AA%E7%94%A8%E6%88%B7%E5%B9%B6%E6%8C%87%E5%AE%9ASELinux%E7%94%A8%E6%88%B7%0A%20%20-%20%60useradd%20joe%20-Z%20user_u%60%0A%0A%23%20%E5%8F%82%E8%80%83%E6%96%87%E7%8C%AE%0A%5B1%5D%20%5BSELinux%20by%20Example_%20Using%20Security%20Enhanced%20Linux%5D(https%3A%2F%2Fapp.yinxiang.com%2Fshard%2Fs10%2Fnl%2F161681%2Fea41e2f7-d7a8-4629-9f8c-c08696f578af%2F)%0A%5B2%5D%20%5BSELinux%E5%88%9D%E5%A7%8B%E5%8C%96%E7%99%BB%E5%BD%95%E7%94%A8%E6%88%B7%E5%AE%89%E5%85%A8%E4%B8%8A%E4%B8%8B%E6%96%87%E7%9A%84%E6%96%B9%E6%B3%95%5D(https%3A%2F%2Fblog.csdn.net%2Fkeheinash%2Farticle%2Fdetails%2F81047520)%0A