diff --git a/refpolicy/policy/modules/admin/su.if b/refpolicy/policy/modules/admin/su.if index 6dc5216e..d86b4c13 100644 --- a/refpolicy/policy/modules/admin/su.if +++ b/refpolicy/policy/modules/admin/su.if @@ -1,5 +1,26 @@ ## Run shells with substitute user and group +####################################### +## +## The per user domain template for the su module. +## +## +##

+## This template creates a derived domain which is allowed +## to change the linux user id, to run shells as a different +## user. +##

+##

+## This template is invoked automatically for each user, and +## generally does not need to be invoked directly +## by policy writers. +##

+##
+## +## The prefix of the user domain (e.g., user +## is the prefix for user_t). +## +# template(`su_per_userdomain_template',` type $1_su_t;