Allow a Linux account to read a tag named var_log_t

[LOEWENTHAL Sophie (EEAS-EXT)]

Hi everybody,

Can a tag named  var_log_t be assigned to Linux account instead of a Selinux user?

e.g I want the Linux account named logread to be able to read all files in /var/log(/.*)?

Or should a new Selinux be created with permission to read var_log_t, and this Selinux user be assigned to the Linux user logread?

O/S is CentOS, but imagine not too much difference from Fedora.

Best wishes,
Sophie

The views expressed are purely those of the writer and may not in any circumstances be regarded as stating an official position of the EEAS. Les avis exprimés n'engagent que leur auteur et ne peuvent en aucun cas être considérés comme une position officielle du SEAE.