Re: [gentoo-hardened] semanage - ldap problem ?

[Chris PeBenito]

On Tue, 2007-07-31 at 11:43 +0200, julien.thomas@×××××××××××××.fr wrote:
> Hi.
> An a test implementation of SeLinux, I've tried to
> create a special account, admin, which should have right over the different
> severs of our tests.
>
> After classical configurations, I've tested the SeLinux part and I
> have problem with the semanage tool or at least the linux user mapping
> for this account,
> managed by pam-ldap :
>
> I want to give this account a sysadmin role so a mapping to sysadm_u with
>
> semanage login -a -s sysadm_u admin
>
> which result in the messages file by
> Jul 31 11:09:53 mv4 python: Successful:  modify selinux user mapping
> name=admin
> sename=sysadm_u old_sename=sysadm_u
>
>
> mv4 ~ # semanage login -l
>
> Login Name                SELinux User
>
> __default__               user_u
> admin                     sysadm_u
> root                      root
> system_u                  system_u
>
> mv4 ~ # semanage user -l
> SELinux User    SELinux Roles
>
> root            sysadm_r staff_r
> staff_u         sysadm_r staff_r
> sysadm_u        sysadm_r
> system_u        system_r
> user_u          user_r
>
> However, when I open a ssh connexion on the server, with this admin
> account, I still have a user_u:: context and, quite obviously a
> newrole -r sysadm_r is refused.
>
>
> admin@mv1 ~ $ secon
> user: user_u
> role: user_r
> type: user_t
> sensitivity:
> clearance:
> mls-range:
>
> However, with a direct identification on the server, I do not have any problem
>
>
> May be the problem is similar to the fact that upon connecting on the
> server directly with the root account, I have a context confirmation
> to perform while with a ssh connexion, the context is set to staff_r  ?
>
> I also have to precised that the seLinux context (sestatus -v) match
> the default context, as checked in the section "Trouble Logging in
> remotely"

You need to turn on the ssh_sysadm_login if you want to ssh in as
sysadm_r.

-- 
Chris PeBenito
<pebenito@g.o>
Developer,
Hardened Gentoo Linux
 
Public Key: http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xE6AF9243
Key fingerprint = B0E6 877A 883F A57A 8E6A  CB00 BC8E E42D E6AF 9243