Re: [gentoo-hardened] newrole -r selinux problem

[stanke]

Hello

Thanks for help, I solved my problem with user_r and sysadm_r it's
working ok now, but I have still problem with my cron,
Everything (probably)  usefull I can find in logs is.

Could please someone help me or show me the right way i should go.

Thank you

Sep 25 05:23:01 gentoo64 cron[24435]: (root) ENTRYPOINT FAILED
(crontabs/root)

Sep 25 05:21:53 gentoo64 audit(1159154513.832:8048): avc:  denied  {
search } for  pid=21140 comm="crontab" name="/" dev=dm-3 ino=2
ipaddr=16.14.42.166 scontext=tester:sysadm_r:sysadm_crontab_t
tcontext=system_u:object_r:unlabeled_t tclass=dir
Sep 25 05:21:53 gentoo64 audit(1159154513.832:8049): avc:  denied  {
write } for  pid=21140 comm="crontab" name="/" dev=dm-3 ino=2
ipaddr=16.14.42.166 scontext=tester:sysadm_r:sysadm_crontab_t
tcontext=system_u:object_r:unlabeled_t tclass=dir
Sep 25 05:21:53 gentoo64 audit(1159154513.832:8050): avc:  denied  {
add_name } for  pid=21140 comm="crontab" name="crontab.XXXX9WNbfG"
ipaddr=16.14.42.166 scontext=tester:sysadm_r:sysadm_crontab_t
tcontext=system_u:object_r:unlabeled_t tclass=dir
Sep 25 05:21:53 gentoo64 audit(1159154513.832:8051): avc:  denied  {
create } for  pid=21140 comm="crontab" name="crontab.XXXX9WNbfG"
ipaddr=16.14.42.166 scontext=tester:sysadm_r:sysadm_crontab_t
tcontext=tester:object_r:unlabeled_t tclass=file
Sep 25 05:21:53 gentoo64 audit(1159154513.832:8052): avc:  denied  {
associate } for  pid=21140 comm="crontab" name="crontab.XXXX9WNbfG"
ipaddr=16.14.42.166 scontext=tester:object_r:unlabeled_t
tcontext=system_u:object_r:unlabeled_t tclass=filesystem
Sep 25 05:21:53 gentoo64 audit(1159154513.832:8053): avc:  denied  {
setattr } for  pid=21140 comm="crontab" name="crontab.XXXX9WNbfG"
dev=dm-3 ino=58 ipaddr=16.14.42.166
scontext=tester:sysadm_r:sysadm_crontab_t
tcontext=system_u:object_r:unlabeled_t tclass=file
Sep 25 05:21:53 gentoo64 audit(1159154513.832:8054): avc:  denied  {
getattr } for  pid=21140 comm="crontab" name="crontab.XXXX9WNbfG"
dev=dm-3 ino=58 ipaddr=16.14.42.166
scontext=tester:sysadm_r:sysadm_crontab_t
tcontext=system_u:object_r:unlabeled_t tclass=file
Sep 25 05:21:53 gentoo64 audit(1159154513.844:8055): avc:  denied  {
write } for  pid=21140 comm="crontab" name="crontab.XXXX9WNbfG" dev=dm-3
ino=58 ipaddr=16.14.42.166 scontext=tester:sysadm_r:sysadm_crontab_t
tcontext=system_u:object_r:unlabeled_t tclass=file
Sep 25 05:22:02 gentoo64 audit(1159154522.949:8056): avc:  denied  {
read } for  pid=21140 comm="crontab" name="crontab.XXXX9WNbfG" dev=dm-3
ino=58 ipaddr=16.14.42.166 scontext=tester:sysadm_r:sysadm_crontab_t
tcontext=system_u:object_r:unlabeled_t tclass=file
Sep 25 05:22:02 gentoo64 audit(1159154522.949:8057): avc:  denied  {
remove_name } for  pid=21140 comm="crontab" name="crontab.XXXX9WNbfG"
dev=dm-3 ino=58 ipaddr=16.14.42.166
scontext=tester:sysadm_r:sysadm_crontab_t
tcontext=system_u:object_r:unlabeled_t tclass=dir
Sep 25 05:22:02 gentoo64 audit(1159154522.949:8058): avc:  denied  {
unlink } for  pid=21140 comm="crontab" name="crontab.XXXX9WNbfG"
dev=dm-3 ino=58 ipaddr=16.14.42.166
scontext=tester:sysadm_r:sysadm_crontab_t
tcontext=system_u:object_r:unlabeled_t tclass=file




Antoine Martin  wrote / napísal(a):
>>>> The policy does not allow a role transition from user_r to sysadm_r.
>>>> So thats why su can't work.
>>>>
>>>>
>>> The solution in this case is to make sure that when you login as root
>>> you get into sysadm_u:sysadm_r:sysadm_t or another context which does
>>> allow the transition to sysadm. Setting the default for ssh is fairly
>>> well documented.
>>>
>> Thanks for help could you please send me some link for manuals, i google
>> it (probably wrong) but i didn't found nothing usefull.
>>
> /etc/security/default_contexts
> is what you're looking for.
>
> Antoine
>
>

-- 
gentoo-hardened@g.o mailing list