[gentoo-hardened] SELinux - Root and sudo commands denied

[Krzysztof Kozłowski]

On many "normal" sudo commands like:
 - tail /var/log/messages (accessing logs)
 - editing system files (/etc, /boot)
i can see "denied" in /var/log/avc.log:
--------------
# tail /var/log/messages
Jun 10 16:56:02 bambo audit(1181487362.824:1013): avc:  denied  {
execute_no_trans } for  pid=24622 comm="sudo" name="tail" dev=sda5 ino=6264
scontext=staff_u:staff_r:staff_sudo_t tcontext=system_u:object_r:bin_t tclass=file
Jun 10 16:56:02 bambo audit(1181487362.824:1014): avc:  denied  { read } for
pid=24622 comm="sudo" name="tail" dev=sda5 ino=6264
scontext=staff_u:staff_r:staff_sudo_t tcontext=system_u:object_r:bin_t tclass=file
Jun 10 16:59:02 bambo audit(1181487542.218:1015): avc:  denied  { read } for
pid=24626 comm="tail" name="messages" dev=sda7 ino=178336
scontext=staff_u:staff_r:staff_sudo_t tcontext=system_u:object_r:var_log_t
tclass=file
Jun 10 16:59:02 bambo audit(1181487542.218:1016): avc:  denied  { getattr }
for  pid=24626 comm="tail" name="messages" dev=sda7 ino=178336
scontext=staff_u:staff_r:staff_sudo_t tcontext=system_u:object_r:var_log_t
tclass=file
--------------
# vi /boot/grub/grub.conf
Jun 10 17:00:38 bambo audit(1181487638.555:1017): avc:  denied  { search } for
 pid=24869 comm="vi" name="/" dev=sda1 ino=2
scontext=staff_u:staff_r:staff_sudo_t tcontext=system_u:object_r:boot_t tclass=dir
Jun 10 17:00:38 bambo audit(1181487638.571:1018): avc:  denied  { getattr }
for  pid=24869 comm="vi" name="grub.conf" dev=sda1 ino=4040
scontext=staff_u:staff_r:staff_sudo_t tcontext=system_u:object_r:boot_t
tclass=file
Jun 10 17:00:38 bambo audit(1181487638.659:1019): avc:  denied  { write } for
 pid=24869 comm="vi" name="grub.conf" dev=sda1 ino=4040
scontext=staff_u:staff_r:staff_sudo_t tcontext=system_u:object_r:boot_t
tclass=file
--------------

Performing these tasks from root acount:
--------------
# vi /boot/grub/grub.conf
Jun 10 17:16:28 bambo audit(1181488588.761:1083): avc:  denied  { read } for
pid=25719 comm="ls" name="boot" dev=sda1 ino=14
scontext=staff_u:staff_r:staff_t tcontext=system_u:object_r:boot_t tclass=lnk_file
Jun 10 17:16:43 bambo audit(1181488603.486:1084): avc:  denied  { write } for
 pid=25720 comm="vi" name="grub.conf" dev=sda1 ino=4040
scontext=staff_u:staff_r:staff_t tcontext=system_u:object_r:boot_t tclass=file
Jun 10 17:16:43 bambo audit(1181488603.486:1085): avc:  denied  { read } for
pid=25720 comm="vi" name="grub.conf" dev=sda1 ino=4040
scontext=staff_u:staff_r:staff_t tcontext=system_u:object_r:boot_t tclass=file
Jun 10 17:16:43 bambo audit(1181488603.486:1086): avc:  denied  { write } for
 pid=25720 comm="vi" name="grub" dev=sda1 ino=4017
scontext=staff_u:staff_r:staff_t tcontext=system_u:object_r:boot_t tclass=dir
--------------

These are only examples - almost all my root/sudo actions are denied. Why?
What settings or rules I have forgot? Should I explicitly allow
"staff_t/staff_sudo_t" access to /boot, /var/log and other important places?
I am searching for clues for many hours and "I still haven't found what I'm
looking for...".




Some detailed info:

Gentoo profile: /usr/portage/profiles/selinux/x86/2006.1
sec-policy/selinux-base-policy-20070329
--------------
# sestatus
SELinux status:                 enabled
SELinuxfs mount:                /selinux
Current mode:                   permissive
Mode from config file:          permissive
Policy version:                 21
Policy from config file:        strict
--------------
# semodule -l
clamav          1.2.1
gpm             1.2.1
logrotate       1.4.0
logwatch        1.3.1
munin           1.1.1
mysql           1.3.1
readahead       1.3.0
samba           1.4.3
slocate         1.3.1
smartmon        1.1.1
sudo            1.0.2
sxid            1.1.0
tmpreaper       1.2.0
unconfined      1.5.2
usbmodules      1.1.0
--------------
emerge --info can be found at:
http://www.kozik.net.pl/tmp/bambo-emerge.info.txt

Sudo commands are run from user with "context=staff_u:staff_r:staff_t"
(staff_u has roles "sysadm_r staff_r").


-- 
Krzysztof Kozłowski
http://www.kozik.net.pl


-- 
gentoo-hardened@g.o mailing list