Re: [gentoo-hardened] SELinux - Root and sudo commands denied

[Brant Williams]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


Correct me if I'm wrong, but wouldn't one of the main points of running 
SELinux be to get away from the "root" user and su/sudo/setuid/setgid?  
I'd think one could edit /etc/fstab if the role permitted it... why not 
configure a role to allow editing of [certain] system files?


Public GPG/PGP key for Brant Williams: 0x88E1AA9E.
Available at your friendly local public keyserver.



On Sun, 10 Jun 2007, Krzysztof Koz~Bowski wrote:

> Petre Rodan wrote:
> >  - you're opening up a pandora's box here because I'm sure one can be very imaginative of what can be run thru sudo and not be allowed by the policy
> So you are saying that with "su" the sysadmin cannot run all possible
> commands? For example - I have to edit /etc/fstab. So I have two choices:
> $ newrole -r sysadm
> $ su -
> # vi /etc/fstab
> (or "$ su - -c 'vi /etc/fstab'")
> or
> $ newrole -r sysadm // or something else
> $ sudo vi /etc/fstab
>
> And the first choice is better from security point of view? For me it looks
> like that policies for "su" and "sudo" will be similar in such examples. Am I
> wrong? Is there another /better/ way for running one command as root?
>
>
> >  - a misconfigured or broken sudo greatly weakens the security of a system by possibly allowing privilege escalation, so why even install it?
> One simple reason is that it is an easy way to log root commands (when of
> course the sysadmin wants it to be logged, e.g. he don't type "sudo bash" or
> something).
>
>
>
>
> --
> Krzysztof Kozłowski
> http://www.kozik.net.pl
>
>
> --
> gentoo-hardened@g.o mailing list
>
>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (GNU/Linux)

iD8DBQFGbJosYfOV94jhqp4RAp/AAJ9itE2QJkxTd8kc8u2CIzqt7k/suACdHeet
pt+15Q/uORMUYrFrQq7Sv5M=
=houh
-----END PGP SIGNATURE-----