Re: [gentoo-hardened] SELinux - Root and sudo commands denied

[Petre Rodan]

hi,

On Sun, Jun 10, 2007 at 07:41:16PM -0500, Brant Williams wrote:
>
> Correct me if I'm wrong, but wouldn't one of the main points of running
> SELinux be to get away from the "root" user and su/sudo/setuid/setgid?
> I'd think one could edit /etc/fstab if the role permitted it...

you still need uid=0 in order to modify a file owned by root. reaching uid=0 was the subject our discussion.

> why not
> configure a role to allow editing of [certain] system files?

yup, let's call it sysadm_r. 


bye,
peter

> On Sun, 10 Jun 2007, Krzysztof Koz�~Bowski wrote:
>
> > Petre Rodan wrote:
> > >  - you're opening up a pandora's box here because I'm sure one can be very imaginative of what can be run thru sudo and not be allowed by the policy
> > So you are saying that with "su" the sysadmin cannot run all possible
> > commands? For example - I have to edit /etc/fstab. So I have two choices:
> > $ newrole -r sysadm
> > $ su -
> > # vi /etc/fstab
> > (or "$ su - -c 'vi /etc/fstab'")
> > or
> > $ newrole -r sysadm // or something else
> > $ sudo vi /etc/fstab
> >
> > And the first choice is better from security point of view? For me it looks
> > like that policies for "su" and "sudo" will be similar in such examples. Am I
> > wrong? Is there another /better/ way for running one command as root?
> >
> >
> > >  - a misconfigured or broken sudo greatly weakens the security of a system by possibly allowing privilege escalation, so why even install it?
> > One simple reason is that it is an easy way to log root commands (when of
> > course the sysadmin wants it to be logged, e.g. he don't type "sudo bash" or
> > something).
> >
> >
> >
> >
> > --
> > Krzysztof Kozłowski
> > http://www.kozik.net.pl
> >
> >
> > --
> > gentoo-hardened@g.o mailing list
> >
> >


-- 
petre rodan
<kaiowas@g.o>
Developer,
Hardened Gentoo Linux