Re: [gentoo-hardened] SELinux - Root and sudo commands denied

[Petre Rodan]

Hi,

On Sun, Jun 10, 2007 at 05:25:17PM +0200, Krzysztof Kozłowski wrote:
> On many "normal" sudo commands like:
>  - tail /var/log/messages (accessing logs)
>  - editing system files (/etc, /boot)
> i can see "denied" in /var/log/avc.log:
> --------------
> # tail /var/log/messages
> Jun 10 16:56:02 bambo audit(1181487362.824:1013): avc:  denied  {
> execute_no_trans } for  pid=24622 comm="sudo" name="tail" dev=sda5 ino=6264
> scontext=staff_u:staff_r:staff_sudo_t tcontext=system_u:object_r:bin_t tclass=file
> Jun 10 16:56:02 bambo audit(1181487362.824:1014): avc:  denied  { read } for
> pid=24622 comm="sudo" name="tail" dev=sda5 ino=6264
> scontext=staff_u:staff_r:staff_sudo_t tcontext=system_u:object_r:bin_t tclass=file
> Jun 10 16:59:02 bambo audit(1181487542.218:1015): avc:  denied  { read } for
> pid=24626 comm="tail" name="messages" dev=sda7 ino=178336
> scontext=staff_u:staff_r:staff_sudo_t tcontext=system_u:object_r:var_log_t
> tclass=file
> Jun 10 16:59:02 bambo audit(1181487542.218:1016): avc:  denied  { getattr }
> for  pid=24626 comm="tail" name="messages" dev=sda7 ino=178336
> scontext=staff_u:staff_r:staff_sudo_t tcontext=system_u:object_r:var_log_t
> tclass=file
> --------------
> # vi /boot/grub/grub.conf
> Jun 10 17:00:38 bambo audit(1181487638.555:1017): avc:  denied  { search } for
>  pid=24869 comm="vi" name="/" dev=sda1 ino=2
> scontext=staff_u:staff_r:staff_sudo_t tcontext=system_u:object_r:boot_t tclass=dir
> Jun 10 17:00:38 bambo audit(1181487638.571:1018): avc:  denied  { getattr }
> for  pid=24869 comm="vi" name="grub.conf" dev=sda1 ino=4040
> scontext=staff_u:staff_r:staff_sudo_t tcontext=system_u:object_r:boot_t
> tclass=file
> Jun 10 17:00:38 bambo audit(1181487638.659:1019): avc:  denied  { write } for
>  pid=24869 comm="vi" name="grub.conf" dev=sda1 ino=4040
> scontext=staff_u:staff_r:staff_sudo_t tcontext=system_u:object_r:boot_t
> tclass=file
> --------------
>
> Performing these tasks from root acount:
> --------------
> # vi /boot/grub/grub.conf
> Jun 10 17:16:28 bambo audit(1181488588.761:1083): avc:  denied  { read } for
> pid=25719 comm="ls" name="boot" dev=sda1 ino=14
> scontext=staff_u:staff_r:staff_t tcontext=system_u:object_r:boot_t tclass=lnk_file
> Jun 10 17:16:43 bambo audit(1181488603.486:1084): avc:  denied  { write } for
>  pid=25720 comm="vi" name="grub.conf" dev=sda1 ino=4040
> scontext=staff_u:staff_r:staff_t tcontext=system_u:object_r:boot_t tclass=file
> Jun 10 17:16:43 bambo audit(1181488603.486:1085): avc:  denied  { read } for
> pid=25720 comm="vi" name="grub.conf" dev=sda1 ino=4040
> scontext=staff_u:staff_r:staff_t tcontext=system_u:object_r:boot_t tclass=file
> Jun 10 17:16:43 bambo audit(1181488603.486:1086): avc:  denied  { write } for
>  pid=25720 comm="vi" name="grub" dev=sda1 ino=4017
> scontext=staff_u:staff_r:staff_t tcontext=system_u:object_r:boot_t tclass=dir
> --------------
>
> These are only examples - almost all my root/sudo actions are denied. Why?
> What settings or rules I have forgot? Should I explicitly allow
> "staff_t/staff_sudo_t" access to /boot, /var/log and other important places?
> I am searching for clues for many hours and "I still haven't found what I'm
> looking for...".

any reason why you don't `newrole -r sysadm_r; su -` ?

bye,
peter

-- 
petre rodan
<kaiowas@g.o>
Developer,
Hardened Gentoo Linux