1 |
On Sat, Nov 26, 2011 at 10:00:01PM -0700, Stan Sander wrote: |
2 |
> After doing some more searching, reading, and educating of myself I have |
3 |
> been able to achieve the behavior I was wanting from the su command, |
4 |
> namely change my regular Linux uid to 0 and be able to launch graphical |
5 |
> programs if necessary when logged in to a desktop session. What I |
6 |
> discovered leaves my SELinux user id set to the user I originally logged |
7 |
> in as, which from a security and accountability standpoint is not a bad |
8 |
> thing, but the role and type are updated so all the transitions needed |
9 |
> for the policy to function as intended can occur. However, my Linux uid |
10 |
> is 0 so things that need that work. Probably a simple concept for all |
11 |
> you seasoned SELinux folk, but wanted to document it here for the |
12 |
> benefit of others who may find this in the archives. |
13 |
> |
14 |
> My answer -- removing the calls to pam_selinux.so from the su file in |
15 |
> pam.d and also removing the calls to pam_xauth.so from the su and |
16 |
> newrole files. These (xauth) generated avc denials when they couldn't |
17 |
> access root's home area at /root due to (I think) ubac constraints. |
18 |
> The last step a very simple script I called sesu |
19 |
> |
20 |
> #!/bin/bash |
21 |
> echo -n "X server: " |
22 |
> xhost local:localhost |
23 |
> echo -n "Enter root " |
24 |
> su -c "echo -n \"Enter current user \" && newrole -r sysadm_r" |
25 |
> |
26 |
> If your PAM config doesn't allow the current user to su, then they get |
27 |
> permission denied. |
28 |
> If SELinux doesn't allow the current user to transition to a sysadm_r |
29 |
> then you get a root shell, but with limited capability. |
30 |
|
31 |
Hi Stan, |
32 |
|
33 |
This isn't really the way it is meant to resolve. From your denials, I |
34 |
gather that you were still running in staff_r role. You need to transition |
35 |
to sysadm_r role first and then try to perform your administrative tasks. |
36 |
|
37 |
Wkr, |
38 |
Sven Vermeulen |