[gentoo-hardened] su command

[Bill McCarty]

Hi all,

I recently set up SELinux under Gentoo and find that SELinux is prohibiting 
ordinary users from running su. Is this intentional? Since I generally 
prohibit root logins via SSH, access to su is important to me; I cannot 
otherwise administer the system remotely.

I'm using pam-0.77, which is the version that I understand to be 
SELinux-compliant. The users have context user_u:user_r:user_t and the su 
executable has context system_u:object_r:su_exec_t. Where else might I look 
for a possible error in my configuration?

The possibility that makes me most anxious is that I may have too recent a 
version of some ebuild that should be security-aware. I find setting 
ACCEPT_KEYWORDS="~x86" a bit scary <g>. Is there a list of known good 
ebuild versions, or should I check the Changelog of each ebuild?

Thanks for any suggestions!

Cheers,

---------------------------------------------------
Bill McCarty


--
gentoo-hardened@g.o mailing list