Re: [gentoo-hardened] su and newrole do not work from normal user account

[Peter Buettner]

On Thu, 09 Sep 2004 12:28:23 -0400
Joshua Brindle <method@g.o> wrote:

> Richard Simpson wrote:
>
> >>-----Original Message-----
> >>From: Peter Buettner [mailto:pb@××××××××××××.de]
> >>Sent: Thursday, September 09, 2004 9:43 AM
> >>To: gentoo-hardened@l.g.o
> >>Subject: [gentoo-hardened] su and newrole do not work from normal user
> >>account
> >>
> >>
> >>Hello,
> >>
> >>I performed a stage1 install from the hardened gentoo CD.
> >>Installation works fine and without problems.
> >>
> >>But with the loaded policy it is not possible to do newrole -r or
> >>su - from normal user account.
> >>
> >
> >
> > I believe you would need to allow the role transition. See staff.te. The
> > default policy seems to only allow role transitions between staff and
> > sysadm. Rather than allowing a role transition to/from the unprivileged
> > user_r, it would be more secure to instead grant additional privileges to an
> > individual user, or create a new role with privileges applicable for a group
> > of users. See staff.te for ideas on this.
> >
> > Richard.
> >
> >
> > --
> > gentoo-hardened@g.o mailing list
> >
> >
>
> Role transition is not used anywhere in the Gentoo base policy and we do
> not recommend it's use unless you have very specific security goals that
> it can address, you are refering to role allows, and you are right,
> user_r does not have the ability to change roles to sysadm_r. Only
> staff_r can do this.

My problem is that staff_r can't do so.

Last login: Fri Sep 10 13:59:22 2004 from thor.personalwlan.de
sysop@access sysop $ id
uid=1000(sysop) gid=100(users) groups=10(wheel),100(users) context=sysop:staff_r:staff_t

sysop@access sysop $ su -
Password: 
su: Authentication failure
Sorry.

sysop@access sysop $ newrole -r sysadm_r
Authenticating sysop.
Password: 
newrole: incorrect password for sysop



 
Peter Büttner





> This is a specific design decision, you do not want your administrators
> to be user_r and have a user_home_dir_t home directory, you need to
> segment them from unprivileged users to keep their files, processes, etc
> seperate. The best example of why this is good is, for example, if a
> sysadmin logs in with user_r his ssh agent would be user_tmp_t. This is
> obviously a bad thing, if he logs in as staff_t then his ssh agent is
> staff_tmp_t which wouldn't be accessible at all by unprivileged users,
> even if they could bypass DAC.
>
> Joshua Brindle
>
> --
> gentoo-hardened@g.o mailing list
>


--
gentoo-hardened@g.o mailing list