RE: [gentoo-hardened] problems with newrole in enforcing mod

[Jansson Fredrik]

I should maybe add that I am ssh'ing into the box and that I am using
public key authentication on ssh. I am not sure it matters though.

/Fredrik

-----Original Message-----
From: Jansson Fredrik [mailto:Fredrik.Jansson@×××××××××××.com] 
Sent: den 24 juni 2004 20:07
To: gentoo-hardened@l.g.o
Subject: [gentoo-hardened] problems with newrole in enforcing mod

Hi!

I have a problem with newrole in enforcing mode. I have seen others
having the same problem when googling for it, but haven't seen any
solution to it.

I have a user (frja) who is in sysadm_r and staff_r:
/etc/security/selinux/src/policy/users:
	user frja roles { sysadm_r staff_r };

I have no problems switching to sysadm_r when in permissive mode, but in
enforcing mode I get:
$ newrole -r sysadm_r
Authenticating frja.
Password:
newrole: incorrect password for frja

dmesg:
avc:  denied  { siginh } for  pid=8009 exe=/usr/bin/newrole
scontext=frja:staff_r:staff_t tcontext=frja:staff_r:newrole_t
tclass=process

avc:  denied  { rlimitinh } for  pid=8009 exe=/usr/bin/newrole
scontext=frja:staff_r:staff_t tcontext=frja:staff_r:newrole_t
tclass=process

avc:  denied  { noatsecure } for  pid=8009 exe=/usr/bin/newrole
scontext=frja:staff_r:staff_t tcontext=frja:staff_r:newrole_t
tclass=process

avc:  denied  { siginh } for  pid=8010 exe=/sbin/unix_chkpwd
scontext=frja:staff_r:newrole_t tcontext=frja:staff_r:system_chkpwd_t
tclass=process

avc:  denied  { rlimitinh } for  pid=8010 exe=/sbin/unix_chkpwd
scontext=frja:staff_r:newrole_t tcontext=frja:staff_r:system_chkpwd_t
tclass=process

avc:  denied  { noatsecure } for  pid=8010 exe=/sbin/unix_chkpwd
scontext=frja:staff_r:newrole_t tcontext=frja:staff_r:system_chkpwd_t
tclass=process

avc:  denied  { read } for  pid=8010 exe=/sbin/unix_chkpwd name=urandom
dev=hda2 ino=164173 scontext=frja:staff_r:system_chkpwd_t
tcontext=system_u:object_r:urandom_device_t tclass=chr_file

avc:  denied  { search } for  pid=8010 exe=/sbin/unix_chkpwd name=var
dev=hda2 ino=912129 scontext=frja:staff_r:system_chkpwd_t
tcontext=system_u:object_r:var_t tclass=dir

avc:  denied  { dac_override } for  pid=8010 exe=/sbin/unix_chkpwd
capability=1 scontext=frja:staff_r:system_chkpwd_t
tcontext=frja:staff_r:system_chkpwd_t tclass=capability

avc:  denied  { dac_read_search } for  pid=8010 exe=/sbin/unix_chkpwd
capability=2 scontext=frja:staff_r:system_chkpwd_t
tcontext=frja:staff_r:system_chkpwd_t tclass=capability

avc:  denied  { dac_override } for  pid=8010 exe=/sbin/unix_chkpwd
capability=1 scontext=frja:staff_r:system_chkpwd_t
tcontext=frja:staff_r:system_chkpwd_t tclass=capability

avc:  denied  { dac_read_search } for  pid=8010 exe=/sbin/unix_chkpwd
capability=2 scontext=frja:staff_r:system_chkpwd_t
tcontext=frja:staff_r:system_chkpwd_t tclass=capability


In permissive mode newrole is successful and I still get in dmesg:
avc:  denied  { siginh } for  pid=8024 exe=/usr/bin/newrole
scontext=frja:staff_r:staff_t tcontext=frja:staff_r:newrole_t
tclass=process

avc:  denied  { rlimitinh } for  pid=8024 exe=/usr/bin/newrole
scontext=frja:staff_r:staff_t tcontext=frja:staff_r:newrole_t
tclass=process

avc:  denied  { noatsecure } for  pid=8024 exe=/usr/bin/newrole
scontext=frja:staff_r:staff_t tcontext=frja:staff_r:newrole_t
tclass=process

avc:  denied  { siginh } for  pid=8025 exe=/sbin/unix_chkpwd
scontext=frja:staff_r:newrole_t tcontext=frja:staff_r:system_chkpwd_t
tclass=process

avc:  denied  { rlimitinh } for  pid=8025 exe=/sbin/unix_chkpwd
scontext=frja:staff_r:newrole_t tcontext=frja:staff_r:system_chkpwd_t
tclass=process

avc:  denied  { noatsecure } for  pid=8025 exe=/sbin/unix_chkpwd
scontext=frja:staff_r:newrole_t tcontext=frja:staff_r:system_chkpwd_t
tclass=process

avc:  denied  { read } for  pid=8025 exe=/sbin/unix_chkpwd name=urandom
dev=hda2 ino=164173 scontext=frja:staff_r:system_chkpwd_t
tcontext=system_u:object_r:urandom_device_t tclass=chr_file

avc:  denied  { search } for  pid=8025 exe=/sbin/unix_chkpwd name=var
dev=hda2 ino=912129 scontext=frja:staff_r:system_chkpwd_t
tcontext=system_u:object_r:var_t tclass=dir

avc:  denied  { search } for  pid=8025 exe=/sbin/unix_chkpwd name=run
dev=hda2 ino=1205313 scontext=frja:staff_r:system_chkpwd_t
tcontext=system_u:object_r:var_run_t tclass=dir

avc:  denied  { dac_override } for  pid=8025 exe=/sbin/unix_chkpwd
capability=1 scontext=frja:staff_r:system_chkpwd_t
tcontext=frja:staff_r:system_chkpwd_t tclass=capability

avc:  denied  { siginh } for  pid=8026 exe=/bin/bash
scontext=frja:staff_r:newrole_t tcontext=frja:sysadm_r:sysadm_t
tclass=process

avc:  denied  { rlimitinh } for  pid=8026 exe=/bin/bash
scontext=frja:staff_r:newrole_t tcontext=frja:sysadm_r:sysadm_t
tclass=process

avc:  denied  { noatsecure } for  pid=8026 exe=/bin/bash
scontext=frja:staff_r:newrole_t tcontext=frja:sysadm_r:sysadm_t
tclass=process

But since it's not enforced it works.

So I guess my question is, why? I have tried to relabel the system a
couple of times, and it doesn't work.

I am pretty sure I am missing something obvious, but I am still a
SELinux newbie.

Best regards
Fredrik Jansson

--
gentoo-hardened@g.o mailing list


--
gentoo-hardened@g.o mailing list