Re: [gentoo-hardened] SELinux - Root and sudo commands denied

[Petre Rodan]

Hi,

On Sun, Jun 10, 2007 at 06:47:38PM +0200, Krzysztof Kozłowski wrote:
> Petre Rodan wrote:
> > any reason why you don't `newrole -r sysadm_r; su -` ?
> Thanks for reply. "newrole" helped for root commands but not for sudo. Maybe
> it is problem only with sudo.
> $ newrole -r sysadm_r
> $ id -Z
> staff_u:sysadm_r:sysadm_t
> $ sudo vi /etc/fstab
> Jun 10 18:44:25 bambo audit(1181493865.029:1274): avc:  denied  { write } for
>  pid=30018 comm="vi" name="fstab" dev=sda5 ino=52674
> scontext=staff_u:sysadm_r:sysadm_sudo_t tcontext=system_u:object_r:etc_t
> tclass=file
> Jun 10 18:44:25 bambo audit(1181493865.029:1275): avc:  denied  { write } for
>  pid=30018 comm="vi" name="etc" dev=sda5 ino=52209
> scontext=staff_u:sysadm_r:sysadm_sudo_t tcontext=system_u:object_r:etc_t
> tclass=dir

looking at the policy, only the reading of etc files is allowed to sysadm_sudo_t.

I asked why you're not using 'su -' for two reasons

 - you're opening up a pandora's box here because I'm sure one can be very imaginative of what can be run thru sudo and not be allowed by the policy
 - a misconfigured or broken sudo greatly weakens the security of a system by possibly allowing privilege escalation, so why even install it?

bye,
peter


-- 
petre rodan
<kaiowas@g.o>
Developer,
Hardened Gentoo Linux