-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 01/03/2013 09:52 AM, richard -rw- weinberger wrote:
> Hi!
>
> On my CentOS6 test box I'm facing a strange problem. I'd like to have an
> uid!=0 user which is mapped to the selinux sysadm_u user.
>
> To achieve this I did "semanage login -a -s sysadm_u setest". But "runcon
> -t sysadm_t -u sysadm_u -r sysadm_r /bin/bash" failed.
>
> The transition got blocked for the following reason: type=AVC
> msg=audit(1357223866.943:29): avc: denied { transition } for pid=1105
> comm="runcon" path="/bin/bash" dev=dm-0 ino=130087
> scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
> tcontext=sysadm_u:sysadm_r:sysadm_t:s0-s0:c0.c1023 tclass=process
>
> Using audit2allow I've created an allow rule to allow the transition.
> ---cut--- [root@selinuxbox ~]# cat sysadm.te
>
> module sysadm 1.0;
>
> require { type unconfined_t; type sysadm_t; class process transition; }
>
> #============= unconfined_t ============== allow unconfined_t
> sysadm_t:process transition; ---cut---
>
> I've loaded the new rule using "semodule -i sysadm.pp".
>
> ---cut--- [root@selinuxbox ~]# sesearch --all | grep "allow unconfined_t
> sysadm_t" allow unconfined_t sysadm_t : process { transition sigchld } ;
> ---cut---
>
> As you can observe a transition from unconfined_t to sysadm_t is now
> allowed. But runcon still fails and audit logs the same deny message. Also
> audit2allow created exactly the same allow rule again.
>
> What is preventing runcon to work?
>
Audit2allow is not always as smart as it could be.
It translates AVC denials into Type Enforcement rules, even if the problem is
a RBAC problem or an MCS/MLS problem
Most likely you are having an RBAC problem.
First you need a rule that says unconfined_r can become sysadm_r.
sesearch --role_allow | grep unconfined_r
allow staff_r unconfined_r;
allow unconfined_r system_r;
allow system_r unconfined_r;
Add
allow unconfined_r sysadm_r;
To your te file.
Next you probably need to fix you SELinux User to say it can reach the sysadmin_r.
# semanage user -l | grep unconfined_u
unconfined_u user s0 s0-s0:c0.c1023 system_r
webadm_r unconfined_r
# semanage user -m -R"system_r webadm_r unconfined_r sysadm_r" unconfined_u
Now I believe you could execute
runcon -r sysadm_r -t sysadmin_t /bin/sh
And it would run as
unconfined_u:sysadm_r:sysadm_t:s0-s0:c0.c1023
You might not need to do the semanage command if unconfined_t is allowed to
change SELinux user.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
Comment: Using GnuPG with undefined - http://www.enigmail.net/
iEYEARECAAYFAlDlrKcACgkQrlYvE4MpobPb5wCbByn1e2D4glv/2cM+3+akZ7bH
baEAoIIWdujUmWjA1xuaCwNUvibnl5MT
=MiAo
-----END PGP SIGNATURE-----
--
selinux mailing list
selinux@xxxxxxxxxxxxxxxxxxxxxxx
https://admin.fedoraproject.org/mailman/listinfo/selinux
