Daniel J Walsh wrote: > One possible use case would be. I want to allow a user to login as > unconfined_t and only be able to become root as webadm_t through sudo. > > If webadm_t has setattr on /var/www, he can cp /bin/sh /var/www/sh, > chcon 4755 /var/www/sh, exit webadm_t and as unconfined_t become root > using /var/www/sh. Isn't this just a side effect of the 'unconfined' philosophy? I've always been taught (and taught others) that with proper MAC controls you can have as many setuid shells as you like. You already give all your trust to the user by giving him unconfined. Placing setuid controls in place is curing only (one of many) symptoms, not the cause. Michal Svoboda
Attachment:
pgp7ozB957vKG.pgp
Description: PGP signature
