On 06/12/2010 07:36 PM, Guido Trentalancia wrote:
Hello everybody !
I am logging as root on a remote MLS machine using ssh so the default
role is staff_r. However, I need to execute ps (to display all system
processes, "ps -ax") over ssh. Unfortunately, ps does not show all
processes that are normally displayed when using the sysadm_r role
because it runs in the staff_r role.
What would be the safest way to allow ps over ssh to show all processes
running on the system ?
Thanks for your help.
Guido
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@xxxxxxxxxxxxx with
the words "unsubscribe selinux" without quotes as the message.
If you want to allow staff this, you need to add
mls_file_read_to_clearance(staff_t)
And make sure staff_t has SystemLow-SystemHigh
Or if you want to be more specific you could add a new constraint, like
the one in MCS
mlsconstrain file { read ioctl lock execute execute_no_trans }
(( h1 dom h2 ) or ( t1 == mcsreadall ) or ( t2 == domain ));
And then allow staff_t to read all process files but no others.
Or turn on the
ssh_sysadm_login boolean
and log in
ssh dwalsh/sysadm_r@remotehost
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@xxxxxxxxxxxxx with
the words "unsubscribe selinux" without quotes as the message.
