On 01/29/2010 08:53 PM, Fernando Magro wrote:
Hi there,
I have fedora 11 installed and I'm running a program with root, but
need to drop priviledges to another user (xguest_u) and change to the
proper security context. When I tried to use simple tools like runcon
or newrole, I wasn't able to modify the context. I tried:
su -c 'runcon -c -t xguest_t -u xguest_u -r xguest_r -l s0
/usr/bin/id' unpriviledged-user-that-is-xguest_u
I always get permission denied. After checking /var/log/audit and
doing an audit2allow it pointed out:
allow unconfined_t xguest_t : process transition.
However, when I load the module, the problem continues... Any easy way
to run a program with another UID and another security context from
root/unconfined_t/unconfined_r?
I guess policycoreutils sandbox could be useful here. Or create a user
application domain policy.
With regard to what you are trying there are a few things you could try:
1. leave out the -u xguest_u. This could cause issues i believe. ( I
have had some weird issues in this regard which to me looked like ubac
side effects on a configuration with ubac disabled but i may be wrong )
2. you probably need a rule allowing role access for unconfined_r: allow
unconfined_r xguest_r; (looks for an SELINUX_ERR in audit.log)
3. You should probably also modify your unconfined_u selinux user
mapping to include the xguest_r role.
Unconfined user is not designed to transition to other user domains or
roles (except probably system_r).
I think it is probably best to create a user application domain. This
allows you to define policy that is tailor made to your applications
properties.
You could probably also extend or clone a policycoreutils sandbox to
meet the requirement of your application.
thanks!
--
selinux mailing list
selinux(a)lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/selinux