-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 01/03/2013 09:52 AM, richard -rw- weinberger wrote:
Hi!
On my CentOS6 test box I'm facing a strange problem. I'd like to have an
uid!=0 user which is mapped to the selinux sysadm_u user.
To achieve this I did "semanage login -a -s sysadm_u setest". But "runcon
-t sysadm_t -u sysadm_u -r sysadm_r /bin/bash" failed.
The transition got blocked for the following reason: type=AVC
msg=audit(1357223866.943:29): avc: denied { transition } for pid=1105
comm="runcon" path="/bin/bash" dev=dm-0 ino=130087
scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
tcontext=sysadm_u:sysadm_r:sysadm_t:s0-s0:c0.c1023 tclass=process
Using audit2allow I've created an allow rule to allow the transition.
---cut--- [root@selinuxbox ~]# cat sysadm.te
module sysadm 1.0;
require { type unconfined_t; type sysadm_t; class process transition; }
#============= unconfined_t ============== allow unconfined_t
sysadm_t:process transition; ---cut---
I've loaded the new rule using "semodule -i sysadm.pp".
---cut--- [root@selinuxbox ~]# sesearch --all | grep "allow unconfined_t
sysadm_t" allow unconfined_t sysadm_t : process { transition sigchld } ;
---cut---
As you can observe a transition from unconfined_t to sysadm_t is now
allowed. But runcon still fails and audit logs the same deny message. Also
audit2allow created exactly the same allow rule again.
What is preventing runcon to work?
Audit2allow is not always as smart as it could be.
It translates AVC denials into Type Enforcement rules, even if the problem is
a RBAC problem or an MCS/MLS problem
Most likely you are having an RBAC problem.
First you need a rule that says unconfined_r can become sysadm_r.
sesearch --role_allow | grep unconfined_r
allow staff_r unconfined_r;
allow unconfined_r system_r;
allow system_r unconfined_r;
Add
allow unconfined_r sysadm_r;
To your te file.
Next you probably need to fix you SELinux User to say it can reach the sysadmin_r.
# semanage user -l | grep unconfined_u
unconfined_u user s0 s0-s0:c0.c1023 system_r
webadm_r unconfined_r
# semanage user -m -R"system_r webadm_r unconfined_r sysadm_r" unconfined_u
Now I believe you could execute
runcon -r sysadm_r -t sysadmin_t /bin/sh
And it would run as
unconfined_u:sysadm_r:sysadm_t:s0-s0:c0.c1023
You might not need to do the semanage command if unconfined_t is allowed to
change SELinux user.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
Comment: Using GnuPG with undefined -
http://www.enigmail.net/
iEYEARECAAYFAlDlrKcACgkQrlYvE4MpobPb5wCbByn1e2D4glv/2cM+3+akZ7bH
baEAoIIWdujUmWjA1xuaCwNUvibnl5MT
=MiAo
-----END PGP SIGNATURE-----