Adding sudo_db_t type for sudo timestamp database/directory
PATCH 1/3 Adding sudo_db_t type for sudo timestamp database/directory
The sudo application uses /var/db/sudo to keep track of sudo timestamps (to find out if sudo wants to ask the user to reauthenticate or not).
I have found the same policy rules in fedora's repository (commit d46a2b01151fd5061cdecd4004dc5993225c053d by Dan Walsh) but couldn't find any direct mail on the refpolicy archives with a request to push this through.
This is patch 1/3 which defines the type
--- policy/modules/admin/sudo.te | 3 +++ 1 files changed, 3 insertions(+), 0 deletions(-)
policy/modules/admin/sudo.te +3 -0
@@ -7,3 +7,6 @@ attribute sudodomain; type sudo_exec_t; application_executable_file(sudo_exec_t) + +type sudo_db_t; +files_type(sudo_db_t)
Signature · 1 line
1.7.3.4
PATCH 1/3 Adding sudo_db_t type for sudo timestamp database/directory
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Quoted 19 lines · Sven Vermeulen
The sudo application uses
/var/db/sudoto keep track of sudo timestamps (to find out if sudo wants to ask the user to reauthenticate or not).I have found the same policy rules in fedora's repository (commit
d46a2b01151fd5061cdecd4004dc5993225c053dby Dan Walsh) but couldn't find any direct mail on the refpolicy archives with a request to push this through.This is patch 1/3 which defines the type
Signed-off-by Sven Vermeulen <[email protected]>--- policy/modules/admin/sudo.te | 3 +++ 1 files changed, 3 insertions(+), 0 deletions(-)policy/modules/admin/sudo.te +0
-0
policy/modules/admin/sudo.te attribute sudodomain; · line 12
Quoted 6 lines
policy/modules/admin/sudo.te +3
-0@@ -7,3 +7,6 @@ attribute sudodomain; type sudo_exec_t; application_executable_file(sudo_exec_t) + +type sudo_db_t; +files_type(sudo_db_t)
I handled this in a different way:
authlogin.fc:
# Fedoras sudo moved from run to db, not sure if pam is still involved.
/var/run/sudo(/.*)? gen_context(system_u:object_r:pam_var_run_t,s0)
/var/db/sudo(/.*)? gen_context(system_u:object_r:pam_var_run_t,s0)
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.16 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
iEYEARECAAYFAk1Oz9AACgkQMlxVo39jgT/LjgCgzcTT2tOwkBsUDsLsL/2cELmt OTYAoLI8SnGwtsk3Yqs8KfZJwL9nw0Op
=2Vb8
-----END PGP SIGNATURE-----
PATCH 1/3 Adding sudo_db_t type for sudo timestamp database/directory
On Sun, Feb 06, 2011 at 05:44:00PM +0100, Dominick Grift wrote:
[... snip introducing a new type for /var/db/sudo ...]
Quoted 7 lines
I handled this in a different way:
authlogin.fc:
# Fedoras sudo moved from run to db, not sure if pam is still involved.
/var/run/sudo(/.*)?gen_context(system_u:object_r:pam_var_run_t,s0)
/var/db/sudo(/.*)?gen_context(system_u:object_r:pam_var_run_t,s0)
Fair enough; /var/db/sudo is indeed the new target but for exactly the same functionality. See also http://www.sudo.ws/repos/sudo/rev/8c9440423d98
I'll resubmit a new patch for this. Thanks for the feedback.
Wkr,
Sven Vermeulen
PATCH v2 1/1 Sudo timestamp directory has changed since v1.7.4, reflect this in .fc file
In reply to Dominick GriftSince sudo 1.7.4, the timestamp directory has moved from /var/run/sudo to /var/db/sudo, lib or adm (in that order). See also the sudo changeset
http://www.sudo.ws/repos/sudo/rev/8c9440423d98
Keeping the "old" one (/var/run/sudo) for a while for those systems where sudo has not been updated yet (change is since 1.7.4, Jul 14 2010).
--- policy/modules/system/authlogin.fc | 1 + 1 files changed, 1 insertions(+), 0 deletions(-)
policy/modules/system/authlogin.fc +1 -0
@@ -43,3 +43,4 @@ ifdef(`distro_gentoo', ` /var/run/pam_ssh(/.*)? gen_context(system_u:object_r:var_auth_t,s0) /var/run/sepermit(/.*)? gen_context(system_u:object_r:pam_var_run_t,s0) /var/run/sudo(/.*)? gen_context(system_u:object_r:pam_var_run_t,s0) +/var/(db|lib|adm)/sudo(/.*)? gen_context(system_u:object_r:pam_var_run_t,s0)
Signature · 1 line
1.7.3.4
PATCH v2 1/1 Sudo timestamp directory has changed since v1.7.4, reflect this in .fc file
Quoted 7 lines · Sven Vermeulen
Since sudo 1.7.4, the timestamp directory has moved from
/var/run/sudoto/var/db/sudo, lib or adm (in that order). See also the sudo changeset
http://www.sudo.ws/repos/sudo/rev/8c9440423d98Keeping the "old" one (
/var/run/sudo) for a while for those systems where sudo has not been updated yet (change is since 1.7.4, Jul 14 2010).
Merged.
Quoted 14 lines
Signed-off-by Sven Vermeulen<[email protected]>--- policy/modules/system/authlogin.fc | 1 + 1 files changed, 1 insertions(+), 0 deletions(-)policy/modules/system/authlogin.fc +1
-0@@ -43,3 +43,4 @@ ifdef(`distro_gentoo', ` /var/run/pam_ssh(/.*)? gen_context(system_u:object_r:var_auth_t,s0) /var/run/sepermit(/.*)? gen_context(system_u:object_r:pam_var_run_t,s0) /var/run/sudo(/.*)? gen_context(system_u:object_r:pam_var_run_t,s0) +/var/(db|lib|adm)/sudo(/.*)? gen_context(system_u:object_r:pam_var_run_t,s0)
Signature · 3 lines
Chris PeBenito Tresys Technology, LLC www.tresys.com | oss.tresys.com