Allow su to get selinux mount info
PATCH 1/1 Allow su to get selinux mount info
While trying to authenticate using "su", the authentication fails with the following error:
~$ su -
su: Authentication service cannot retrieve authentication info
In the audit log, we notice the following denial (after disabling dontaudits):
type=AVC msg=audit(1376567915.011:8005): avc: denied { getattr } for pid=10640 comm="su" name="/" dev="selinuxfs" ino=1 scontext=staff_u:staff_r:staff_su_t tcontext=system_u:object_r:security_t tclass=filesystem
Allowing selinux_get_fs_mount() against $1_su_t is enough for su to succeed again.
This is probably specific to Gentoo so using an ifdef(distro_gentoo',...') block.
--- policy/modules/admin/su.if | 8 ++++++++ 1 file changed, 8 insertions(+)
policy/modules/admin/su.if +8 -0
@@ -91,6 +91,10 @@ template(`su_restricted_domain_template', ` miscfiles_read_localization($1_su_t) + ifdef(`distro_gentoo',` + selinux_get_fs_mount($1_su_t) + ') + ifdef(`distro_redhat',` # RHEL5 and possibly newer releases incl. Fedora auth_domtrans_upd_passwd($1_su_t)
@@ -233,6 +237,10 @@ template(`su_role_template',` userdom_use_user_terminals($1_su_t) userdom_search_user_home_dirs($1_su_t) + ifdef(`distro_gentoo',` + selinux_get_fs_mount($1_su_t) + ') + ifdef(`distro_redhat',` # RHEL5 and possibly newer releases incl. Fedora auth_domtrans_upd_passwd($1_su_t)
Signature · 1 line
1.8.1.5
PATCH 1/1 Allow su to get selinux mount info
Quoted 13 lines · Sven Vermeulen
While trying to authenticate using "su", the authentication fails with the following error:
~$ su -
su: Authentication service cannot retrieve authentication infoIn the audit log, we notice the following denial (after disabling dontaudits):
type=AVC msg=audit(1376567915.011:8005): avc: denied { getattr } for pid=10640 comm="su" name="/" dev="selinuxfs" ino=1 scontext=staff_u:staff_r:staff_su_t tcontext=system_u:object_r:security_t tclass=filesystem
Quoted 5 lines
Allowing
selinux_get_fs_mount()against $1_su_t is enough for su to succeed again.This is probably specific to Gentoo so using an ifdef(
distro_gentoo',...') block.
My suspicion is that this is from pam_unix.so, so is probably not specific to Gentoo. If so, we should probably use seutil_libselinux_linked(). This also made me think that we should consider making an authlogin interface, something like auth_use_pam_unix() so we can gather all these accesses that are due to the pam config, rather than having them scattered among the domains that use PAM.
Quoted 32 lines
Signed-off-by Sven Vermeulen <[email protected]>--- policy/modules/admin/su.if | 8 ++++++++ 1 file changed, 8 insertions(+)policy/modules/admin/su.if +8
-0@@ -91,6 +91,10 @@ template(`su_restricted_domain_template', ` miscfiles_read_localization($1_su_t) + ifdef(`distro_gentoo',` + selinux_get_fs_mount($1_su_t) + ') + ifdef(`distro_redhat',` # RHEL5 and possibly newer releases incl. Fedora auth_domtrans_upd_passwd($1_su_t)@@ -233,6 +237,10 @@ template(`su_role_template',` userdom_use_user_terminals($1_su_t) userdom_search_user_home_dirs($1_su_t) + ifdef(`distro_gentoo',` + selinux_get_fs_mount($1_su_t) + ') + ifdef(`distro_redhat',` # RHEL5 and possibly newer releases incl. Fedora auth_domtrans_upd_passwd($1_su_t)
Signature · 3 lines
Chris PeBenito Tresys Technology, LLC www.tresys.com | oss.tresys.com