sudo with SELinux support requires key handling
PATCH 1/1 sudo with SELinux support requires key handling
When using sudo with SELinux integrated support, the sudo domains need to be able to create user keys. Without this privilege, any command invoked like "sudo /etc/init.d/local status" will run within the sudo domain (sysadm_sudo_t) instead of the sysadm_t domain (or whatever domain is mentioned in the sudoers file).
--- policy/modules/admin/sudo.if | 1 + 1 files changed, 1 insertions(+), 0 deletions(-)
policy/modules/admin/sudo.if +1 -0
@@ -129,6 +129,7 @@ template(`sudo_role_template',` seutil_libselinux_linked($1_sudo_t) userdom_spec_domtrans_all_users($1_sudo_t) + userdom_create_all_users_keys($1_sudo_t) userdom_manage_user_home_content_files($1_sudo_t) userdom_manage_user_home_content_symlinks($1_sudo_t) userdom_manage_user_tmp_files($1_sudo_t)
Signature · 1 line
1.7.3.4
PATCH 1/1 sudo with SELinux support requires key handling
Quoted 14 lines · Sven Vermeulen
When using sudo with SELinux integrated support, the sudo domains need to be able to create user keys. Without this privilege, any command invoked like "sudo
/etc/init.d/localstatus" will run within the sudo domain (sysadm_sudo_t) instead of thesysadm_tdomain (or whatever domain is mentioned in the sudoers file).Signed-off-by Sven Vermeulen <[email protected]>--- policy/modules/admin/sudo.if | 1 + 1 files changed, 1 insertions(+), 0 deletions(-)policy/modules/admin/sudo.if +0
-0
policy/modules/admin/sudo.if template(`sudo_role_template',` · line 135
Quoted 7 lines
policy/modules/admin/sudo.if +1
-0@@ -129,6 +129,7 @@ template(`sudo_role_template',` seutil_libselinux_linked($1_sudo_t) userdom_spec_domtrans_all_users($1_sudo_t) + userdom_create_all_users_keys($1_sudo_t) userdom_manage_user_home_content_files($1_sudo_t) userdom_manage_user_home_content_symlinks($1_sudo_t) userdom_manage_user_tmp_files($1_sudo_t)
Merged.
Signature · 3 lines
Chris PeBenito Tresys Technology, LLC www.tresys.com | oss.tresys.com