Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We are migrating an application from Solaris to Linux and the main user is allowed, through the use of RBAC roles, to run a few system commands like svccfg/svcadm (chkconfig on redhat).

Is it possible, using only SElinux (no sudo), to allow a normal user to run chkconfig off/on (basically give it the ability to add remove services) ?

My approach was to try to create an SElinux user with a corresponding SElinux role that manages the app's domain/type and is allowed to transition to all other domains required to run chkconfig, tcpdump or any other system utility usually restricted to root access only. All my attempts so far have failed, so my second question would be where could I find good documentation that applies to this specific problem ?

share|improve this question
    
May I ask why sudo isn't an option? –  Kenny Rasschaert Sep 3 '12 at 19:14
    
If this can't be achieved solely by means of SELinux then we shall use sudo. –  Jimmy Sep 3 '12 at 19:26

3 Answers 3

It is surely possible to use SElinux to fulfil your request, and the config is supposed to be easy.

The step are:

  1. create a SElinux user with minimal terminal permission.
  2. create a system user and map the user to new created SElinux user.
  3. modify the SElinux user's additional role to let the user transition chkconfig_t.
  4. the system user was not able to run almost all the linux command because his permission is minimal, we can use sudo or newrole command to let the user transition to chkconfig_t domain if it needed. You can use system-config-selinux to create or modify the SElinux module.

I had used SElinux to confine a user only had permission to restart httpd and modified its configurations. But this, the user could do nothing.

share|improve this answer
up vote 1 down vote accepted

Response received from selinux mailing list:

Not possible via SELinux alone, as presently we don't provide a way to grant capabilities that would not otherwise be granted, only to further restrict them. There were patches floated to support that kind of functionality but they were shouted down by the mob.

So you need to use something else (sudo or file caps or whatever) to first grant the capabilities, and then you can use SELinux to help lock down the user to only what is required. sudo does have SELinux support these days, both via command-line options and sudoers configuration.

share|improve this answer

The SELinux reference policy already contains a user role sysadm_r which (slightly) confines root when confined users are being used on the system (they are not by default).

It should be possible to design a user role which can start/stop services and no other admin tasks, based loosely on sysadm_r, though I've never had to do this before and so I hesitate to give you a line-by-line. As much as I hate to say it, this is a question I would probably take to the selinux mailing list.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.