2

We are migrating an application from Solaris to Linux and the main user is allowed, through the use of RBAC roles, to run a few system commands like svccfg/svcadm (chkconfig on redhat).

Is it possible, using only SElinux (no sudo), to allow a normal user to run chkconfig off/on (basically give it the ability to add remove services) ?

My approach was to try to create an SElinux user with a corresponding SElinux role that manages the app's domain/type and is allowed to transition to all other domains required to run chkconfig, tcpdump or any other system utility usually restricted to root access only. All my attempts so far have failed, so my second question would be where could I find good documentation that applies to this specific problem ?

2
  • May I ask why sudo isn't an option? Sep 3, 2012 at 19:14
  • If this can't be achieved solely by means of SELinux then we shall use sudo.
    – user126330
    Sep 3, 2012 at 19:26

3 Answers 3

2

The SELinux reference policy already contains a user role sysadm_r which (slightly) confines root when confined users are being used on the system (they are not by default).

It should be possible to design a user role which can start/stop services and no other admin tasks, based loosely on sysadm_r, though I've never had to do this before and so I hesitate to give you a line-by-line. As much as I hate to say it, this is a question I would probably take to the selinux mailing list.

0
1

Response received from selinux mailing list:

Not possible via SELinux alone, as presently we don't provide a way to grant capabilities that would not otherwise be granted, only to further restrict them. There were patches floated to support that kind of functionality but they were shouted down by the mob.

So you need to use something else (sudo or file caps or whatever) to first grant the capabilities, and then you can use SELinux to help lock down the user to only what is required. sudo does have SELinux support these days, both via command-line options and sudoers configuration.

1

It is surely possible to use SElinux to fulfil your request, and the config is supposed to be easy.

The step are:

  1. create a SElinux user with minimal terminal permission.
  2. create a system user and map the user to new created SElinux user.
  3. modify the SElinux user's additional role to let the user transition chkconfig_t.
  4. the system user was not able to run almost all the linux command because his permission is minimal, we can use sudo or newrole command to let the user transition to chkconfig_t domain if it needed. You can use system-config-selinux to create or modify the SElinux module.

I had used SElinux to confine a user only had permission to restart httpd and modified its configurations. But this, the user could do nothing.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy