0

I am trying to set-up SELinux in an Ubuntu Trusty server, who is an Amazon EC2 instance. I followed the Debian documentation about installing SELinux. The installation work well as seen by :

root@machine:~# sestatus

SELinux status: enabled

SELinuxfs mount: /sys/fs/selinux

SELinux root directory: /etc/selinux

Loaded policy name: default

Current mode: permissive

Mode from config file: permissive

Policy MLS status: enabled

Policy deny_unknown status: allowed

Max kernel policy version: 28

However, I have some problems with my context as a standard user with ssh I have the context : system_u:system_r:sysadm_t:SystemLow. I tested with root user, who is also system_u:system_r:sysadm_t:SystemLow.

root@ip-172-31-4-210:~# id -Z

system_u:system_r:sysadm_t:SystemLow

Since I can only join this server via SSH, I guess the problem come from that. Is their a boolean or a policy for allowing ssh login with unconfined_u context ?

EDIT 1 : I'm sorry I didn't give enough detail. What I want to do is just to set up SELinux for confining the process and deamon, I want my standard user to be able to sudo & be able to manage the system. Isn't root supposed to be in the context "unconfined_u" ? Why am I system_u ?

Output of semanage login -l:

Login Name SELinux User MLS/MCS Range Service

__default__ unconfined_u SystemLow-SystemHigh *

root unconfined_u SystemLow-SystemHigh *

system_u system_u SystemLow-SystemHigh *

ubuntu unconfined_u SystemLow-SystemHigh *

0

First of all you can check all SELinux booleans with:

getsebool -a

There you can check whether there is a boolean regarding this issue or not.

Another thing you can try is giving your user a different role with:

semanage login -a -s <role> <your_user>

Just make sure the role is the same as the root user (in this case system_u), but be aware of the security risks. You can always go back with:

semanage login -d <your_user>

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.