<html>
<head>
<style>
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 10pt;
font-family:Verdana
}
</style>
</head>
<body class='hmmessage'>
This seems to be a bit complicated.<br>As a start I'm trying to create new role and new types, I want the new role to be accessed by unconfined_r, having problem since my last email:<br>Compiling targeted new module<br>/usr/bin/checkmodule: loading policy configuration from tmp/new.tmp<br>new.te":6:ERROR 'unknown role unconfined_r' at token ';' on line 3189:<br>allow unconfined_r new_r; <br>role new_r types example_t;<br>/usr/bin/checkmodule: error(s) encountered while parsing configuration<br>make: *** [tmp/new.mod] Error 1<br><br>the file used: new.te<br>policy_module(new, 0.0.1)<br><br>role new_r;<br>type example_t;<br>role new_r types example_t;<br>allow unconfined_r new_r; <br> (both allow or role causing the same problem).<br><br><br><br>> Subject: Re: su or sudo from unconfined user to confined user<br>> From: sds@tycho.nsa.gov<br>> To: domg472@gmail.com<br>> CC: mrowais@hotmail.com; fedora-selinux-list@redhat.com<br>> Date: Tue, 23 Jun 2009 12:20:38 -0400<br>> <br>> On Tue, 2009-06-23 at 17:17 +0200, Dominick Grift wrote:<br>> > It is possible i think yes.<br>> <br>> I could be wrong, but I think the original poster wanted a way he could<br>> switch to another user's security context in its entirety using su or<br>> sudo. Which today we do not support.<br>> <br>> The original (and current) view is that the SELinux user field should<br>> only get set when a session is created, and only role, type, and level<br>> can change within a session and only then if within the authorized roles<br>> and levels for the user. That bounds access escalation within a login<br>> session. su doesn't affect the SELinux security context, and<br>> newrole/sudo are limited to changing role, type, or level.<br>> <br>> In early Fedora and RHEL 4, there was support for switching the entire<br>> security context upon su, but that was removed. To re-instate it, you<br>> would need to do two things:<br>> 1) Add the necessary policy rules to allow su to switch the entire<br>> context. Look at the rules under an ifdef distro_rhel4 in su.if in the<br>> refpolicy for example. You could add those as a local policy module<br>> rather than rebuilding the base policy.<br>> 2) Add pam_selinux entries to /etc/pam.d/su. Look in /etc/pam.d/login<br>> for an example of how to do so.<br>> <br>> And I can't guarantee it will still work, as no one uses it that way<br>> anymore.<br>> <br>> > As far as i know there are two requirements (example unconfined_r to<br>> > confined_r)<br>> > <br>> > 1. Your SELinux User must be mapped to both roles.<br>> > semanage user -a -L s0 -r s0-s0 -R "unconfined_r confined_r" -P user<br>> > special_u<br>> > <br>> > 2. Your source role must have access to your target role<br>> > allow unconfined_r confined_r;<br>> > <br>> > (also make default context in /etc/selinux/targeted/contexts/users for<br>> > special_u)<br>> > <br>> > The reason that this is supported by default is because it does not make<br>> > sense to transition from a unconfined domain to a confined domain. It<br>> > defeats the purpose of the unconfined domain.<br>> > <br>> > Unconfined environments are used by processes that are exempted from<br>> > much of the policy enforcement.<br>> > <br>> > In rare cases unconfined domain transition to restricted domains. For<br>> > example: one can toggle a boolean to force unconfined_t to transition to<br>> > nsplugin_t when the process runs nsplugin. <br>> > <br>> > <br>> > On Tue, 2009-06-23 at 15:58 +0100, Mohamed Aburowais wrote:<br>> > > Hello, <br>> > > I've a requirement to use a system as a root, but I need to move so<br>> > > offen to other users and be able to move to their default SELinux user<br>> > > and roles.<br>> > > As it appears to be, it is no a common thing to do, but is it possible<br>> > > without implementing a new policy?<br>> > > <br>> > > Regards<br>> > > <br>> > > <br>> > > ______________________________________________________________________<br>> > > Beyond Hotmail - see what else you can do with Windows Live. Find out<br>> > > more.<br>> > > --<br>> > > fedora-selinux-list mailing list<br>> > > fedora-selinux-list@redhat.com<br>> > > https://www.redhat.com/mailman/listinfo/fedora-selinux-list<br>> > --<br>> > fedora-selinux-list mailing list<br>> > fedora-selinux-list@redhat.com<br>> > https://www.redhat.com/mailman/listinfo/fedora-selinux-list<br>> -- <br>> Stephen Smalley<br>> National Security Agency<br>> <br><br /><hr />View your Twitter and Flickr updates from one place – <a href='http://clk.atdmt.com/UKM/go/137984870/direct/01/' target='_new'>Learn more!</a></body>
</html>