Re: changing root to default to sysadm_r

[forrest whitcher <fw@fwsystems.com>]

Nick

I don't know why you're having problems changing it but I know why
it was/is set this way.

If root defaults to sysadm_r, then certain kinds of sshd exploits
(kinds that _heve_ been seen before) can get the attacker sysadm_r,
game over, not good.

The requirement to authenticate explicitly thru newrole intends to
to avoid this.

forrest




On Wed, 10 Dec 2003 16:51:42 -0600 (unchecked - local sync NTPstrat4)
Nick <nagray@austin.rr.com> did inscribe thusly:

> I thought I could do make root come up in the sysadm_r initially by
> changing the users.te file
> 
> diff users .users
> 42c42
> < user root roles { sysadm_r staff_r };
> ---
> > user root roles { staff_r sysadm_r };
> 
> and recompiling the policy.
> 
> Apparently not, suggestions! and comments why it is not this way
> already.
> 
> -- 
> Nick (Nix) Gray
> Senior Systems Engineer
> Bruzenak Inc.
> (512) 331-7998
> 
> --
> This message was distributed to subscribers of the selinux mailing list.
> If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
> the words "unsubscribe selinux" without quotes as the message.

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.