SELinux version of sudo

[Daniel J Walsh <dwalsh@redhat.com>]

[-- Attachment #1: Type: text/plain, Size: 2166 bytes --]

I have been playing around with SELinux a little and was getting 
agravated in always changing roles and
then having to su to root.  What I really needed was the functionality 
of sudo and newrole combined together.
So I am building a version of sudo that will take as a parameter the 
role and or type to execute the program as.
(I would eventually move this to the /etc/sudoers file if I can figure 
out how to use yacc).  I am not sure whether
this is a good idea or not.  It could lead to better security, since I 
believe most users are going to get sick of
changing to sysadm_r and executing su/sudo every time they want to 
change the configuration, so they are likely
to just log in at sysadm_r.  By making it easier for them to do this 
with sudo, they might maintain better security.  

The code seems to work except that I am hitting on a policy error. 
 Basically I don't have a policy that allows
/usr/bin/sudo to exec other applications.   What do I need to change in 
policy to make this happen?
I am getting the following errors in the /var/log/messages

Apr 15 09:13:40 pxe kernel: avc:  denied  { setattr } for  pid=2377 
exe=/usr/bin/sudo path=/var/run/sudo/dwalsh/1 dev=03:02 ino=962189 
scontext=dwalsh:user_r:user_su_t tcontext=dwalsh:object_r:var_run_t 
tclass=file
Apr 15 09:13:50 pxe kernel:
Apr 15 09:13:50 pxe kernel: avc:  denied  { transition } for  pid=2378 
exe=/usr/bin/sudo path=/usr/local/selinux/bin/id dev=03:02 ino=2316548 
scontext=dwalsh:user_r:user_su_t tcontext=dwalsh:sysadm_r:sysadm_t 
tclass=process


Added the following line to policy/file_contexts/program/su.fc
/usr/bin/sudo            system_u:object_r:su_exec_t

Also modified policy/domains/program/newrole.te

--- newrole.te~    2003-03-06 18:13:25.000000000 -0500
+++ newrole.te    2003-04-14 16:26:10.000000000 -0400
@@ -27,7 +27,8 @@
 can_exec(newrole_t, chkpwd_exec_t)
 
 # Allow newrole_t to transition to user domains.
-domain_trans(newrole_t, shell_exec_t, userdomain)
+# domain_trans(newrole_t, shell_exec_t, userdomain)
+domain_trans(newrole_t,{ bin_t sbin_t exec_type }, userdomain)
 domain_trans(newrole_t, ls_exec_t, userdomain)

 # Use capabilities.


[-- Attachment #2: sudo-1.6.6-4.src.rpm --]
[-- Type: application/x-rpm, Size: 344709 bytes --]