sudo change in policy

sudo change in policy

[Daniel J Walsh]

[-- Attachment #1: Type: text/plain, Size: 226 bytes --]

sudo should be able to getattr on all executables not just 
bin_t/sbin_t.  Confined executeables run from sudo need this.

sudo_exec_t needs to be marked as exec_type so prelink will work correctly.

sudo semanage should work

[-- Attachment #2: nsaserefpolicy_policy_modules_admin_sudo.patch --]
[-- Type: text/x-patch, Size: 1038 bytes --]

--- nsaserefpolicy/policy/modules/admin/sudo.if	2007-02-19 11:32:54.000000000 -0500
+++ serefpolicy-2.5.5/policy/modules/admin/sudo.if	2007-02-28 10:25:17.000000000 -0500
@@ -37,7 +37,6 @@
 
 	gen_require(`
 		type sudo_exec_t;
-		bool secure_mode;
 	')
 
 	##############################
@@ -92,12 +91,10 @@
 	fs_getattr_xattr_fs($1_sudo_t)
 
 	auth_domtrans_chk_passwd($1_sudo_t)
-	# sudo stores a token in the pam_pid directory
 	auth_manage_pam_pid($1_sudo_t)
 
-	corecmd_getattr_bin_files($1_sudo_t)
 	corecmd_read_sbin_symlinks($1_sudo_t)
-	corecmd_getattr_sbin_files($1_sudo_t)
+	corecmd_getattr_all_executables($1_sudo_t)
 
 	domain_use_interactive_fds($1_sudo_t)
 	domain_sigchld_interactive_fds($1_sudo_t)
--- nsaserefpolicy/policy/modules/admin/sudo.te	2007-02-19 11:32:54.000000000 -0500
+++ serefpolicy-2.5.5/policy/modules/admin/sudo.te	2007-02-28 10:25:17.000000000 -0500
@@ -7,5 +7,6 @@
 
 type sudo_exec_t;
 files_type(sudo_exec_t)
+corecmd_executable_file(sudo_exec_t)
 
 # Remaining policy in per user domain template.

Re: sudo change in policy

[Christopher J. PeBenito]

On Wed, 2007-02-28 at 10:29 -0500, Daniel J Walsh wrote:
> sudo should be able to getattr on all executables not just 
> bin_t/sbin_t.  Confined executeables run from sudo need this.
> 
> sudo_exec_t needs to be marked as exec_type so prelink will work correctly.
> 
> sudo semanage should work

Merged, except for the comment change.

> --- nsaserefpolicy/policy/modules/admin/sudo.if 2007-02-19
> 11:32:54.000000000 -0500
> +++ serefpolicy-2.5.5/policy/modules/admin/sudo.if      2007-02-28
> 10:25:17.000000000 -0500
> @@ -37,7 +37,6 @@
>  
>         gen_require(`
>                 type sudo_exec_t;
> -               bool secure_mode;
>         ')
>  
>         ##############################
> @@ -92,12 +91,10 @@
>         fs_getattr_xattr_fs($1_sudo_t)
>  
>         auth_domtrans_chk_passwd($1_sudo_t)
> -       # sudo stores a token in the pam_pid directory
>         auth_manage_pam_pid($1_sudo_t)
>  
> -       corecmd_getattr_bin_files($1_sudo_t)
>         corecmd_read_sbin_symlinks($1_sudo_t)
> -       corecmd_getattr_sbin_files($1_sudo_t)
> +       corecmd_getattr_all_executables($1_sudo_t)
>  
>         domain_use_interactive_fds($1_sudo_t)
>         domain_sigchld_interactive_fds($1_sudo_t)
> --- nsaserefpolicy/policy/modules/admin/sudo.te 2007-02-19
> 11:32:54.000000000 -0500
> +++ serefpolicy-2.5.5/policy/modules/admin/sudo.te      2007-02-28
> 10:25:17.000000000 -0500
> @@ -7,5 +7,6 @@
>  
>  type sudo_exec_t;
>  files_type(sudo_exec_t)
> +corecmd_executable_file(sudo_exec_t)
>  
>  # Remaining policy in per user domain template.

-- 
Chris PeBenito
Tresys Technology, LLC
(410) 290-1411 x150


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.