Re: Linux user / SELinux user changes...

[Ken YANG <spng.yang@gmail.com>]

Hasan Rezaul-CHR010 wrote:
>  
> Hi All,
> 
> If I have Linux users "root"  and "test"     and I have
> SELinux users  "staff_u", and "user_u",  and 
> SELinux roles  "staff_r", and "user_r"  
> 
> If I ssh into the Linux machine as test, my SELinux identity is user_u.
> If I ssh into the Linux machine as root, my SELinux identity is staff_u.
> 
> Lets say I ssh into my Linux machine as Linux user "root".
> "id -Z"  shows   staff_u:staff_r:staff_t
> 
> Now if I downgrade my Linux user priviledge to user "test" by using  su
> as follows:
> 
> su - test
> Pass: test
> 
> id -Z  =>  still shows me that I am staff_u , even though I am Linux
> user "test" (Linux user test should ideally be mapped to user_u).
> 
> Is there a way for SELinux to automatically adjust/change the SELinux
> user, whenever the Linux user is changed via "su"  ???

in original selinux, su can change context, including selinux user,
but now, su can not change selinux user at all, su/pam_selinux
had been reverted for a while. if you want to switch to admin role,
you must use "newrole"

furthermore, user_r can not switch to staff_r, you must map your
linux user identity to staff_u via semanage, before you switch to
admin role. the difference between staff_u and user_u is the former
can switch to admin role, i.e. sysadm_r(root)

http://marc.info/?l=selinux&m=118121922201142&w=2

this thread maybe help you


> 
> Thanks in advance,
> 
> - Rezaul.
> 
> P.S. I can appreciate why first logging in as Linux user test, and then
> su to root, will still keep my SELinux user to user_u.  But just curious
> if there is any flexibility in this regard ?
> 
> 
> --
> This message was distributed to subscribers of the selinux mailing list.
> If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
> the words "unsubscribe selinux" without quotes as the message.
> 


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.