Non root user cannot execute semanage, semodule

Non root user cannot execute semanage, semodule

[Rahul Jain]

[-- Attachment #1: Type: text/plain, Size: 619 bytes --]

Hi All,
 
I am currently developing a Role Based Access Solution on Montavista linux using SELiunx. I started my implementaion with the reference policy from Tresys. In this implementation I had assigned a role of security officer to one of my non root Linux user. This user is resposible for maintaining SELinux related tasks such as creation, building of policy etc. But this user of mine, being a non root user is not able to execute some priviledged commands such as semodule and semanage. 
Is there any in which I can permit a non root user execute these commands.
 
Thanks and Regards
Rahul Jain


      

[-- Attachment #2: Type: text/html, Size: 815 bytes --]

Re: Non root user cannot execute semanage, semodule

[Stephen Smalley]

On Tue, 2008-12-09 at 09:52 -0800, Rahul Jain wrote:
> Hi All,
>  
> I am currently developing a Role Based Access Solution on Montavista
> linux using SELiunx. I started my implementaion with the reference
> policy from Tresys. In this implementation I had assigned a role of
> security officer to one of my non root Linux user. This user is
> resposible for maintaining SELinux related tasks such as creation,
> building of policy etc. But this user of mine, being a non root user
> is not able to execute some priviledged commands such as semodule and
> semanage. 
> Is there any in which I can permit a non root user execute these
> commands.
>  
> Thanks and Regards
> Rahul Jain

Not directly, no.  SELinux only further restricts what can be done; it
does not completely override the normal Linux checks.

You could invoke semodule/semanage via sudo in order to enable a
non-root user to use them, with suitable policy configuration and
sudoers configuration.

-- 
Stephen Smalley
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: Non root user cannot execute semanage, semodule

[Daniel J Walsh]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Rahul Jain wrote:
> Hi All,
>  
> I am currently developing a Role Based Access Solution on Montavista linux using SELiunx. I started my implementaion with the reference policy from Tresys. In this implementation I had assigned a role of security officer to one of my non root Linux user. This user is resposible for maintaining SELinux related tasks such as creation, building of policy etc. But this user of mine, being a non root user is not able to execute some priviledged commands such as semodule and semanage. 
> Is there any in which I can permit a non root user execute these commands.
>  
> Thanks and Regards
> Rahul Jain
> 
> 
>       
sudo
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org

iEYEARECAAYFAkk+3QQACgkQrlYvE4MpobOgwgCdHCpxAP2hqRPSI17OLLy0tO4a
FAoAmwZa914C1wlLGPV2HZ3+BGPmv9ZG
=zE1X
-----END PGP SIGNATURE-----

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: Non root user cannot execute semanage, semodule

[Casey Schaufler]

Daniel J Walsh wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Rahul Jain wrote:
>   
>> Hi All,
>>  
>> I am currently developing a Role Based Access Solution on Montavista linux using SELiunx. I started my implementaion with the reference policy from Tresys. In this implementation I had assigned a role of security officer to one of my non root Linux user. This user is resposible for maintaining SELinux related tasks such as creation, building of policy etc. But this user of mine, being a non root user is not able to execute some priviledged commands such as semodule and semanage. 
>> Is there any in which I can permit a non root user execute these commands.
>>  
>> Thanks and Regards
>> Rahul Jain
>>
>>
>>       
>>     
> sudo
>   

File based capabilities, too.


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: Non root user cannot execute semanage, semodule

[Justin P. Mattock]

Shouldn't the employee have only access to only what they need?

justin P. Mattock



On Dec 9, 2008, at 10:19 PM, Casey Schaufler <casey@schaufler-ca.com>  
wrote:

> Daniel J Walsh wrote:
>> -----BEGIN PGP SIGNED MESSAGE-----
>> Hash: SHA1
>>
>> Rahul Jain wrote:
>>
>>> Hi All,
>>> I am currently developing a Role Based Access Solution on  
>>> Montavista linux using SELiunx. I started my implementaion with  
>>> the reference policy from Tresys. In this implementation I had  
>>> assigned a role of security officer to one of my non root Linux  
>>> user. This user is resposible for maintaining SELinux related  
>>> tasks such as creation, building of policy etc. But this user of  
>>> mine, being a non root user is not able to execute some  
>>> priviledged commands such as semodule and semanage. Is there any  
>>> in which I can permit a non root user execute these commands.
>>> Thanks and Regards
>>> Rahul Jain
>>>
>>>
>>>
>> sudo
>>
>
> File based capabilities, too.
>
>
> --
> This message was distributed to subscribers of the selinux mailing  
> list.
> If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov 
>  with
> the words "unsubscribe selinux" without quotes as the message.

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: Non root user cannot execute semanage, semodule

[Stephen Smalley]

On Tue, 2008-12-09 at 22:19 -0800, Casey Schaufler wrote:
> Daniel J Walsh wrote:
> > -----BEGIN PGP SIGNED MESSAGE-----
> > Hash: SHA1
> >
> > Rahul Jain wrote:
> >   
> >> Hi All,
> >>  
> >> I am currently developing a Role Based Access Solution on Montavista linux using SELiunx. I started my implementaion with the reference policy from Tresys. In this implementation I had assigned a role of security officer to one of my non root Linux user. This user is resposible for maintaining SELinux related tasks such as creation, building of policy etc. But this user of mine, being a non root user is not able to execute some priviledged commands such as semodule and semanage. 
> >> Is there any in which I can permit a non root user execute these commands.
> >>  
> >> Thanks and Regards
> >> Rahul Jain
> >>
> >>
> >>       
> >>     
> > sudo
> >   
> 
> File based capabilities, too.

No - here we are running programs that do not expect to have any special
privileges beyond their caller.  And semanage is a python script.

-- 
Stephen Smalley
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: Non root user cannot execute semanage, semodule

[Casey Schaufler]

Stephen Smalley wrote:
>> No - here we are running programs that do not expect to have any special
>> privileges beyond their caller.

Yes, you would have to make the programs CAP aware, and in any case ...

>>   And semanage is a python script.
>>     

The Orange Book educated mind boggles. You're right. Bad idea. Never mind.



--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Non root user cannot execute semanage, semodule

[Rahul Jain]

[-- Attachment #1: Type: text/plain, Size: 861 bytes --]

Thankyou All,
 
This community is really awesome.
 
As suggested by Stephen I used sudo in order to allow a non root user execute the priviledged commands like semodule and semanage and protected the configuration file using SELinux. Though I tried to tweak the policycoreutils also to get the things done but it did not work. The reason being, the some intermediate directories that are created when these commands are executed. The owner of these directories is root and a non root user is not able to access these directories.
 
For me it was important to allow security officer execute these commands because his role entitles him to perform all security policy related tasks. Semodule was needed to load the policy modules while semanage was required to map the Linux users with the selinux users.
 
Thanks and Regards
Rahul Jain
 
 


      

[-- Attachment #2: Type: text/html, Size: 1152 bytes --]

Re: Non root user cannot execute semanage, semodule

[Justin Mattock]

On Wed, Dec 10, 2008 at 8:34 AM, Rahul Jain <erahul29@yahoo.com> wrote:
> Thankyou All,
>
> This community is really awesome.
>
> As suggested by Stephen I used sudo in order to allow a non root user
> execute the priviledged commands like semodule and semanage and protected
> the configuration file using SELinux. Though I tried to tweak the
> policycoreutils also to get the things done but it did not work. The
> reason being, the some intermediate directories that are created when these
> commands are executed. The owner of these directories is root and a non root
> user is not able to access these directories.
>
> For me it was important to allow security officer execute these commands
> because his role entitles him to perform all security policy related tasks.
> Semodule was needed to load the policy modules while semanage was required
> to map the Linux users with the selinux users.
>
> Thanks and Regards
> Rahul Jain
>
>
>

Yeah that makes sense.
glad you up and running.

-- 
Justin P. Mattock

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.