Re: Display all processes using ps

[Daniel J Walsh <dwalsh@redhat.com>]

On 06/12/2010 07:36 PM, Guido Trentalancia wrote:
> Hello everybody !
>
> I am logging as root on a remote MLS machine using ssh so the default
> role is staff_r. However, I need to execute ps (to display all system
> processes, "ps -ax") over ssh. Unfortunately, ps does not show all
> processes that are normally displayed when using the sysadm_r role
> because it runs in the staff_r role.
>
> What would be the safest way to allow ps over ssh to show all processes
> running on the system ?
>
> Thanks for your help.
>
> Guido
>
>
> --
> This message was distributed to subscribers of the selinux mailing list.
> If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
> the words "unsubscribe selinux" without quotes as the message.

If you want to allow staff this, you need to add


mls_file_read_to_clearance(staff_t)

And make sure staff_t has SystemLow-SystemHigh

Or if you want to be more specific you could add a new constraint, like 
the one in MCS

mlsconstrain file { read ioctl lock execute execute_no_trans }
	(( h1 dom h2 ) or ( t1 == mcsreadall ) or ( t2 == domain ));

And then allow staff_t to read all process files but no others.

Or turn on the

ssh_sysadm_login boolean
and log in


ssh dwalsh/sysadm_r@remotehost


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.