Display all processes using ps

Display all processes using ps

[Guido Trentalancia]

Hello everybody !

I am logging as root on a remote MLS machine using ssh so the default
role is staff_r. However, I need to execute ps (to display all system
processes, "ps -ax") over ssh. Unfortunately, ps does not show all
processes that are normally displayed when using the sysadm_r role
because it runs in the staff_r role.

What would be the safest way to allow ps over ssh to show all processes
running on the system ?

Thanks for your help.

Guido


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: Display all processes using ps

[Dominick Grift]

[-- Attachment #1: Type: text/plain, Size: 871 bytes --]

On Sun, Jun 13, 2010 at 01:36:04AM +0200, Guido Trentalancia wrote:
> Hello everybody !
> 
> I am logging as root on a remote MLS machine using ssh so the default
> role is staff_r. However, I need to execute ps (to display all system
> processes, "ps -ax") over ssh. Unfortunately, ps does not show all
> processes that are normally displayed when using the sysadm_r role
> because it runs in the staff_r role.
> 
> What would be the safest way to allow ps over ssh to show all processes
> running on the system ?

login using the sysadm_t domain? ssh root/sysadm_r@localhost

> 
> Thanks for your help.
> 
> Guido
> 
> 
> --
> This message was distributed to subscribers of the selinux mailing list.
> If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
> the words "unsubscribe selinux" without quotes as the message.

[-- Attachment #2: Type: application/pgp-signature, Size: 198 bytes --]

Re: Display all processes using ps

[Daniel J Walsh]

On 06/12/2010 07:36 PM, Guido Trentalancia wrote:
> Hello everybody !
>
> I am logging as root on a remote MLS machine using ssh so the default
> role is staff_r. However, I need to execute ps (to display all system
> processes, "ps -ax") over ssh. Unfortunately, ps does not show all
> processes that are normally displayed when using the sysadm_r role
> because it runs in the staff_r role.
>
> What would be the safest way to allow ps over ssh to show all processes
> running on the system ?
>
> Thanks for your help.
>
> Guido
>
>
> --
> This message was distributed to subscribers of the selinux mailing list.
> If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
> the words "unsubscribe selinux" without quotes as the message.

If you want to allow staff this, you need to add


mls_file_read_to_clearance(staff_t)

And make sure staff_t has SystemLow-SystemHigh

Or if you want to be more specific you could add a new constraint, like 
the one in MCS

mlsconstrain file { read ioctl lock execute execute_no_trans }
	(( h1 dom h2 ) or ( t1 == mcsreadall ) or ( t2 == domain ));

And then allow staff_t to read all process files but no others.

Or turn on the

ssh_sysadm_login boolean
and log in


ssh dwalsh/sysadm_r@remotehost


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: Display all processes using ps

[Dennis Wronka]

[-- Attachment #1: Type: text/plain, Size: 1112 bytes --]

Can't tell you how to enable it for SSH only. I guess you'll need to edit the policy for that.
But in general you should be able to control ps's behavior using an SELinux boolean.
Look through "getsebool -a", you should be able to find it.

Sent from my HTC

----- Reply message -----
From: "Guido Trentalancia" <guido@trentalancia.com>
Date: Sun, Jun 13, 2010 07:36
Subject: Display all processes using ps
To: <selinux@tycho.nsa.gov>

Hello everybody !

I am logging as root on a remote MLS machine using ssh so the default
role is staff_r. However, I need to execute ps (to display all system
processes, "ps -ax") over ssh. Unfortunately, ps does not show all
processes that are normally displayed when using the sysadm_r role
because it runs in the staff_r role.

What would be the safest way to allow ps over ssh to show all processes
running on the system ?

Thanks for your help.

Guido


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

[-- Attachment #2: Type: text/html, Size: 1280 bytes --]