Hi,
answers inline below.
On Sun, Apr 27, 2025 at 1:49 AM chaitanya singh via selinux <selinux@xxxxxxxxxxxxxxxxxxxxxxx> wrote:
Doing this on a RHEL8.10 distro.
I've created a user with staff_u role:
# useradd -Z staff_u testadm
And provided this user elevated permissions, for which did following steps:
1. created: /etc/sudoers.d/mysudoers
2. added this: %testadm ALL=(ALL) TYPE=sysadm_t ROLE=sysadm_r ALL
This is the correct step if you want to set it for users in the testadm group, for the testadm user it would be
testadm ALL=(ALL) TYPE=sysadm_t ROLE=sysadm_r ALL
Did reboot. Installed my app's selinux policy module(rpm). Then logged in with this testadm user, and ran command to elevate to sysadm_r:sysadm_t:
# sudo runcon -r sysadm_r -t sysadm_t -- su -
This is not needed, just as the testadm user run
$ sudo -i
and then confirm the current context with
# id -Z
Now, on this console, with selinux Enforcing, I try running my application's executable (maconfig) and I'm getting this permission denied error:
[root@6H0RHEL810 ~]# /opt/McAfee/agent/bin/maconfig -stop
2025-04-25 11:43:12.768 (50811.50811) maconfig.Info: Stopping Trellix agent.
sh: /etc/init.d/ma: /bin/sh: bad interpreter: Permission denied
2025-04-25 11:43:12.770 (50811.50811) maconfig.Info: configuration finished
So naturally, I looked for denials in var/log/audit/audit.log but got this instead:
type=SELINUX_ERR msg=audit(1745581392.769:2056): op=security_compute_sid invalid_context="staff_u:system_r:initrc_t:s0" scontext=staff_u:sysadm_r:sysadm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:initrc_exec_t:s0 tclass=process
type=SYSCALL msg=audit(1745581392.769:2056): arch=c000003e syscall=59 success=no exit=-13 a0=5587d7a7b540 a1=5587d7a7c700 a2=5587d7a79e40 a3=0 items=0 ppid=50811 pid=50812 auid=1001 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=8 comm="sh" exe="/usr/bin/bash" subj=staff_u:sysadm_r:sysadm_t:s0-s0:c0.c1023 key=(null)ARCH=x86_64 SYSCALL=execve AUID="testadm" UID="root" GID="root" EUID="root" SUID="root" FSUID="root" EGID="root" SGID="root" FSGID="root"
type=PROCTITLE msg=audit(1745581392.769:2056): proctitle=7368002D63002F6574632F696E69742E642F6D612073746F70
..which is not a straighforward avc denial. So searched for ways to tackle this.
Found the explanation for the log - a process running as sysadm_t (maconfig) tried to run a file labeled initrc_exec_t (/etc/init.d/ma - my application's script), and SELinux said "nope" because it would result in an invalid context transition to initrc_t.
So tried a couple of other things:
-Switched selinux to Permissive mode, got some user_avc denials. Added rules in policy for allowing those, but didn't work.
-Added this domain transition rule to my policy (didn't work): domain_auto_trans(sysadm_t, initrc_exec_t, initrc_t);
-Tried adding these role-type statements in policy (which I thought would work for sure but nope):
require {
role system_r, sysadm_r
}
role system_r types initrc_t;
#AND
role sysadm_r types initrc_t;
Also got to know some more stuff from these pages :
https://wiki.gentoo.org/wiki/SELinux/Tutorials/Linux_services_and_the_system...
https://github.com/SELinuxProject/selinux-notebook/blob/main/src/auditing.md
..but still not sure how to proceed. Pls help out if u can. Thanks in advance!
--
_______________________________________________
selinux mailing list -- selinux@xxxxxxxxxxxxxxxxxxxxxxx
To unsubscribe send an email to selinux-leave@xxxxxxxxxxxxxxxxxxxxxxx
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/selinux@xxxxxxxxxxxxxxxxxxxxxxx
Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
--
Zdenek Pytela
Security SELinux team
-- _______________________________________________ selinux mailing list -- selinux@xxxxxxxxxxxxxxxxxxxxxxx To unsubscribe send an email to selinux-leave@xxxxxxxxxxxxxxxxxxxxxxx Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/selinux@xxxxxxxxxxxxxxxxxxxxxxx Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
