Yrurtj

I have two user accounts in my virtual machine, anim and anim2. Both are part of the wheel group and can run su/sudo commands.

I was reading on redhat how SELinux user staff_u can only run sudo commands and not su so I changed anim2 from unconfined_u to staff_u via

sudo semanage login -a -s staff_u anim2 and now here's the output of sudo semanage login -l

Login Name           SELinux User         MLS/MCS Range        Service



__default__          unconfined_u         s0-s0:c0.c1023       *

anim2                staff_u              s0-s0:c0.c1023       *

root                 unconfined_u         s0-s0:c0.c1023       *

system_u             system_u             s0-s0:c0.c1023       *

After a reboot, I login to anim2 account via GNOME login screen and check my security context.

[anim2@localhost ~]$ id -Z

staff_u:staff_r:staff_t:s0-s0:c0.c1023

But unfortunately, I'm unable to run sudo commands with anim2 user. I get permission denied and I can see the errors in /var/log/messages and /var/log/audit/audit.log

Here's the error message from /var/log/messages

Feb  6 16:23:07 localhost setroubleshoot: SELinux is preventing /usr/bin/sudo from read 

access on the file stat. For complete SELinux messages run: 

sealert -l da20696b-791b-4585-b69b-28d2b65c2936

Feb  6 16:23:07 localhost python: SELinux is preventing /usr/bin/sudo from read 

access on the file stat.#012#012*****  Plugin catchall (100. confidence) 

suggests   **************************#012#012If you believe that sudo should 

be allowed read access on the stat file by default.#012Then you should report 

this as a bug.#012You can generate a local policy module to allow this access.

#012Do#012allow this access for now by executing:#012# ausearch -c 

'sudo' --raw | audit2allow -M my-sudo#012# semodule -i my-sudo.pp#012

And here's the error message from sealert -a /var/log/audit/audit.log

If you believe that ls should have the dac_override capability by default.

Then you should report this as a bug.

You can generate a local policy module to allow this access.

Do

allow this access for now by executing:

# ausearch -c 'ls' --raw | audit2allow -M my-ls

# semodule -i my-ls.pp





Additional Information:

Source Context                staff_u:staff_r:staff_t:s0-s0:c0.c1023

Target Context                staff_u:staff_r:staff_t:s0-s0:c0.c1023

Target Objects                Unknown [ capability ]

Source                        ls

Source Path                   /usr/bin/ls

Port                          <Unknown>

Host                          <Unknown>

Source RPM Packages           coreutils-8.22-23.el7.x86_64

Target RPM Packages           

Policy RPM                    selinux-policy-3.13.1-229.el7.noarch

Selinux Enabled               True

Policy Type                   targeted

Enforcing Mode                Enforcing

Host Name                     localhost.localdomain

Platform                      Linux localhost.localdomain 3.10.0-957.el7.x86_64

                              #1 SMP Thu Nov 8 23:39:32 UTC 2018 x86_64 x86_64

Alert Count                   6

First Seen                    2019-02-06 15:52:53 PST

Last Seen                     2019-02-06 16:21:52 PST

Local ID                      de276963-e626-4336-89b4-2701788f3222



Raw Audit Messages

type=AVC msg=audit(1549498912.128:409): avc:  denied  { dac_override } for  pid=10279 

comm="ls" capability=1  scontext=staff_u:staff_r:staff_t:s0-s0:c0.c1023 

tcontext=staff_u:staff_r:staff_t:s0-s0:c0.c1023 tclass=capability permissive=0





type=AVC msg=audit(1549498912.128:409): avc:  denied  { dac_read_search } for  

pid=10279 comm="ls" capability=2  scontext=staff_u:staff_r:staff_t:s0-s0:c0.c1023 

tcontext=staff_u:staff_r:staff_t:s0-s0:c0.c1023 tclass=capability permissive=0





type=SYSCALL msg=audit(1549498912.128:409): arch=x86_64 syscall=openat success=no 

exit=EACCES a0=ffffffffffffff9c a1=acac10 a2=90800 a3=0 items=0 ppid=10276 pid=10279 

auid=1001 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts2 ses=8 

comm=ls exe=/usr/bin/ls subj=staff_u:staff_r:staff_t:s0-s0:c0.c1023 key=(null)



Hash: ls,staff_t,staff_t,capability,dac_override

What am I doing wrong?

Here's an output of SELinux booleans

[root@localhost audit]# getsebool -a

abrt_anon_write --> off

abrt_handle_event --> off

abrt_upload_watch_anon_write --> on

antivirus_can_scan_system --> off

antivirus_use_jit --> off

auditadm_exec_content --> on

authlogin_nsswitch_use_ldap --> off

authlogin_radius --> off

authlogin_yubikey --> off

awstats_purge_apache_log_files --> off

boinc_execmem --> on

cdrecord_read_content --> off

cluster_can_network_connect --> off

cluster_manage_all_files --> off

cluster_use_execmem --> off

cobbler_anon_write --> off

cobbler_can_network_connect --> off

cobbler_use_cifs --> off

cobbler_use_nfs --> off

collectd_tcp_network_connect --> off

condor_tcp_network_connect --> off

conman_can_network --> off

conman_use_nfs --> off

container_connect_any --> off

cron_can_relabel --> off

cron_system_cronjob_use_shares --> off

cron_userdomain_transition --> on

cups_execmem --> off

cvs_read_shadow --> off

daemons_dump_core --> off

daemons_enable_cluster_mode --> off

daemons_use_tcp_wrapper --> off

daemons_use_tty --> off

dbadm_exec_content --> on

dbadm_manage_user_files --> off

dbadm_read_user_files --> off

deny_execmem --> off

deny_ptrace --> off

dhcpc_exec_iptables --> off

dhcpd_use_ldap --> off

domain_can_mmap_files --> on

domain_can_write_kmsg --> off

domain_fd_use --> on

domain_kernel_load_modules --> off

entropyd_use_audio --> on

exim_can_connect_db --> off

exim_manage_user_files --> off

exim_read_user_files --> off

fcron_crond --> off

fenced_can_network_connect --> off

fenced_can_ssh --> off

fips_mode --> on

ftpd_anon_write --> off

ftpd_connect_all_unreserved --> off

ftpd_connect_db --> off

ftpd_full_access --> off

ftpd_use_cifs --> off

ftpd_use_fusefs --> off

ftpd_use_nfs --> off

ftpd_use_passive_mode --> off

git_cgi_enable_homedirs --> off

git_cgi_use_cifs --> off

git_cgi_use_nfs --> off

git_session_bind_all_unreserved_ports --> off

git_session_users --> off

git_system_enable_homedirs --> off

git_system_use_cifs --> off

git_system_use_nfs --> off

gitosis_can_sendmail --> off

glance_api_can_network --> off

glance_use_execmem --> off

glance_use_fusefs --> off

global_ssp --> off

gluster_anon_write --> off

gluster_export_all_ro --> off

gluster_export_all_rw --> on

gluster_use_execmem --> off

gpg_web_anon_write --> off

gssd_read_tmp --> on

guest_exec_content --> on

haproxy_connect_any --> off

httpd_anon_write --> off

httpd_builtin_scripting --> on

httpd_can_check_spam --> off

httpd_can_connect_ftp --> off

httpd_can_connect_ldap --> off

httpd_can_connect_mythtv --> off

httpd_can_connect_zabbix --> off

httpd_can_network_connect --> off

httpd_can_network_connect_cobbler --> off

httpd_can_network_connect_db --> off

httpd_can_network_memcache --> off

httpd_can_network_relay --> off

httpd_can_sendmail --> off

httpd_dbus_avahi --> off

httpd_dbus_sssd --> off

httpd_dontaudit_search_dirs --> off

httpd_enable_cgi --> on

httpd_enable_ftp_server --> off

httpd_enable_homedirs --> off

httpd_execmem --> off

httpd_graceful_shutdown --> on

httpd_manage_ipa --> off

httpd_mod_auth_ntlm_winbind --> off

httpd_mod_auth_pam --> off

httpd_read_user_content --> off

httpd_run_ipa --> off

httpd_run_preupgrade --> off

httpd_run_stickshift --> off

httpd_serve_cobbler_files --> off

httpd_setrlimit --> off

httpd_ssi_exec --> off

httpd_sys_script_anon_write --> off

httpd_tmp_exec --> off

httpd_tty_comm --> off

httpd_unified --> off

httpd_use_cifs --> off

httpd_use_fusefs --> off

httpd_use_gpg --> off

httpd_use_nfs --> off

httpd_use_openstack --> off

httpd_use_sasl --> off

httpd_verify_dns --> off

icecast_use_any_tcp_ports --> off

irc_use_any_tcp_ports --> off

irssi_use_full_network --> off

kdumpgui_run_bootloader --> off

keepalived_connect_any --> off

kerberos_enabled --> on

ksmtuned_use_cifs --> off

ksmtuned_use_nfs --> off

logadm_exec_content --> on

logging_syslogd_can_sendmail --> off

logging_syslogd_run_nagios_plugins --> off

logging_syslogd_use_tty --> on

login_console_enabled --> on

logrotate_read_inside_containers --> off

logrotate_use_nfs --> off

logwatch_can_network_connect_mail --> off

lsmd_plugin_connect_any --> off

mailman_use_fusefs --> off

mcelog_client --> off

mcelog_exec_scripts --> on

mcelog_foreground --> off

mcelog_server --> off

minidlna_read_generic_user_content --> off

mmap_low_allowed --> off

mock_enable_homedirs --> off

mount_anyfile --> on

mozilla_plugin_bind_unreserved_ports --> off

mozilla_plugin_can_network_connect --> off

mozilla_plugin_use_bluejeans --> off

mozilla_plugin_use_gps --> off

mozilla_plugin_use_spice --> off

mozilla_read_content --> off

mpd_enable_homedirs --> off

mpd_use_cifs --> off

mpd_use_nfs --> off

mplayer_execstack --> off

mysql_connect_any --> off

nagios_run_pnp4nagios --> off

nagios_run_sudo --> off

nagios_use_nfs --> off

named_tcp_bind_http_port --> off

named_write_master_zones --> off

neutron_can_network --> off

nfs_export_all_ro --> on

nfs_export_all_rw --> on

nfsd_anon_write --> off

nis_enabled --> off

nscd_use_shm --> on

openshift_use_nfs --> off

openvpn_can_network_connect --> on

openvpn_enable_homedirs --> on

openvpn_run_unconfined --> off

pcp_bind_all_unreserved_ports --> off

pcp_read_generic_logs --> off

piranha_lvs_can_network_connect --> off

polipo_connect_all_unreserved --> off

polipo_session_bind_all_unreserved_ports --> off

polipo_session_users --> off

polipo_use_cifs --> off

polipo_use_nfs --> off

polyinstantiation_enabled --> off

postfix_local_write_mail_spool --> on

postgresql_can_rsync --> off

postgresql_selinux_transmit_client_label --> off

postgresql_selinux_unconfined_dbadm --> on

postgresql_selinux_users_ddl --> on

pppd_can_insmod --> off

pppd_for_user --> off

privoxy_connect_any --> on

prosody_bind_http_port --> off

puppetagent_manage_all_files --> off

puppetmaster_use_db --> off

racoon_read_shadow --> off

radius_use_jit --> off

redis_enable_notify --> off

rpcd_use_fusefs --> off

rsync_anon_write --> off

rsync_client --> off

rsync_export_all_ro --> off

rsync_full_access --> off

samba_create_home_dirs --> off

samba_domain_controller --> off

samba_enable_home_dirs --> off

samba_export_all_ro --> off

samba_export_all_rw --> off

samba_load_libgfapi --> off

samba_portmapper --> off

samba_run_unconfined --> off

samba_share_fusefs --> off

samba_share_nfs --> off

sanlock_enable_home_dirs --> off

sanlock_use_fusefs --> off

sanlock_use_nfs --> off

sanlock_use_samba --> off

saslauthd_read_shadow --> off

secadm_exec_content --> on

secure_mode --> off

secure_mode_insmod --> off

secure_mode_policyload --> off

selinuxuser_direct_dri_enabled --> on

selinuxuser_execheap --> off

selinuxuser_execmod --> on

selinuxuser_execstack --> on

selinuxuser_mysql_connect_enabled --> off

selinuxuser_ping --> on

selinuxuser_postgresql_connect_enabled --> off

selinuxuser_rw_noexattrfile --> on

selinuxuser_share_music --> off

selinuxuser_tcp_server --> off

selinuxuser_udp_server --> off

selinuxuser_use_ssh_chroot --> off

sge_domain_can_network_connect --> off

sge_use_nfs --> off

smartmon_3ware --> off

smbd_anon_write --> off

spamassassin_can_network --> off

spamd_enable_home_dirs --> on

spamd_update_can_network --> off

squid_connect_any --> on

squid_use_tproxy --> off

ssh_chroot_rw_homedirs --> off

ssh_keysign --> off

ssh_sysadm_login --> off

staff_exec_content --> on

staff_use_svirt --> off

swift_can_network --> off

sysadm_exec_content --> on

telepathy_connect_all_ports --> off

telepathy_tcp_connect_generic_network_ports --> on

tftp_anon_write --> off

tftp_home_dir --> off

tmpreaper_use_cifs --> off

tmpreaper_use_nfs --> off

tmpreaper_use_samba --> off

tomcat_can_network_connect_db --> off

tomcat_read_rpm_db --> off

tomcat_use_execmem --> off

tor_bind_all_unreserved_ports --> off

tor_can_network_relay --> off

unconfined_chrome_sandbox_transition --> on

unconfined_login --> on

unconfined_mozilla_plugin_transition --> on

unprivuser_use_svirt --> off

use_ecryptfs_home_dirs --> off

use_fusefs_home_dirs --> off

use_lpd_server --> off

use_nfs_home_dirs --> off

use_samba_home_dirs --> off

user_exec_content --> on

varnishd_connect_any --> off

virt_read_qemu_ga_data --> off

virt_rw_qemu_ga_data --> off

virt_sandbox_use_all_caps --> on

virt_sandbox_use_audit --> on

virt_sandbox_use_fusefs --> off

virt_sandbox_use_mknod --> off

virt_sandbox_use_netlink --> off

virt_sandbox_use_sys_admin --> off

virt_transition_userdomain --> off

virt_use_comm --> off

virt_use_execmem --> off

virt_use_fusefs --> off

virt_use_glusterd --> off

virt_use_nfs --> off

virt_use_rawip --> off

virt_use_samba --> off

virt_use_sanlock --> off

virt_use_usb --> on

virt_use_xserver --> off

webadm_manage_user_files --> off

webadm_read_user_files --> off

wine_mmap_zero_ignore --> off

xdm_bind_vnc_tcp_port --> off

xdm_exec_bootloader --> off

xdm_sysadm_login --> off

xdm_write_home --> off

xen_use_nfs --> off

xend_run_blktap --> on

xend_run_qemu --> on

xguest_connect_network --> on

xguest_exec_content --> on

xguest_mount_media --> on

xguest_use_bluetooth --> on

xserver_clients_write_xshm --> off

xserver_execmem --> off

xserver_object_manager --> off

zabbix_can_network --> off

zabbix_run_sudo --> off

zarafa_setrlimit --> off

zebra_write_config --> off

zoneminder_anon_write --> off

zoneminder_run_sudo --> off

Here's some info on the CentOS machine I'm running.

3.10.0-957.el7.x86_64

CentOS Linux release 7.6.1810 (Core)

And sestatus

SELinux status:                 enabled

SELinuxfs mount:                /sys/fs/selinux

SELinux root directory:         /etc/selinux

Loaded policy name:             targeted

Current mode:                   enforcing

Mode from config file:          enforcing

Policy MLS status:              enabled

Policy deny_unknown status:     allowed

Max kernel policy version:      31

I'm following this tutorial.