Gentoo Forums
Gentoo Forums
Gentoo Forums
Quick Search: in
[SOLVED] Why SELINUX does not change from user_u...
View unanswered posts
View posts from last 24 hours

 
Reply to topic    Gentoo Forums Forum Index Networking & Security
View previous topic :: View next topic  
Author Message
vcmota
n00b
n00b


Joined: 19 Jun 2017
Posts: 47

PostPosted: Thu Dec 07, 2017 7:21 pm    Post subject: [SOLVED] Why SELINUX does not change from user_u... Reply with quote

I have a gentoo install running a hardened/selinux profile, and I am confused about the login behavior of selinux. First, I have decided not to change the login map of the regular linux user of my pc from user_u to sysadm_u. My plan is to give as little privilege as possible to the regular user, and simply login as root whenever I needed to do administrative tasks. But the plan is not working: when I start the machine and login as the regular user, then entering the root environment with "su --login" gives me root as user_u. This is what I get when I log in as the normal user first:

Code:

vinicius@mossadegh ~ $ id -Z
user_u:user_r:user_t
vinicius@mossadegh ~ $ su --login
Password:
mossadegh ~ # id -Z
user_u:user_r:user_t


and this is what I get when I log in as the root:

Code:

mossadegh ~ # id -Z
root:sysadm_r:sysadm_t


Is this the correct Selinux behavior? I understand that the selinux user and the linux user are completely different things, but I do not understand why, from the perspective of selinux, I do not have root privileges after "su --login", that sounds like a miss configuration of my part.

Thank you all!


Last edited by vcmota on Fri Dec 08, 2017 11:29 am; edited 1 time in total
Back to top
View user's profile Send private message
vcmota
n00b
n00b


Joined: 19 Jun 2017
Posts: 47

PostPosted: Fri Dec 08, 2017 11:28 am    Post subject: Reply with quote

I guess this is the correct selinux behavior... From the configuration page:

Quote:

If the SELINUXTYPE variable is set to strict, then it is necessary to map the account(s) used to manage the system (those that need access to Portage) to the staff_u SELinux user. If not, none of the accounts will be able to succesfully manage the system (except for root, but then the administrator will need to login as root directly and not through sudo or su.)


Marking as SOLVED...
Back to top
View user's profile Send private message
Display posts from previous:   
Reply to topic    Gentoo Forums Forum Index Networking & Security All times are GMT
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum