Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

SELinux - CentOSx86_64: User command limitation

Is SELinux the right tool for this job? If so, what is the best way to do it?

I would like to limit a particular user to only running some list of pre-defined commands/scripts (perhaps in their home directory). In addition the users scripts could have permission to run commands that the user cannot run directly (e.g. the user script test.sh could call 'ping localhost' but the user could not call 'ping localhost' directly from the command line). It is worth mentioning that I think these limitations are only required for one user account (I will not need multiple different configurations for different user accounts).

The OS is CentOSx86_64 and SELinux is enabled as follows:

SELinux status:                 enabled
SELinuxfs mount:                /selinux
Current mode:                   enforcing
Mode from config file:          enforcing
Policy version:                 24
Policy from config file:        targeted

I am very new to SELinux but have experimented with the following:

(1) I thought that the MLS policy would perhaps be best suited (This link looked promising: http://www.centos.org/docs/5/html/Deployment_Guide-en-US/sec-mcs-getstarted.html) for this task so I first attempted to switch this on. The 'SELinux Admin GUI' does not provide any option to change the policy from targeted so I attempted to directly change /etc/selinux/config. This ended with 'kernel panic' after rebooting so I decided to use the original installed policy (i.e. targeted).

(2) From the SELinux Admin GUI I created a new policy with a policy type of 'Minimal Terminal User Role'. For the 'name' I called it 'limiteduser'. I selected no roles that it would be transitioned to. I selected no additional roles. I selected 'All' TCP and UDP ports for binds/connects. I added no booleans to the policy. After running the generated .sh the new SELinux User and Role were created. I then assigned a login name to the 'limiteduser'. As expected this gave me a user with very limited privileges.

(3) Initially this new user could create a script in its home directory but could not execute it. After I set a boolean called 'allow_guest_exec_content' the user was able to execute the script. Initially the script just contained an 'echo' but once I changed this to ping it failed again. In an attempt to allow 'ping' for this new user I deselected the boolean user_ping (although I think this only applies to user_u rather than guest_u). To do what I want, I think an alternative might be to define a 'user_u' based type and then remove permissions (rather than go with the approach I have taken which is to go with a guest_u based type and add permissions - However I don't know how to do that either!).

(4) A number of online sources discuss policy files from a src directory but this was not installed and I could not figure out which package to install that would add this. I have the following selinux related packages installed:

libselinux.x86_64                   2.0.94-5.3.el6                     installed
libselinux-devel.x86_64             2.0.94-5.3.el6                     installed
libselinux-python.x86_64            2.0.94-5.3.el6                     installed
libselinux-utils.x86_64             2.0.94-5.3.el6                     installed
selinux-policy.noarch               3.7.19-126.el6_2.4                 @updates 
selinux-policy-targeted.noarch      3.7.19-126.el6_2.4                 @updates 
setools-console.x86_64              3.3.7-4.el6                        @base    
setools-devel.x86_64                3.3.7-4.el6                        @base    
setools-gui.x86_64                  3.3.7-4.el6                        @base    
setools-libs.x86_64                 3.3.7-4.el6                        @base    
setools-libs-java.x86_64            3.3.7-4.el6                        @base    
setools-libs-python.x86_64          3.3.7-4.el6                        @base    
setools-libs-tcl.x86_64             3.3.7-4.el6                        @base 

(5) I looked at an alternative limited shell such as http://lshell.ghantoos.org/ but my company requirement is either to use SELinux -or- if all fails to use something already provided by the os (e.g. bash restricted) but this may not be as secure.

I think that I need to define a custom policy and within that:

(a) Allow the user to execute files in its home directory.

(b) Allow the user scripts to transition into different types in order to run commands that the user does not have permissions for.

Using the SELinux admin GUI (and the configuration files I am aware of) I have not idea how to do this.

Thanks for any help you can provide.

share|improve this question

1 Answer 1

From the versions of the packages that is CentOS 6. The approach to this problem I'm currently implementing, whose main advantages are auditing capabilities (through sudo), simplicity (not requiring MLS/MCS) and confinement, is the following:

  • Users are provided a HOME directory using pam_namespace
  • Users are given rbash login shell
  • HOME is mounted noexec,ro, with things like HISTFILE pointing outside of their homes to a controlled place elsewhere
  • Users are mapped to user_u seuser
  • Users have their PATH set readonly and limited to ~/bin, where symlinks to allowed (basic) binaries exist
  • Use of sudo is mandatory for any other command not in ~/bin
  • /etc/sudoers file contains rules that take into account the role and type enforcement of the target user/command using the SELinux_Spec to specify the role and type sudoers options.

This blog post describes a use case. This thread refers the state of things with regards to RHEL5/CentOS5 and RHEL6/CentOS6

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.