linux su 拒绝权限,启用S​​ELinux后/ bin / su权限被拒绝 – 无法通过手动创建SELinux策略解决...

出于某种原因,我不能从非root用户那里获取root权限：

[rilindo@kerberos ~]$/bin/su -

-bash: /bin/su: Permission denied

从/var/log/audit/audit.log运行输出要么返回：

[root@kerberos tmp]# cat /tmp/audit

type=AVC msg=audit(1319322088.937:68012): avc: denied { execute } for pid=9794 comm="bash" name="su" dev=dm-0 ino=1048659 scontext=user_u:user_r:user_t:s0 tcontext=system_u:object_r:su_exec_t:s0 tclass=file

type=SYSCALL msg=audit(1319322088.937:68012): arch=c000003e syscall=59 success=no exit=-13 a0=26a7df0 a1=26c9b30 a2=269efa0 a3=18 items=0 ppid=8435 pid=9794 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=pts0 ses=4454 comm="bash" exe="/bin/bash" subj=user_u:user_r:user_t:s0 key=(null)

type=AVC msg=audit(1319322088.944:68013): avc: denied { getattr } for pid=9794 comm="bash" path="/bin/su" dev=dm-0 ino=1048659 scontext=user_u:user_r:user_t:s0 tcontext=system_u:object_r:su_exec_t:s0 tclass=file

type=SYSCALL msg=audit(1319322088.944:68013): arch=c000003e syscall=4 success=no exit=-13 a0=26a7df0 a1=7fff26b200d0 a2=7fff26b200d0 a3=18 items=0 ppid=8435 pid=9794 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=pts0 ses=4454 comm="bash" exe="/bin/bash" subj=user_u:user_r:user_t:s0 key=(null)

type=AVC msg=audit(1319322088.944:68014): avc: denied { getattr } for pid=9794 comm="bash" path="/bin/su" dev=dm-0 ino=1048659 scontext=user_u:user_r:user_t:s0 tcontext=system_u:object_r:su_exec_t:s0 tclass=file

type=SYSCALL msg=audit(1319322088.944:68014): arch=c000003e syscall=4 success=no exit=-13 a0=26a7df0 a1=7fff26b200b0 a2=7fff26b200b0 a3=18 items=0 ppid=8435 pid=9794 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=pts0 ses=4454 comm="bash" exe="/bin/bash" subj=user_u:user_r:user_t:s0 key=(null)

这导致来自audit2allow的此解决方案：

[root @kerberos tmp] #cat / tmp / audit | audit2allow

#============= user_t ==============

#!!!! This avc is allowed in the current policy

allow user_t su_exec_t:file { execute getattr };

[root@kerberos tmp]#

或者这个输出：

type=AVC msg=audit(1319334064.195:39047): avc: denied { read open } for pid=6067 comm="bash" name="su" dev=dm-0 ino=1048587 scontext=user_u:user_r:user_t:s0 tcontext=system_u:object_r:su_exec_t:s0 tclass=file

type=SYSCALL msg=audit(1319334064.195:39047): arch=c000003e syscall=59 success=no exit=-13 a0=eecbd0 a1=eecbf0 a2=ec7720 a3=18 items=0 ppid=2857 pid=6067 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=pts8 ses=2 comm="bash" exe="/bin/bash" subj=user_u:user_r:user_t:s0 key=(null)

type=AVC msg=audit(1319334064.200:39048): avc: denied { read } for pid=6067 comm="bash" name="su" dev=dm-0 ino=1048587 scontext=user_u:user_r:user_t:s0 tcontext=system_u:object_r:su_exec_t:s0 tclass=file

type=SYSCALL msg=audit(1319334064.200:39048): arch=c000003e syscall=21 success=no exit=-13 a0=eecbd0 a1=4 a2=0 a3=18 items=0 ppid=2857 pid=6067 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=pts8 ses=2 comm="bash" exe="/bin/bash" subj=user_u:user_r:user_t:s0 key=(null)

type=AVC msg=audit(1319334064.200:39049): avc: denied { read } for pid=6067 comm="bash" name="su" dev=dm-0 ino=1048587 scontext=user_u:user_r:user_t:s0 tcontext=system_u:object_r:su_exec_t:s0 tclass=file

type=SYSCALL msg=audit(1319334064.200:39049): arch=c000003e syscall=2 success=no exit=-13 a0=eecbd0 a1=0 a2=43 a3=18 items=0 ppid=2857 pid=6067 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=pts8 ses=2 comm="bash" exe="/bin/bash" subj=user_u:user_r:user_t:s0 key=(null)

type=AVC msg=audit(1319334064.208:39050): avc: denied { rlimitinh } for pid=6069 comm="setroubleshootd" scontext=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 tcontext=system_u:system_r:setroubleshootd_t:s0-s0:c0.c1023 tclass=process

type=AVC msg=audit(1319334064.208:39050): avc: denied { siginh } for pid=6069 comm="setroubleshootd" scontext=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 tcontext=system_u:system_r:setroubleshootd_t:s0-s0:c0.c1023 tclass=process

type=AVC msg=audit(1319334064.208:39050): avc: denied { noatsecure } for pid=6069 comm="setroubleshootd" scontext=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 tcontext=system_u:system_r:setroubleshootd_t:s0-s0:c0.c1023 tclass=process

type=SYSCALL msg=audit(1319334064.208:39050): arch=c000003e syscall=59 success=yes exit=0 a0=944aa0 a1=9447e0 a2=943010 a3=1 items=0 ppid=6068 pid=6069 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="setroubleshootd" exe="/usr/bin/python" subj=system_u:system_r:setroubleshootd_t:s0-s0:c0.c1023 key=(null)

type=AVC msg=audit(1319334064.369:39051): avc: denied { write } for pid=6069 comm="setroubleshootd" name="rpm" dev=dm-0 ino=655363 scontext=system_u:system_r:setroubleshootd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:rpm_var_lib_t:s0 tclass=dir

type=SYSCALL msg=audit(1319334064.369:39051): arch=c000003e syscall=21 success=no exit=-13 a0=1405430 a1=2 a2=0 a3=9 items=0 ppid=6068 pid=6069 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="setroubleshootd" exe="/usr/bin/python" subj=system_u:system_r:setroubleshootd_t:s0-s0:c0.c1023 key=(null)

type=AVC msg=audit(1319334064.370:39052): avc: denied { write } for pid=6069 comm="setroubleshootd" name="rpm" dev=dm-0 ino=655363 scontext=system_u:system_r:setroubleshootd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:rpm_var_lib_t:s0 tclass=dir

type=SYSCALL msg=audit(1319334064.370:39052): arch=c000003e syscall=21 success=no exit=-13 a0=1405430 a1=2 a2=0 a3=5 items=0 ppid=6068 pid=6069 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="setroubleshootd" exe="/usr/bin/python" subj=system_u:system_r:setroubleshootd_t:s0-s0:c0.c1023 key=(null)

在此,audit2allow建议如下：

#============= setroubleshootd_t ==============

#!!!! The source type 'setroubleshootd_t' can write to a 'dir' of the following types:

# var_log_t, setroubleshoot_var_lib_t, setroubleshoot_var_run_t, setroubleshoot_var_log_t, var_lib_t, var_run_t, root_t

allow setroubleshootd_t rpm_var_lib_t:dir write;

#============= system_dbusd_t ==============

allow system_dbusd_t setroubleshootd_t:process { siginh rlimitinh noatsecure };

#============= user_t ==============

allow user_t su_exec_t:file { read open };

奇怪的是,每当我尝试加载新策略时,它都会在两条消息之间切换,如下所示：

[root@kerberos tmp]# cat /tmp/audit2 | audit2allow -M local

******************** IMPORTANT ***********************

To make this policy package active, execute:

semodule -i local.pp

尝试使用升级选项将返回以下内容：

[root@kerberos tmp]# semodule -u local.pp

libsemanage.get_direct_upgrade_filename: Previous module local is same or newer. (No such file or directory).

semodule: Failed on local.pp!

值得注意的是：

>系统最初没有启用selinux.启用selinux后问题就出现了：

>最初,这是一个使用“sudo su – ”的问题,在故障排除过程中导致了这个问题.

>我在此之后构建的新主机默认启用了selinux – 并且他们没有遇到此问题,这意味着当我将SELinux恢复为原始服务器的“强制执行”时,某些内容无法启用.

以下是su命令的权限和facl：

[root@kerberos tmp]# getfacl /bin/su

getfacl: Removing leading '/' from absolute path names

# file: bin/su

# owner: root

# group: root

# flags: s--

user::rwx

group::r-x

other::r-x

[root@kerberos tmp]# ls -laZ /bin/su

-rwsr-xr-x. root root system_u:object_r:su_exec_t:s0 /bin/su

[root@kerberos tmp]#

>奇怪的是,在某些时候,我必须以确切的路径执行su,即使它在我的道路上.还奇怪的是,如果我以root身份登录,那么su作为普通用户,我可以使用su命令：

[root@kerberos tmp]# su - rilindo

[rilindo@kerberos ~]$su -

Password:

[root@kerberos ~]#

一些方向表示赞赏.