I have a daemon (collectd) that executes a script for data collection (via smartctl).
The exec-plugin of collectd mandates that external scripts are executed under a user != root.
The plan is to set it up like this:
- allow collectd to change the user and perhaps execute the script (via SELinux)
- create a system user X for the task at hand
- configure sudo such that X is allowed to execute smartctl
- configure SELinux such that a) sudo transitions to a (say) unconfined domain b) the setuid to user X (or the execution of the script) transitions to an unconfined domain
I've come up with the last step - because otherwise there is no transition, and I have to allow collectd all the smartctl related low-level permissions (e.g. sys_rawio, ioctl, execute_no_trans ...) - which I want to avoid.
Sudo seems to provide SELinux related attributes, e.g. one can put into the sudoer line something like:
TYPE=unconfined_t ROLE=unconfined_r
But then sudo complains:
sudo: unable to determine enforcing mode.: Permission denied sudo: unable to execute /usr/sbin/smartctl: Permission denied
How are the TYPE/ROLE supposed to work with sudo (under CentOS 7)?
What about route b) - how to configure this with a custom SELinux policy file?