How to transition into another domain when invoking sudo?

Question

I have a daemon (collectd) that executes a script for data collection (via smartctl).

The exec-plugin of collectd mandates that external scripts are executed under a user != root.

The plan is to set it up like this:

• allow collectd to change the user and perhaps execute the script (via SELinux)
• create a system user X for the task at hand
• configure sudo such that X is allowed to execute smartctl
• configure SELinux such that a) sudo transitions to a (say) unconfined domain b) the setuid to user X (or the execution of the script) transitions to an unconfined domain

I've come up with the last step - because otherwise there is no transition, and I have to allow collectd all the smartctl related low-level permissions (e.g. sys_rawio, ioctl, execute_no_trans ...) - which I want to avoid.

Sudo seems to provide SELinux related attributes, e.g. one can put into the sudoer line something like:

TYPE=unconfined_t ROLE=unconfined_r

But then sudo complains:

sudo: unable to determine enforcing mode.: Permission denied
sudo: unable to execute /usr/sbin/smartctl: Permission denied

How are the TYPE/ROLE supposed to work with sudo (under CentOS 7)?

What about route b) - how to configure this with a custom SELinux policy file?

Answer 1

You can specify a transition in a custom policy file (.te) like this:

module collectdlocalexec 1.0;

require {
        type collectd_t;
        type user_home_t;
        type unconfined_t;
        type shell_exec_t;
        class capability {setgid setuid };
        class file { execute read open };
        class process transition;
}

allow collectd_t self:capability { setgid setuid };
allow collectd_t user_home_t:file { execute read open };
allow collectd_t shell_exec_t:file execute;
allow collectd_t unconfined_t:process transition;

type_transition collectd_t user_home_t:process unconfined_t;

Assuming that the collection script is located under a user's home directory (and that is labeled with user_home_t).