5

I have a daemon (collectd) that executes a script for data collection (via smartctl).

The exec-plugin of collectd mandates that external scripts are executed under a user != root.

The plan is to set it up like this:

  • allow collectd to change the user and perhaps execute the script (via SELinux)
  • create a system user X for the task at hand
  • configure sudo such that X is allowed to execute smartctl
  • configure SELinux such that a) sudo transitions to a (say) unconfined domain b) the setuid to user X (or the execution of the script) transitions to an unconfined domain

I've come up with the last step - because otherwise there is no transition, and I have to allow collectd all the smartctl related low-level permissions (e.g. sys_rawio, ioctl, execute_no_trans ...) - which I want to avoid.

Sudo seems to provide SELinux related attributes, e.g. one can put into the sudoer line something like:

TYPE=unconfined_t ROLE=unconfined_r

But then sudo complains:

sudo: unable to determine enforcing mode.: Permission denied
sudo: unable to execute /usr/sbin/smartctl: Permission denied

How are the TYPE/ROLE supposed to work with sudo (under CentOS 7)?

What about route b) - how to configure this with a custom SELinux policy file?

3

You can specify a transition in a custom policy file (.te) like this:

module collectdlocalexec 1.0;

require {
        type collectd_t;
        type user_home_t;
        type unconfined_t;
        type shell_exec_t;
        class capability {setgid setuid };
        class file { execute read open };
        class process transition;
}

allow collectd_t self:capability { setgid setuid };
allow collectd_t user_home_t:file { execute read open };
allow collectd_t shell_exec_t:file execute;
allow collectd_t unconfined_t:process transition;

type_transition collectd_t user_home_t:process unconfined_t;

Assuming that the collection script is located under a user's home directory (and that is labeled with user_home_t).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.