Bug 1691351

+++ This bug was initially created as a clone of Bug #1688887 +++

Description of problem:

When user is confined to "staff_u" or "sysadm_u", executing "sudo su" fails in error:

-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------
$ sudo su
su: avc.c:74: avc_context_to_sid_raw: Assertion `avc_running' failed.
Aborted
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------


Version-Release number of selected component (if applicable):

selinux-policy-3.14.1-61.el8.noarch
selinux-policy-devel-3.14.1-61.el8.noarch
selinux-policy-targeted-3.14.1-61.el8.noarch
sudo-1.8.25p1-4.el8.x86_64

How reproducible:

Always


Steps to Reproduce:

1. Update system to latest 8.0

  # yum -y update

2. Create confined administrators with sudo capabilities

  # useradd -Z staff_u -G wheel staff
  # echo "staff" | passwd --stdin staff

  # useradd -Z sysadm_u -G wheel sysadm
  # echo "sysadm" | passwd --stdin sysadm
  # semanage boolean -m --on ssh_sysadm_login

3. Log as "staff" and try to "sudo su". Do the same with "sysadm"

  # ssh staff@localhost
  $ id -Z
  staff_u:staff_r:staff_t:s0-s0:c0.c1023
  $ sudo su
  su: avc.c:74: avc_context_to_sid_raw: Assertion `avc_running' failed.
  Aborted
  $ exit

  # ssh sysadm@localhost
  $ id -Z
  sysadm_u:sysadm_r:sysadm_t:s0-s0:c0.c1023
  $ sudo su
  su: avc.c:74: avc_context_to_sid_raw: Assertion `avc_running' failed.
  Aborted
  $


Additional info:

The following module fixes the issue:

-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------
module staff_sysadm_sudo_su 1.0;

require {
	type security_t;
	type staff_sudo_t;
	type sysadm_sudo_t;
	type lastlog_t;
	class passwd passwd;
	class netlink_selinux_socket { bind create };
	class file { open read write };
	class security compute_av;
}

allow staff_sudo_t lastlog_t:file { open read write };
allow staff_sudo_t security_t:security compute_av;
allow sysadm_sudo_t lastlog_t:file { open read write };
allow sysadm_sudo_t security_t:security compute_av;

allow staff_sudo_t self:netlink_selinux_socket { bind create };
allow staff_sudo_t self:passwd passwd;
allow sysadm_sudo_t self:netlink_selinux_socket { bind create };
allow sysadm_sudo_t self:passwd passwd;
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------