Red Hat Bugzilla – Bug 1336902
chpasswd allows for SELinux sandbox breakout in certain situations
Last modified: 2016-11-03 23:41:42 EDT
Description of problem: chpasswd is not SELinux aware, but is granted a default policy as if it was. Therefore root accounts with SELinux restrictions can bypass these restrictions. Version-Release number of selected component (if applicable): redhat-release-server-7.2-9.el7.x86_64 How reproducible: Always. Steps to Reproduce: 1. Create administrative account e.g. superadmin, add to wheel group 2. Add superadmin to staff_u or root selinux group: semanage -a -s root -r s0-s0:c0.c1023 superadmin 3. Restrict root account to user_u user context: semanage -m -s user_u -r s0 root 4. As "user_u" root account, change superadmin's password: echo "superadmin:owned" | chpasswd Actual results: Password of superadmin is changed to owned. This is unexpected since user_u should not be able to change the password of someone with a user context of root. Expected results: Access denied since it is the user_u context. Additional info: 7.1 does not have this issue since the chpasswd binary is labeled as bin_t. That is only a temporary fix, the actual fix being making chpasswd SELinux aware/supported (upstream issue: https://github.com/shadow-maint/shadow/issues/22).
This change should be reverted in selinux-policy for now. Adding selinux support to chpasswd would have to be done upstream first.
RHEL-7.1 ======== # matchpathcon `which chpasswd ` /usr/sbin/chpasswd system_u:object_r:bin_t:s0 # RHEL-7.2 ======== # matchpathcon `which chpasswd ` /usr/sbin/chpasswd system_u:object_r:passwd_exec_t:s0 #
Hi Tomas, This change is related to this bz: https://bugzilla.redhat.com/show_bug.cgi?id=1243458 We should find other way how to fix it.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://rhn.redhat.com/errata/RHBA-2016-2322.html