Bug 2230857 - MLS: logging in through ssh as root ends up being "staff_t" instead of "sysadm_t"
Summary: MLS: logging in through ssh as root ends up being "staff_t" instead of "sysad...
Keywords:
Status: NEW
Alias: None
Product: Red Hat Enterprise Linux 9
Classification: Red Hat
Component: selinux-policy
Version: 9.2
Hardware: All
OS: Linux
medium
medium
Target Milestone: rc
: ---
Assignee: Nikola Knazekova
QA Contact: BaseOS QE Security Team
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2023-08-10 07:40 UTC by Renaud Métrich
Modified: 2023-08-17 07:55 UTC (History)
3 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed:
Type: Bug
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Issue Tracker RHELPLAN-165348 0 None None None 2023-08-10 07:42:00 UTC

Description Renaud Métrich 2023-08-10 07:40:01 UTC
Description of problem:

On my freshly setup MLS system, I can see that logging in as root through ssh ends up getting "staff_t" context:
~~~
-bash: /root/.bash_profile: Permission denied
[root@vm-mls9 ~]# id -Z
root:staff_r:staff_t:s0-s15:c0.c1023
~~~

Version-Release number of selected component (if applicable):

selinux-policy-mls-38.1.11-2.el9_2.3.noarch

How reproducible:

Always

Additional info:

Our doc [1] states the context should be sysadm_t (hence we cannot login without the boolean) but apparently there is some bug here.

~~~
[1] https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/using_selinux/using-multi-level-security-mls_using-selinux#switching-the-selinux-policy-to-mls_using-multi-level-security-mls

Important note:
[...]
Also note that in MLS, SSH logins as the root user mapped to the sysadm_r SELinux role differ from logging in as root in staff_r.
~~~

Comment 1 Renaud Métrich 2023-08-11 06:28:10 UTC
The root cause is the below line in /etc/selinux/mls/contexts/users/root:
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------
#
# Uncomment if you want to automatically login as sysadm_r
#
#system_r:sshd_t:s0		unconfined_r:unconfined_t:s0 sysadm_r:sysadm_t:s0 staff_r:staff_t:s0 user_r:user_t:s0
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------

I think this is non-sense because logging in as root with default staff_t context makes the root user become unusable.

Anyway, either the documentation of this line has to be modified.


Note You need to log in before you can comment on or make changes to this bug.