* Display all processes using ps
@ 2010-06-12 23:36 Guido Trentalancia
2010-06-14 13:37 ` Dominick Grift
2010-06-15 14:12 ` Daniel J Walsh
0 siblings, 2 replies; 4+ messages in thread
From: Guido Trentalancia @ 2010-06-12 23:36 UTC (permalink / raw)
To: selinux
Hello everybody !
I am logging as root on a remote MLS machine using ssh so the default
role is staff_r. However, I need to execute ps (to display all system
processes, "ps -ax") over ssh. Unfortunately, ps does not show all
processes that are normally displayed when using the sysadm_r role
because it runs in the staff_r role.
What would be the safest way to allow ps over ssh to show all processes
running on the system ?
Thanks for your help.
Guido
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: Display all processes using ps
2010-06-12 23:36 Display all processes using ps Guido Trentalancia
@ 2010-06-14 13:37 ` Dominick Grift
2010-06-15 14:12 ` Daniel J Walsh
1 sibling, 0 replies; 4+ messages in thread
From: Dominick Grift @ 2010-06-14 13:37 UTC (permalink / raw)
To: selinux
[-- Attachment #1: Type: text/plain, Size: 871 bytes --]
On Sun, Jun 13, 2010 at 01:36:04AM +0200, Guido Trentalancia wrote:
> Hello everybody !
>
> I am logging as root on a remote MLS machine using ssh so the default
> role is staff_r. However, I need to execute ps (to display all system
> processes, "ps -ax") over ssh. Unfortunately, ps does not show all
> processes that are normally displayed when using the sysadm_r role
> because it runs in the staff_r role.
>
> What would be the safest way to allow ps over ssh to show all processes
> running on the system ?
login using the sysadm_t domain? ssh root/sysadm_r@localhost
>
> Thanks for your help.
>
> Guido
>
>
> --
> This message was distributed to subscribers of the selinux mailing list.
> If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
> the words "unsubscribe selinux" without quotes as the message.
[-- Attachment #2: Type: application/pgp-signature, Size: 198 bytes --]
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: Display all processes using ps
2010-06-12 23:36 Display all processes using ps Guido Trentalancia
2010-06-14 13:37 ` Dominick Grift
@ 2010-06-15 14:12 ` Daniel J Walsh
1 sibling, 0 replies; 4+ messages in thread
From: Daniel J Walsh @ 2010-06-15 14:12 UTC (permalink / raw)
To: Guido Trentalancia; +Cc: selinux
On 06/12/2010 07:36 PM, Guido Trentalancia wrote:
> Hello everybody !
>
> I am logging as root on a remote MLS machine using ssh so the default
> role is staff_r. However, I need to execute ps (to display all system
> processes, "ps -ax") over ssh. Unfortunately, ps does not show all
> processes that are normally displayed when using the sysadm_r role
> because it runs in the staff_r role.
>
> What would be the safest way to allow ps over ssh to show all processes
> running on the system ?
>
> Thanks for your help.
>
> Guido
>
>
> --
> This message was distributed to subscribers of the selinux mailing list.
> If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
> the words "unsubscribe selinux" without quotes as the message.
If you want to allow staff this, you need to add
mls_file_read_to_clearance(staff_t)
And make sure staff_t has SystemLow-SystemHigh
Or if you want to be more specific you could add a new constraint, like
the one in MCS
mlsconstrain file { read ioctl lock execute execute_no_trans }
(( h1 dom h2 ) or ( t1 == mcsreadall ) or ( t2 == domain ));
And then allow staff_t to read all process files but no others.
Or turn on the
ssh_sysadm_login boolean
and log in
ssh dwalsh/sysadm_r@remotehost
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: Display all processes using ps
@ 2010-06-14 11:31 Dennis Wronka
0 siblings, 0 replies; 4+ messages in thread
From: Dennis Wronka @ 2010-06-14 11:31 UTC (permalink / raw)
To: Guido Trentalancia, selinux
[-- Attachment #1: Type: text/plain, Size: 1112 bytes --]
Can't tell you how to enable it for SSH only. I guess you'll need to edit the policy for that.
But in general you should be able to control ps's behavior using an SELinux boolean.
Look through "getsebool -a", you should be able to find it.
Sent from my HTC
----- Reply message -----
From: "Guido Trentalancia" <guido@trentalancia.com>
Date: Sun, Jun 13, 2010 07:36
Subject: Display all processes using ps
To: <selinux@tycho.nsa.gov>
Hello everybody !
I am logging as root on a remote MLS machine using ssh so the default
role is staff_r. However, I need to execute ps (to display all system
processes, "ps -ax") over ssh. Unfortunately, ps does not show all
processes that are normally displayed when using the sysadm_r role
because it runs in the staff_r role.
What would be the safest way to allow ps over ssh to show all processes
running on the system ?
Thanks for your help.
Guido
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
[-- Attachment #2: Type: text/html, Size: 1280 bytes --]
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2010-06-15 14:13 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2010-06-12 23:36 Display all processes using ps Guido Trentalancia
2010-06-14 13:37 ` Dominick Grift
2010-06-15 14:12 ` Daniel J Walsh
2010-06-14 11:31 Dennis Wronka
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.