Back to igraltist's experiences/ACL
On standard linux system nothing prevented the root user switch to any other user.
This is only example for ACL. The AUTH and or the RC module is much comfortable. All have to do as security user (uid 400).
Named as example Suing.
The P is using as type Private. The other options is G as type Global.
The number 1 on then and set the group-id. So it was empty on test befor and therefor i using the number 1.
$acl_group add_group P Suing 1
$acl_group list_groups Group 1: owner 400 (security), type P, name 'Suing'
The subj_type is GROUP.
The subj_id is the group-id number from previous created group.
The rights is A which grant all.
The target-type is FILE.
The filename is the absolute pathname /bin/su.
$acl_grant GROUP 1 A FILE /bin/su
The number 1 after add_member indicates the group-id number.
The number 1000 is in my case the first default user-id.
$acl_group add_member 1 1000
$acl_group get_group_members 1 1000 jens
List the rights and save it to restore later.
$acl_rights FILE /bin/su /bin/su : 11100000011000011111101110100000011011110011111111110110100
The rights [-s] is set to 0.
The target-type is FILE.
The filename is the absolute path /bin/su.
$acl_mask -s 0 FILE /bin/su
$acl_rights FILE /bin/su /bin/su : 10000000000000000000000000000000000000000000000000000000000
From now on, only member from 'ACL' group Suing are able to change to other user, when 'ACL' is using.
su - security -bash: /bin/su: Operation not permitted
This is the output from security-log.
0000000658|rsbac_adf_request(): request EXECUTE, pid 26958, ppid 14663, prog_name bash, prog_file /bin/bash, uid 0, remote ip 192.168.1.5, target_type FILE, tid Device 253:01 Inode 88530 Path /bin/su, attr none, value none, result NOT_GRANTED by ACL
The root user don't have EXECUTE rights, because befor we remove with acl_mask the default rights and set them to zero.
For example to remove an user from a acl file entry:
acl_grant -m USER "ID" FILE "/path/to/file"
Create a acl group to assing to file /bin/dmesg.
acl_group add_group P Dmesg 2
Add the acl group to the file.
acl_grant GROUP 2 A FILE /bin/dmesg
Remove all default entries from the target file.
acl_mask -s 0 FILE /bin/dmesg
Try the setup.
dmesg -bash: /bin/dmesg: Operation not permitted
Visit the rsbac logfile.
Fri Jul 1 06:09:32 2011 :<6>0000000416|rsbac_adf_request(): request GET_STATUS_DATA, pid 15922, ppid 15921, prog_name bash, prog_file /bin/bash, uid 1000, remote ip 192.168.1.5, target_type FILE, tid Device 253:14 Inode 72435 Path /bin/dmesg, attr none, value none, result NOT_GRANTED by ACL Fri Jul 1 06:09:34 2011 :<6>0000000417|rsbac_adf_request(): request EXECUTE, pid 10231, ppid 15922, prog_name bash, prog_file /bin/bash, uid 1000, remote ip 192.168.1.5, target_type FILE, tid Device 253:14 Inode 72435 Path /bin/dmesg, attr none, value none, result NOT_GRANTED by ACL
The 'ACL' modul offers a good possibility and is easy to use.
This example can easy modify to use on other cases.