3.9. Confining an administrator by using sudo and the sysadm_r role

Procedure

1. Map a new or existing user to the staff_u SELinux user:

   1. To map a new user, add a new user to the wheel user group and map the user to the staff_u SELinux user:

      # adduser -G wheel -Z staff_u <example_user>

   2. To map an existing user, add the user to the wheel user group and map the user to the staff_u SELinux user:

      # usermod -G wheel -Z staff_u <example_user>

2. Restore the context of the user’s home directory:

   # restorecon -R -F -v /home/<example_user>

3. To allow <example_user> to gain the SELinux administrator role, create a new file in the /etc/sudoers.d/ directory, for example:

   # visudo -f /etc/sudoers.d/<example_user>

4. Add the following line to the new file:

   <example_user> ALL=(ALL) TYPE=sysadm_t ROLE=sysadm_r ALL

Verification

1. Check that <example_user> is mapped to the staff_u SELinux user:

   # semanage login -l | grep <example_user>
   <example_user>     staff_u    s0-s0:c0.c1023   *

2. Log in as <example_user>, for example, by using SSH, and switch to the root user:

   [<example_user>@localhost ~]$ sudo -i
   [sudo] password for <example_user>:

3. Show the root security context:

   # id -Z
   staff_u:sysadm_r:sysadm_t:s0-s0:c0.c1023

4. Try an administrative task, for example, restarting the sshd service:

   # systemctl restart sshd

   If there is no output, the command finished successfully.

   If the command does not finish successfully, it prints the following message:

   Failed to restart sshd.service: Access denied
   See system logs and 'systemctl status sshd.service' for details.