3.8. Confining an administrator by mapping to sysadm_u

Procedure

1. Optional: To allow sysadm_u users to connect to the system by using SSH:

   # setsebool -P ssh_sysadm_login on

2. Map a new or existing user to the sysadm_u SELinux user:

   • To map a new user, add a new user to the wheel user group and map the user to the sysadm_u SELinux user:

     # adduser -G wheel -Z sysadm_u <example_user>

   • To map an existing user, add the user to the wheel user group and map the user to the sysadm_u SELinux user:

     # usermod -G wheel -Z sysadm_u <example_user>

3. Restore the context of the user’s home directory:

   # restorecon -R -F -v /home/<example_user>

Verification

1. Check that <example_user> is mapped to the sysadm_u SELinux user:

   # semanage login -l | grep <example_user>
   <example_user>     sysadm_u    s0-s0:c0.c1023   *

2. Log in as <example_user>, for example, by using SSH, and show the user’s security context:

   [<example_user>@localhost ~]$ id -Z
   sysadm_u:sysadm_r:sysadm_t:s0-s0:c0.c1023

3. Switch to the root user:

   $ sudo -i
   [sudo] password for <example_user>:

4. Verify that the security context remains unchanged:

   # id -Z
   sysadm_u:sysadm_r:sysadm_t:s0-s0:c0.c1023

5. Try an administrative task, for example, restarting the sshd service:

   # systemctl restart sshd

   If there is no output, the command finished successfully.

   If the command does not finish successfully, it prints the following message:

   Failed to restart sshd.service: Access denied
   See system logs and 'systemctl status sshd.service' for details.