Needs to prevent executing su.

[Russell Coker]

On Mon, 14 Jun 2004 17:48, "Igor Borisovsky" <igor at datanaut.com> wrote:
> Let me explain in more details my problem.
> What I did:
> 1. prevented root access to the postgresql data files located at
> /var/lib/pgsql;

Presumably you mean that you prevented sysadm_t access.

> 2. created custom pgsql_t type and pgsql_r role;
> 3. created selinux user postgres:
> 	user postgres roles pgsql_r;
> 4. all postgresql directories and files has a proper types(e.g.
> pgsql_home_dir_t, pgsql_home_t).
> Therefore I have two persons: root and postgres. User root is the server
> administrator, but
> he can't access to the postgresql data files. And user postgres is the
> database administrator.
> He will do all database related operations(e.g. database backup). Hence
> postgres has access
> to the postgresql data files. So for security reason i need to prevent
> transition from user root to user postgres.

Then you will need to prevent sysadm_t from accessing pgsql_home_dir_t and 
pgsql_home_t as well...

You could change macros/program/su_macros.te, replace the following line:
domain_trans($1_su_t, shell_exec_t, userdomain)
With:
domain_trans($1_su_t, shell_exec_t, { user_t staff_t sysadm_t })

-- 
http://www.coker.com.au/selinux/   My NSA Security Enhanced Linux packages
http://www.coker.com.au/bonnie++/  Bonnie++ hard drive benchmark
http://www.coker.com.au/postal/    Postal SMTP/POP benchmark
http://www.coker.com.au/~russell/  My home page