Qubes/core-agent-linux
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

sudo isn’t always built with SELinux support

Browse Source 
Red Hat- and Debian- derived distributions support SELinux, and so their
sudo packages are built with SELinux support.  However, other
distributions (notably Arch) build sudo without SELinux.  Such sudo
builds will fail to parse the `ROLE=unconfined_r TYPE=unconfined_t`
string added in 0fac1aa45c.  They *can*
parse `role=unconfined_r, type=unconfined_t` in `Defaults`, but that
causes problems on some Fedora 33 systems if SELinux is turned off and
the root account is locked.

To solve both of these problems at once, we install a different
`/etc/sudoers.d/qubes` file depending on the distribution.  As a
heuristic, we use the presents of `/etc/redhat-release` or
`/etc/debian_version`.  If either is present, sudo probably supports
SELinux, and we should include the corresponding entries.  If both are
missing, then we shouldn’t risk it.  The `qubes.sudoers` file in the git
repository includes the full file (with SELinux); we use `sed` to strip
the SELinux portion when needed.
This commit is contained in:
Demi Marie Obenour 2021-01-11 04:23:38 -05:00
parent ab9627caf0
commit 188ea74993
No known key found for this signature in database
GPG Key ID: 28A45C93B0B5B6E0
1 changed files with 6 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
passwordless-root/Makefile
View File

@ -8,7 +8,12 @@ PAMCONFIGSDIR = /usr/share/pam-configs/
install: install:
install -d -m 0750 $(DESTDIR)$(SUDOERSDIR) install -d -m 0750 $(DESTDIR)$(SUDOERSDIR)
install -D -m 0440 qubes.sudoers $(DESTDIR)$(SUDOERSDIR)/qubes if [ -f /etc/redhat-release ] || [ -f /etc/debian_version ]; then \
exec install -D -m 0440 qubes.sudoers $(DESTDIR)$(SUDOERSDIR)/qubes; \
else \
sed -E '/^[^#]/s/\<(ROLE|TYPE)=[A-Za-z0-9_]+[[:space:]]+//g' qubes.sudoers | \
install -D -m 0440 /dev/stdin $(DESTDIR)$(SUDOERSDIR)/qubes; \
fi
install -D -m 0644 polkit-1-qubes-allow-all.pkla $(DESTDIR)$(POLKIT1DIR)/localauthority/50-local.d/qubes-allow-all.pkla install -D -m 0644 polkit-1-qubes-allow-all.pkla $(DESTDIR)$(POLKIT1DIR)/localauthority/50-local.d/qubes-allow-all.pkla
install -d -m 0750 $(DESTDIR)$(POLKIT1DIR)/rules.d install -d -m 0750 $(DESTDIR)$(POLKIT1DIR)/rules.d
install -D -m 0644 polkit-1-qubes-allow-all.rules $(DESTDIR)$(POLKIT1DIR)/rules.d/00-qubes-allow-all.rules install -D -m 0644 polkit-1-qubes-allow-all.rules $(DESTDIR)$(POLKIT1DIR)/rules.d/00-qubes-allow-all.rules