https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=299029
Bug ID: 299029
Summary: mac_do(4) gid rule example gives mdo: setcred():
Operation not permitted
Product: Base System
Version: 15.1-RELEASE
Hardware: amd64
OS: Any
Status: New
Severity: Affects Only Me
Priority: ---
Component: kern
Assignee: [email protected]
Reporter: [email protected]
This is a slightly unsatisfactory bug report in that mac_do/mdo is not behaving
as I expect and seemingly not behaving in line with documentation. This is not
necessarily the same as it not behaving as it was intended.
My aim is to use the FreeBSD-native mdo(1) in place of sudo(1) where the
feature set of the latter is not required. I have created a group for
administrators with gid 2000. This is set as a supplementary group for the
users. I would like members of this group to be able to escalate their
privileges to root without a password (equivalent to sudo rule %administrators
ALL=(ALL) NOPASSWD: ALL).
To that end I have loaded the mac_do module and defined a single rule,
following an example in the mac_do(4) man page:
gid=10001>uid=0
Makes 10001 a more powerful `wheel' group, allowing its members
to
switch to root without password.
The example did not work.
I am unsure whether the issue lies with:
- Documentation inaccuracy
- My inability to understand the documentation and how mdo is meant to be used
- An issue parsing of mac_do rules, which is quite complex
(https://cgit.freebsd.org/src/tree/sys/security/mac_do/mac_do.c?h=releng/15.1#n871)
- An issue with mdo(1).
All testing on (uname -srmi)
FreeBSD 15.1-RELEASE-p4 amd64 GENERIC.
For a given user "example":
% id
uid=1001(example) gid=1001(example) groups=2000(administrators),1001(example)
Rules that do work successfully:
# sysctl security.mac.do.rules="gid=2000>any"
# sysctl security.mac.do.rules="gid=2000>uid=0,gid=*,+gid=*"
# sysctl security.mac.do.rules="gid=2000>uid=0,gid=any,+gid=any"
All give:
% mdo id
uid=0(root) gid=0(wheel) groups=0(wheel),5(operator)
I wondered whether I might be using mdo(1) incorrectly and that I might need to
explicitly drop supplementary group membership but trying to implement some
examples from the mdo(1) man page:
# sysctl security.mac.do.rules
security.mac.do.rules: gid=2000>uid=0
% id
uid=1001(example) gid=1001(example) groups=1001(example),2000(administrators)
How I might expect to use sudo:
% mdo id
mdo: setcred(): Operation not permitted
Explicitly setting user and group membership:
% mdo -u root -g wheel -G operator id
mdo: setcred(): Operation not permitted
Explicitly setting root as user (implied with -u omitted as I understand):
% mdo -u root id
mdo: setcred(): Operation not permitted
Attempting to add and subtract group membership:
% mdo -u root -s +wheel,+operator,-example id
mdo: setcred(): Operation not permitted
% mdo -u root -s -example id
mdo: setcred(): Operation not permitted
Starting with an empty list
% mdo -u root -s @,+wheel,+operator id
mdo: setcred(): Operation not permitted
% mdo -u root -s @,+wheel,+operator,-example id
mdo: setcred(): Operation not permitted
In case I had misunderstood the mac_do(4) wheel group example I also tried
adding the user to the wheel group:
% id
uid=1001(example) gid=1001(example)
groups=0(wheel),1001(example),2000(administrators)
% mdo id
mdo: setcred(): Operation not permitted
% mdo -u root -G wheel id
mdo: setcred(): Operation not permitted
For completeness I managed to make a "gid=0>uid=0" rule work for the example
user by setting wheel as the primary group for the user, with operator as the
only supplementary group, though this obviously isn't very satisfactory.
Thank you in advance.
--
You are receiving this mail because:
You are the assignee for the bug.
