Confined sysadm users cannot execute administrative commands using `sudo`, "sesh: unable to execute <command>: Permission denied" is printed

Solution Verified - Updated -

Issue

  • When a user is confined to staff_u SELinux user and switches role to sysadm_r while trying to execute an administrative command under sudo, e.g. /sbin/postsuper, the following error is returned

    $ sudo -r sysadm_r /sbin/postsuper
    sesh: unable to execute /sbin/postsuper: Permission denied
    
  • Same issue happens for staff_u SELinux users which automatically switch role to sysadm_r when executing sudo

Environment

  • Red Hat Enterprise Linux 8
    • confined staff_u users
    • selinux
    • sudo

Subscriber exclusive content

A Red Hat subscription provides unlimited access to our knowledgebase, tools, and much more.

Current Customers and Partners

Log in for full access

Log In

New to Red Hat?

Learn more about Red Hat subscriptions

Using a Red Hat product through a public cloud?

How to access this content