Confined user mapped to SELinux sysadm_r, cannot run realm commands even after sudo'ing
Issue
When a user is running as SELinux role sysadm_r, realm commands do not work.
$ id -Z
staff_u:staff_r:staff_t:s0-s0:c0.c1023
$ sudo id -Z
staff_u:sysadm_r:sysadm_t:s0-s0:c0.c1023
$ sudo realm list
realm: Couldn't load the realm service: An SELinux policy prevents this sender from sending this message to this recipient, 0 matched rules; type="method_call", sender=":1.137" (uid=0 pid=3006 comm="/sbin/realm list ") interface="org.freedesktop.DBus.ObjectManager" member="GetManagedObjects" error name="(unset)" requested_reply="0" destination=":1.138" (uid=0 pid=3009 comm="/usr/lib64/realmd/realmd ")
Environment
- Red Hat Enterprise Linux 7 and later
- confined user mapped to sysadm_u or transitioning to sysadm_r
- realm
- SELinux
- /etc/sudoers
Subscriber exclusive content
A Red Hat subscription provides unlimited access to our knowledgebase, tools, and much more.