/bin/su permission denied after SELinux is enabled - not resolved by manual creation of SELinux policies

Question

I want to add a image to the content of a textarea (replaced by CKEDITOR).

What I have is a script, that takes the image uploaded, and transforms it to BASE64 (after downsizing it).

And I know, that the textarea of CKEDITOR is able to show images (as there is the possibility to insert images via url). But actually nothing I tried is working.

So I have a textarea with the ID editorand I replace it by var editor = CKEDITOR.replace('editor');.

What I tried is $('#editor').append('<img src="data:image/jpeg;base64,.........), not working. I also tried iit with editor.insertHTML()but that doesn't work as well....

What I tried now, is to insert the base64-string in the url input of CKEDITOR (when adding an image), that worked. So does anybody know how I can do that? Either by just appending an image with the base64 as src, or by inserting the base64-string as url for the built in image upload function.

Solution

Your problem is your running in the user_t domain as root.

user_t does not have access to su.

Change your user to the staff_u user, that should make it go away.

semanage login -a -s staff_u -r s0 rilindo

Also, note su, on its own wont help you in this regard since you'll su into the staff_t type which wont do everything you want.

To fix this, edit sudoers and add your user to it such as this:

rilindo  ALL=(ALL)       ROLE=sysadm_r   TYPE=sysadm_t  ALL

Now, you can do sudo su - and wont get an issue!

Comments

[Rilindo]

Almost there. Is the sudoers syntax correct? I am getting the message ">>> /etc/sudoers: syntax error near line 114 <<<" when I am attempted to save the file.

[Matthew Ife]

My bad, needs an ALL On the end too, I edited my comment to reflect that.

[Rilindo]

That did it. WINNNNAAHHH!!!!!!!

[Rilindo]

That said, I am getting this: [rilindo@kerberos ~]$ sudo su - [sudo] password for rilindo: sudo: Can't open /var/db/sudo/rilindo/14 It doesn't prevent me from sudoing, though.

[Matthew Ife]

Probably is labelled incorrectly now as you were user_u. Relabel the file to staff_u:object_r:sudo_db_t for all the files in your user folder. Oh and the actual directory named after your user.

[Rilindo]

Yep. /var/db/sudo didn't have sudo_db_t, even after I applied it to /var/db/sudo/rilindo, so I applied the type as well. Now it is completely fixed. Thanks again!

[Vishnu]

stackoverflow.com/questions/55298230/… Can anyone check this