In this lesson, you will learn how to monitor and constrain the use of privileged escalation tools by enforcing strict Mandatory Access Control (MAC) security contexts.
The Principle of Constrained Escalation
Privileged escalation—the act of moving from a standard user to root—is a necessary function in Linux, but it is also the primary target for attackers. In a hardened environment, we don't just log sudo usage; we define where and how escalation is permitted. By assigning strict security contexts to binaries like sudo or pkexec, we ensure that even if a user manages to execute them, the resulting process inherits a limited, predefined policy rather than unrestricted administrative power.
Implementing Strict Contexts
Using a MAC framework like SELinux, we can restrict the transition of security contexts. When a user runs sudo, the system checks if the source context (the user's shell) is authorized to transition into the target context (the administrative shell).
Consider a scenario where a user is permitted to use sudo only for specific maintenance tasks. We define a policy that denies the transition unless the binary is executing from an authorized path with a specific security label:
# Example: Define a transition rule that forces
# specific context constraints during escalation
type_transition user_t sudo_exec_t : process admin_t;
allow user_t sudo_exec_t : file { execute execute_no_trans };
allow admin_t self : process { transition };
By applying these rules, you prevent "lateral movement" within the privileged space. If an attacker attempts to spawn a shell via an unconstrained binary, the MAC layer denies the request because the execution context does not match the strict policy defined for that specific binary path.
Why This Matters for Auditing
Auditing isn't just about logs; it's about verifying that the security context transitions occur only as intended. When you audit, you should check for "denial patterns" where an escalation attempt was blocked because it lacked the correct security context. If you see unauthorized transitions occurring, it is a clear indicator of a policy breach or an attempt to bypass standard escalation flows.
Key Takeaway: Auditing privileged escalation requires enforcing MAC policies that constrain binary execution to strict security contexts, ensuring that elevated processes operate only within a defined scope.