Users which acquire a root shell on a SELinux system can change their SELinux context without entering any password, unlike what does the newrole command.


Step to reproduce:
1. Log into a SELinux system as a sudoer user whose SELinux user is staff_u:staff_r:staff_t.
2. Spawn a root shell (with su, sudo -s or by exploiting a privilege escalation vulnerability).
3. Run "sudo -r sysadm_r -t sysadm_t -s" to became SELinux user staff_u:sysadm_r:sysadm_t.

Actual results:
Root user can change role without entering its password.

Expected reults:
The third command should ask for root password to change role, like newrole does.

Additional info:
On system where there is no root password, staff_u users can use "sudo -r sysadm_r -t sysadm_t" to run commands in staff_u:sysadm_r:sysadm_t context or use newrole before running sudo. All of these commands ask for user password, as expected.

I did these tests on an amd64 Debian sid system with sudo 1.8.7-3 package.