I am trying to block privileges escalations from unprivileged accounts such as www-data.

Basically, if my web server is getting compromised, crackers may find ways to escalate (vulnerabilities found in sudo? root password reuse from another cracked server ?). I want to find a way to forbid this, and I found that putting ``www-data`` into ``user_t`` selinux profile has this effect.

However, looking at the ``audit.log`` file when ``www-data`` tries to ``sudo`` or ``su`` shows this:

For sudo:

    type=AVC msg=audit(1533818833.807:318): avc:  denied  { setuid } for  pid=1417 comm="sudo" capability=7  scontext=user_u:user_r:user_t:s0 tcontext=user_u:user_r:user_t:s0 tclass=capability

	Was caused by:
	The boolean selinuxuser_use_ssh_chroot was set incorrectly. 
	Description:
	Allow selinuxuser to use ssh chroot

	Allow access by executing:
	# setsebool -P selinuxuser_use_ssh_chroot 1

For su:

    type=AVC msg=audit(1533818282.076:263): avc:  denied  { write } for  pid=1354 comm="su" name="btmp" dev="dm-0" ino=8428621 scontext=user_u:user_r:user_t:s0 tcontext=system_u:object_r:faillog_t:s0 tclass=file

	Was caused by:
		Missing type enforcement (TE) allow rule.

		You can use audit2allow to generate a loadable module to allow this access.

So, for ``sudo``, it looks like more than a bug (why selinuxuser_use_ssh_chroot ??!) and for ``su``, the deny comes from insufficient rights on ``/var/log/wtmp``

Is this method efficient to block possible escalation from untrusted users ? Or does it look more than a hack ? Is this sufficient to prevent compromised user with root password to get root access ?

Many thanks!