* PAM, GNOME, etc
@ 2009-03-05 6:49 Russell Coker
2009-03-05 15:01 ` Daniel J Walsh
2009-03-05 16:05 ` Stephen Smalley
0 siblings, 2 replies; 3+ messages in thread
From: Russell Coker @ 2009-03-05 6:49 UTC (permalink / raw)
To: SE-Linux; +Cc: Daniel J Walsh
Currently the gdm package in Debian has some degree of SE Linux support (I
haven't yet read the source to see what it does). However it seems that the
pam_selinux.so module is required and that it can't be the last module
(previously I just appended a line to the pam configuration).
session required pam_selinux.so
session optional pam_gnome_keyring.so auto_start
The above is part of my /etc/pam.d/gdm file. The SE Linux module needs to be
run before the pam_gnome_keyring.so module so that the daemon it spawns for
the user will get the correct context.
It seems that we have three broad classes of session modules. Those which
launch no child processes, those which launch system processes (EG automatic
home directory creation), and those which launch user processes (such as a
GNOME keyring).
Dan, what are you guys doing in Fedora in this regard? Are you integrating SE
Linux support manually in every pam.d file to make sure you get it right? It
seems that any automatic method (such as just appending a line to every one
of a set of files) is not going to work.
Or have you patched a bunch of PAM modules to call setexeccon(NULL) before
they call exec()?
--
russell@coker.com.au
http://etbe.coker.com.au/ My Main Blog
http://doc.coker.com.au/ My Documents Blog
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: PAM, GNOME, etc
2009-03-05 6:49 PAM, GNOME, etc Russell Coker
@ 2009-03-05 15:01 ` Daniel J Walsh
2009-03-05 16:05 ` Stephen Smalley
1 sibling, 0 replies; 3+ messages in thread
From: Daniel J Walsh @ 2009-03-05 15:01 UTC (permalink / raw)
To: russell; +Cc: SE-Linux
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Russell Coker wrote:
> Currently the gdm package in Debian has some degree of SE Linux support (I
> haven't yet read the source to see what it does). However it seems that the
> pam_selinux.so module is required and that it can't be the last module
> (previously I just appended a line to the pam configuration).
>
> session required pam_selinux.so
> session optional pam_gnome_keyring.so auto_start
>
> The above is part of my /etc/pam.d/gdm file. The SE Linux module needs to be
> run before the pam_gnome_keyring.so module so that the daemon it spawns for
> the user will get the correct context.
>
> It seems that we have three broad classes of session modules. Those which
> launch no child processes, those which launch system processes (EG automatic
> home directory creation), and those which launch user processes (such as a
> GNOME keyring).
>
> Dan, what are you guys doing in Fedora in this regard? Are you integrating SE
> Linux support manually in every pam.d file to make sure you get it right? It
> seems that any automatic method (such as just appending a line to every one
> of a set of files) is not going to work.
>
> Or have you patched a bunch of PAM modules to call setexeccon(NULL) before
> they call exec()?
>
No we have the pam modules written pretty well. No patching. And we are
trying to get rid of all pam modules that exec system processes.
pam_oddjob_mkhomedir instead of pam_mkhomedir. consolekit/dbus/policykit
instead of pam_console.
pam modules doing extremely privileged apps is always a problem.
pam_mount for example. pam_namespace.
I believe system-config-auth and the defaults all work in Fedora.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org
iEYEARECAAYFAkmv6UUACgkQrlYvE4MpobMiIgCg0cAAhkbsIRVegfvU4qZac5+2
dF0AoOF737Dp2gev+MpJVJL4V12U7UoM
=t2qk
-----END PGP SIGNATURE-----
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: PAM, GNOME, etc
2009-03-05 6:49 PAM, GNOME, etc Russell Coker
2009-03-05 15:01 ` Daniel J Walsh
@ 2009-03-05 16:05 ` Stephen Smalley
1 sibling, 0 replies; 3+ messages in thread
From: Stephen Smalley @ 2009-03-05 16:05 UTC (permalink / raw)
To: russell; +Cc: SE-Linux, Daniel J Walsh
On Thu, 2009-03-05 at 17:49 +1100, Russell Coker wrote:
> Currently the gdm package in Debian has some degree of SE Linux support (I
> haven't yet read the source to see what it does). However it seems that the
> pam_selinux.so module is required and that it can't be the last module
> (previously I just appended a line to the pam configuration).
>
> session required pam_selinux.so
> session optional pam_gnome_keyring.so auto_start
>
> The above is part of my /etc/pam.d/gdm file. The SE Linux module needs to be
> run before the pam_gnome_keyring.so module so that the daemon it spawns for
> the user will get the correct context.
>
> It seems that we have three broad classes of session modules. Those which
> launch no child processes, those which launch system processes (EG automatic
> home directory creation), and those which launch user processes (such as a
> GNOME keyring).
>
> Dan, what are you guys doing in Fedora in this regard? Are you integrating SE
> Linux support manually in every pam.d file to make sure you get it right? It
> seems that any automatic method (such as just appending a line to every one
> of a set of files) is not going to work.
I think they are manually set up and maintained by the package
maintainers, e.g. the gdm source package has a gdm-pam file that already
contains this sequence for session modules:
session required pam_selinux.so close
session required pam_loginuid.so
session optional pam_console.so
session required pam_selinux.so open
session optional pam_keyinit.so force revoke
session required pam_namespace.so
session optional pam_gnome_keyring.so auto_start
session include system-auth
and the openssh source package has a sshd.pam file that looks like this:
# pam_selinux.so close should be the first session rule
session required pam_selinux.so close
session required pam_loginuid.so
# pam_selinux.so open should only be followed by sessions to be executed in the user context
session required pam_selinux.so open env_params
session optional pam_keyinit.so force revoke
session include system-auth
> Or have you patched a bunch of PAM modules to call setexeccon(NULL) before
> they call exec()?
--
Stephen Smalley
National Security Agency
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2009-03-05 16:05 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2009-03-05 6:49 PAM, GNOME, etc Russell Coker
2009-03-05 15:01 ` Daniel J Walsh
2009-03-05 16:05 ` Stephen Smalley
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.