* src:shadow: dropping passwd shortcut
@ 2019-10-17 21:24 Christian Göttsche
0 siblings, 0 replies; only message in thread
From: Christian Göttsche @ 2019-10-17 21:24 UTC (permalink / raw)
To: selinux
Hi,
I am working to migrate src:shadow to today's SELinux api as
previously mentioned.
Currently there is a shortcut in the passwd check:
If user root tries to change a password for another user AND the
user-identity part (before first colon) of the previous (exec-wise)
context equals the username in question, no SELinux check is
performed.
Stephen suggested to drop this logic as nowadays SELinux
user-identities rarely matches usernames and we only skip is simple
passwd:passwd check.
So I'd like to announce that this logic is probably going to be removed.
Kind regards,
Christian Göttsche
p.s.:
in fedoras passwd, the logic does not exist:
https://pagure.io/passwd/blob/master/f/selinux_utils.c
^ permalink raw reply [flat|nested] only message in thread
only message in thread, other threads:[~2019-10-17 21:24 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-10-17 21:24 src:shadow: dropping passwd shortcut Christian Göttsche
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).