file_contexts: make /usr/share/pam equivalent to /etc#1125
Conversation
PAM 1.7.2 makes the vendordir build option the default. This puts PAM's config files in /usr/share/pam rather than /etc. Unfortunately this makes the default file contexts for these files usr_t which breaks many things. Fix this by adding a file equivalence rule for /usr/share/pam. Bug: https://bugs.gentoo.org/973082 Closes: SELinuxProject#1123 Signed-off-by: Kenton Groombridge <concord@gentoo.org>
|
Actually, I think we want #1123 instead. My understanding is the vendordir stuff is supposed to be the defaults, and if you want to change an option, then you place the modified configuration file in /etc. In that scenario, we would want /usr/share/pam to be read-only except to only to the package manager and sysadm. |
Yeah, that's right. More projects are moving to that because |
How should this apply for |
|
Yes, that sounds right. |
Per SELinuxProject#1125 (comment), pam_namespace tries /etc/security/namespace.init then /usr/share/pam/security/namespace.init, so it needs to be bin_t. Signed-off-by: Sam James <sam@gentoo.org>
|
I've reopened #1123 and added the label there. I don't use |
Per SELinuxProject#1125 (comment), pam_namespace tries /etc/security/namespace.init then /usr/share/pam/security/namespace.init, so it needs to be bin_t. Signed-off-by: Sam James <sam@gentoo.org>
.. by allowing /usr overall. pam installs these configuration files there
as its `vendordir`. It also does this since aea30822e2fa6f87faf2541da140f69dfdfee728.
(I think that commit message isn't quite right: it seems to do this regardless
of libeconf support.)
This comes from auth_use_pam which sudo and su use:
```
AVC avc: denied { getattr } for pid=239941 comm="su" path="/usr/share/pam/security/faillock.conf" dev="dm-0" ino=3227904748
scontext=staff_u:sysadm_r:sysadm_su_t:s0-s0:c0.c1023
tcontext=system_u:object_r:usr_t:s0
tclass=file
AVC avc: denied { read } for pid=239938 comm="sudo" name="pam_env.conf" dev="dm-0" ino=3227906195
scontext=staff_u:staff_r:staff_sudo_t:s0-s0:c0.c1023
tcontext=system_u:object_r:usr_t:s0
tclass=file
```
This is a followup to 169f725.
Bug: https://bugs.gentoo.org/973082
See-also: SELinuxProject#1125
Signed-off-by: Sam James <sam@gentoo.org>
Per SELinuxProject#1125 (comment), pam_namespace tries /etc/security/namespace.init then /usr/share/pam/security/namespace.init, so it needs to be bin_t. Closes: SELinuxProject#1125 Signed-off-by: Sam James <sam@gentoo.org>
Per SELinuxProject#1125 (comment), pam_namespace tries /etc/security/namespace.init then /usr/share/pam/security/namespace.init, so it needs to be bin_t. Closes: SELinuxProject#1125 Signed-off-by: Sam James <sam@gentoo.org>
3 participants
PAM 1.7.2 makes the vendordir build option the default. This puts PAM's config files in
/usr/share/pamrather than/etc. Unfortunately this makes the default file contexts for these filesusr_twhich breaks many things.Fix this by adding a file equivalence rule for
/usr/share/pam.Bug: https://bugs.gentoo.org/973082
Closes: #1123