Re: Adding a custom PAM module and selinux

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Sun, 2006-05-28 at 11:01 +0100, Paul Howarth wrote:
> On Sun, 2006-05-28 at 11:57 +0200, Jurgen Kramer wrote:
> > On Sat, 2006-05-27 at 21:40 +0100, Paul Howarth wrote:
> > > On Sat, 2006-05-27 at 18:54 +0200, Jurgen Kramer wrote:
> > > > I am trying to add a custom PAM module (pam_poldi.so) to my FC5 system
> > > > to be able to login using a OpenPGP smartcard. I already changed the
> > > > security context of /lib/security/pam_poldi.so to match the other pam
> > > > modules (system_u:object_r:lib_t) but it seems that is not enough. In
> > > > syslog I still see:
> > > > 
> > > > su: PAM unable to dlopen(/lib/security/pam_poldi.so)
> > > > su: PAM [error: /lib/security/pam_poldi.so: cannot restore segment prot
> > > > after reloc: Permission denied]
> > > > 
> > > > This can propably be fixed with a chcon -t
> > > > texrel_shlib_t /lib/security/pam_poldi.so
> > > > 
> > > > This will probably not survice an selinux update or relabel session.
> > > > What is the proper way to add the module so it will survice relabels and
> > > > selinux updates?
> > > 
> > > This should do it:
> > > 
> > > # semanage fcontext -a -t textrel_shlib_t -f
> > > -- /lib/security/pam_poldi.so
> > > 
> > > (that's all one long line)
> > > 
> > > You could test it by changing the context back to lib_t and then doing:
> > > 
> > > # restorecon -v /lib/security/pam_poldi.so
> > > 
> > > which should set it back to textrel_shlib_t.
> > Unfortunately that did not do it :( 
> > 
> > I still get:
> > 
> > su: PAM unable to dlopen(/lib/security/pam_poldi.so)
> > su: PAM [error: /lib/security/pam_poldi.so: cannot restore segment prot
> > after reloc: Permission denied]
> > su: PAM adding faulty module: /lib/security/pam_poldi.so
> > 
> > Any ideas?
> 
> 1. Is the context type of /lib/security/pam_poldi.so currently set to
> textrel_shlib_t?

[root@paragon ~]# ls -Z /lib/security/pam_poldi.so
-rwxr-xr-x  root     root
system_u:object_r:lib_t          /lib/security/pam_poldi.so

> 
> 2. What "avc:  denied" messages, if any, do you see in /var/log/messages
> relating to this?

audit(1148810039.087:6): avc:  denied  { execmod } for  pid=5144
comm="su" name="pam_poldi.so" dev=sdb6 ino=13631516
scontext=user_u:system_r:unconfined_t:s0
tcontext=system_u:object_r:lib_t:s0 tclass=file
audit(1148810079.358:7): avc:  denied  { execheap } for  pid=5172
comm="su" scontext=user_u:system_r:unconfined_t:s0
tcontext=user_u:system_r:unconfined_t:s0 tclass=process


Jurgen


-- 
fedora-list mailing list
fedora-list@xxxxxxxxxx
To unsubscribe: https://www.redhat.com/mailman/listinfo/fedora-list
[Index of Archives]     [Older Fedora Users]     [Fedora Announce]     [Fedora Package Announce]     [EPEL Announce]     [Fedora Magazine]     [Fedora News]     [Fedora Summer Coding]     [Fedora Laptop]     [Fedora Cloud]     [Fedora Advisory Board]     [Fedora Education]     [Fedora Security]     [Fedora Scitech]     [Fedora Robotics]     [Fedora Maintainers]     [Fedora Infrastructure]     [Fedora Websites]     [Anaconda Devel]     [Fedora Devel Java]     [Fedora Legacy]     [Fedora Desktop]     [Fedora Fonts]     [ATA RAID]     [Fedora Marketing]     [Fedora Management Tools]     [Fedora Mentors]     [SSH]     [Fedora Package Review]     [Fedora R Devel]     [Fedora PHP Devel]     [Kickstart]     [Fedora Music]     [Fedora Packaging]     [Centos]     [Fedora SELinux]     [Fedora Legal]     [Fedora Kernel]     [Fedora OCaml]     [Coolkey]     [Virtualization Tools]     [ET Management Tools]     [Yum Users]     [Tux]     [Yosemite News]     [Gnome Users]     [KDE Users]     [Fedora Art]     [Fedora Docs]     [Asterisk PBX]     [Fedora Sparc]     [Fedora Universal Network Connector]     [Libvirt Users]     [Fedora ARM]

  Powered by Linux