Re: Adding a custom PAM module and selinux

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Sun, 2006-05-28 at 13:34 +0100, Paul Howarth wrote:

< text trimmed >
 
> > [root@paragon ~]# ls -Z /lib/security/pam_poldi.so
> > -rwxr-xr-x  root     root
> > system_u:object_r:lib_t          /lib/security/pam_poldi.so
> 
> You're still getting errors because the object has context lib_t rather
> than textrel_shlib_t. The semanage call *should* get restorecon to use
> textrel_shlib_t for this file, but won't change the context itself.
> 
> What's the output of:
> # semanage fcontext -l | grep pam_

/lib/security/pam_poldi.so                         regular file
system_u:object_r:textrel_shlib_t:s0
/sbin/pam_console_apply                            regular file
system_u:object_r:pam_console_exec_t:s0
/var/run/console(/.*)?                             all files
system_u:object_r:pam_var_console_t:s0
/var/run/sudo(/.*)?                                all files
system_u:object_r:pam_var_run_t:s0
/sbin/pam_timestamp_check                          regular file
system_u:object_r:pam_exec_t:s0
/lib64/security/pam_krb5/pam_krb5_storetmp         regular file
system_u:object_r:pam_exec_t:s0
/lib/security/pam_krb5/pam_krb5_storetmp           regular file
system_u:object_r:pam_exec_t:s0

> # ls -lZ /lib/security/pam_poldi.so

-rwxr-xr-x  root     root
system_u:object_r:textrel_shlib_t /lib/security/pam_poldi.so

> # restorecon -v /lib/security/pam_poldi.so
> # ls -lZ /lib/security/pam_poldi.so

-rwxr-xr-x  root     root
system_u:object_r:textrel_shlib_t /lib/security/pam_poldi.so


> > > 2. What "avc:  denied" messages, if any, do you see in /var/log/messages
> > > relating to this?
> > 
> > audit(1148810039.087:6): avc:  denied  { execmod } for  pid=5144
> > comm="su" name="pam_poldi.so" dev=sdb6 ino=13631516
> > scontext=user_u:system_r:unconfined_t:s0
> > tcontext=system_u:object_r:lib_t:s0 tclass=file
> > audit(1148810079.358:7): avc:  denied  { execheap } for  pid=5172
> > comm="su" scontext=user_u:system_r:unconfined_t:s0
> > tcontext=user_u:system_r:unconfined_t:s0 tclass=process
> 
> Hmm, execheap looks bad. Software really shouldn't be doing that. Did
> you compile this module yourself? If so, did you use the default
> compiler optimization flags from FC5, which are:

Yes I did compile the module myself. The makefiles are being generated
with ./configure and friends, is this sufficient?

> -O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions
> -fstack-protector --param=ssp-buffer-size=4 -m32 -march=i386
> -mtune=generic -fasynchronous-unwind-tables
> 
> You may find that doing that improves things.

I have to get back to you on this one. I quick modification of all
Makefiles and Makefiles.am doesn't seem to get the expected results.

Jurgen


-- 
fedora-list mailing list
fedora-list@xxxxxxxxxx
To unsubscribe: https://www.redhat.com/mailman/listinfo/fedora-list
[Index of Archives]     [Older Fedora Users]     [Fedora Announce]     [Fedora Package Announce]     [EPEL Announce]     [Fedora Magazine]     [Fedora News]     [Fedora Summer Coding]     [Fedora Laptop]     [Fedora Cloud]     [Fedora Advisory Board]     [Fedora Education]     [Fedora Security]     [Fedora Scitech]     [Fedora Robotics]     [Fedora Maintainers]     [Fedora Infrastructure]     [Fedora Websites]     [Anaconda Devel]     [Fedora Devel Java]     [Fedora Legacy]     [Fedora Desktop]     [Fedora Fonts]     [ATA RAID]     [Fedora Marketing]     [Fedora Management Tools]     [Fedora Mentors]     [SSH]     [Fedora Package Review]     [Fedora R Devel]     [Fedora PHP Devel]     [Kickstart]     [Fedora Music]     [Fedora Packaging]     [Centos]     [Fedora SELinux]     [Fedora Legal]     [Fedora Kernel]     [Fedora OCaml]     [Coolkey]     [Virtualization Tools]     [ET Management Tools]     [Yum Users]     [Tux]     [Yosemite News]     [Gnome Users]     [KDE Users]     [Fedora Art]     [Fedora Docs]     [Asterisk PBX]     [Fedora Sparc]     [Fedora Universal Network Connector]     [Libvirt Users]     [Fedora ARM]

  Powered by Linux