Re: file_contexts patch

[Russell Coker <russell@coker.com.au>]

On Mon, 19 Jul 2004 01:03, Thomas Bleher <bleher@informatik.uni-muenchen.de> 
wrote:
> > unix_chkpwd has been around for years, I can't believe that it's
> > something that they haven't got to it yet.
>
> unix_chkpwd is included in the PAM package, it's just that suse has
> developed their own pam module (pam_unix2.so) which doesn't use
> unix_chkpwd AFAIK.

Why can't you just use pam_unix.so instead?

Also it shouldn't be that difficult to fix the SUSE code.

> > Are you running kcheckpass as root (maybe SETUID)?
>
> It's sgid shadow.

That's entirely the wrong approach.  Any bug in kcheckpass on a SUSE system 
will give full access to /etc/shadow.

> > If so then SUSE would be
> > using PAM without my patch to pam_unix.so which allows unix_chkpwd to be
> > called if /etc/shadow can't be opened as root (without that patch it just
> > aborts).  Also does SUSE have unix_verify (again part of my patch)
> > installed? If not then the default policy will not work in all
> > situations...
>
> Yeah, I had to give login, ssh, kdm, ... the auth attribute.
> I do not know which part of the patch is missing, it's been a while
> since I looked at the PAM code.
> At the time I made the packages I simply gave up on PAM after a while
> because it was too complicated and I didn't want to find out how suse's
> module differed from the rest of the world...
> I guess it's time I dig again into this mess, sigh.
> I really wish there was someone actively maintaining this code.

-- 
http://www.coker.com.au/selinux/   My NSA Security Enhanced Linux packages
http://www.coker.com.au/bonnie++/  Bonnie++ hard drive benchmark
http://www.coker.com.au/postal/    Postal SMTP/POP benchmark
http://www.coker.com.au/~russell/  My home page

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.