Re: file_contexts patch

[Thomas Bleher <bleher@informatik.uni-muenchen.de>]

[-- Attachment #1: Type: text/plain, Size: 1463 bytes --]

* Russell Coker <russell@coker.com.au> [2004-07-19 03:25]:
> On Mon, 19 Jul 2004 01:03, Thomas Bleher <bleher@informatik.uni-muenchen.de> 
> wrote:
> > > unix_chkpwd has been around for years, I can't believe that it's
> > > something that they haven't got to it yet.
> >
> > unix_chkpwd is included in the PAM package, it's just that suse has
> > developed their own pam module (pam_unix2.so) which doesn't use
> > unix_chkpwd AFAIK.
> 
> Why can't you just use pam_unix.so instead?

At the time I installed SELinux on the computers here my primary focus
was to get a working system without breaking too much so I didn't want
to muck around with pam config if possible.

After this mail exchange I looked at the code again. And indeed, the
patch Russell mentioned earlier (to make pam_unix use unix_chkpwd if it
can't access /etc/shadow) was missing. After adding this patch, pam now
runs fine without every login program needing the auth attribute.

So, for everyone who uses my packages, please update to the latest pam,
which you can get from my site. After that, replace every occurrence of
pam_unix.so or pam_unix2.so under /etc/pam.d with pam_unix_auth.so,
pam_unix_acct.so, pam_unix_passwd.so or pam_unix_session.so,
respectively.

Thomas

PS: Thanks to Russell for nudging me to this.

-- 
http://www.cip.ifi.lmu.de/~bleher/selinux/ - my SELinux pages
GPG-Fingerprint: BC4F BB16 30D6 F253 E3EA  D09E C562 2BAE B2F4 ABE7

[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 189 bytes --]