newrole authentication

newrole authentication

[Clarkson, Mike R (US SSA)]

Will someone point me to information or send me an example on how to set
up newrole so that is does not ask for a password, so that it can by
used like this within software "newrole -l s1 -- -c <cmd>"?

Thanks



--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: newrole authentication

[Joshua Brindle]

Clarkson, Mike R (US SSA) wrote:
> Will someone point me to information or send me an example on how to set
> up newrole so that is does not ask for a password, so that it can by
> used like this within software "newrole -l s1 -- -c <cmd>"?
>   
newrole is designed to be a human interface and therefore to ask for a 
password, perhaps you are looking for runcon?


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: newrole authentication

[Stephen Smalley]

On Mon, 2007-10-15 at 16:12 -0700, Clarkson, Mike R (US SSA) wrote:
> Will someone point me to information or send me an example on how to set
> up newrole so that is does not ask for a password, so that it can by
> used like this within software "newrole -l s1 -- -c <cmd>"?

You need policycoreutils 2.0.19 or later, or you need to back port that
change to whatever newrole you have.

See:
http://marc.info/?t=117769973100008&r=1&w=2
http://marc.info/?l=selinux&m=117865153827263&w=2

Then you can set up a /etc/selinux/newrole_pam.conf file with e.g.:
/path/to/cmd newrole-noauth
and you can set up a /etc/pam.d/newrole-noauth file with pam_permit.so
as the auth module.

-- 
Stephen Smalley
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: newrole authentication

[Stephen Smalley]

On Tue, 2007-10-16 at 00:32 -0400, Joshua Brindle wrote:
> Clarkson, Mike R (US SSA) wrote:
> > Will someone point me to information or send me an example on how to set
> > up newrole so that is does not ask for a password, so that it can by
> > used like this within software "newrole -l s1 -- -c <cmd>"?
> >   
> newrole is designed to be a human interface and therefore to ask for a 
> password, perhaps you are looking for runcon?

No, we warned him away from runcon because it requires the caller to be
fully privileged (just runs in the domain of the caller) and because it
doesn't deal with polyinstantiation (pam_namespace) or other kinds of
sanitization (e.g. fd reset) across the level transition.

-- 
Stephen Smalley
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.