[refpolicy] useradd/passwd patch

[dwalsh@redhat.com (Daniel J Walsh)]

Russell Coker wrote:
> On Thursday 25 September 2008 07:38, Mike Edenfield <kutulu@kutulu.org> wrote:
>> Allows passwd and useradd to execute unix_chkpwd (and related binaries)
>> to read and update user passwords.
> 
> Why would passwd and useradd ever need to do that?
> 
> unix_chkpwd is only ever called if the shadow file can't be read directly.  
> passwd needs direct read access and while it might be possible to write a 
> useradd that doesn't need read access (if based on the assumption 
> that /etc/shadow would never be in any way corrupt or out of sync 
> with /etc/paasswd), realistically it will always need such access.
> 
Perhaps they are using pam to verify password entry, pam defaults to
unix_chkpwd so this could cause the avc.  I don't see where this is a
problem though.