Re: strange pam_selinux behavior

[Dominick Grift <dac.override@gmail.com>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

On 03/23/2016 06:58 PM, Dominick Grift wrote:
<snip>
> This seems to be the code:
> 
>> /* we have to check that this user is allowed to go into the
>> range they have specified ... role is tied to an seuser, so
>> that'll be checked at setexeccon time */ if (mls_enabled && 
>> !mls_range_allowed(pamh, defaultcon, newcon, debug)) { 
>> pam_syslog(pamh, LOG_NOTICE, "Security context %s is not allowed 
>> for %s", defaultcon, newcon);
> 
>> goto fail_set;
> 


This seems related:

> class = string_to_security_class("context"); if (!class) { 
> pam_syslog(pamh, LOG_ERR, "Failed to translate security class
> context. %m"); return 0; }

since:

pam_selinux(sshd:session): Failed to translate security class
context. Invalid argument

What is a "security class context"?

Is it choking on the periods in my identifiers?
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQGcBAEBCAAGBQJW8uExAAoJECV0jlU3+UdpAeML/2jEcDzPDAs6zQlDg3EIk4bg
Dtrs3YD5xVyFH6EyheiG5ZZQBDqge0b5jY3YX0l5eabGyjSI4yTvQOSwUTDtHwqR
NQcZQCKWYE/gA72uRjqok7pxHBj5B84TM8SwVc12xAgs3znyy4yHZjlGFmq0VGXO
K9dn6hDvHK6Hk3p8FhnLvumB+Xd6VZ6Ju76JaKSdA19OQ8tYhN7wMvvYEpAAMNJy
Qh+EMPYkMZfcqemru8A7jZ40wh+pb9XuqZCiE2JtW0F1PpC2Aa6RKlwt79de52fB
AAFn6vD/EPlnDksgFhOn+9bUKtT+/zGA4gaflDLtmv3Z2K6U3txHxMIZOhD3XDc6
/pjcIo2gu0cA7gP1r6jkC2dX3uZzx2BHu00e8ilXuI90nXI51nUoi6HzBDVg6Tdd
fnHrAvkl4qJJCRvNXCRDIUxbOecIuwWbVoHRZJWR/0q2TOIIujPzhYsE0dmzPAif
rmygoDv2H6sNKxqaENT1xZlstkSItRuIeeE31q3Rzw==
=gYpm
-----END PGP SIGNATURE-----