From: Saul Wold <sgw@linux.intel.com>
To: openembedded-core@lists.openembedded.org
Cc: Koen Kooi <koen@dominion.thruhere.net>
Subject: [CONSOLIDATED PULL 06/12] shadow: remove selinux entry from pam.d/login
Date: Thu, 2 Jun 2011 01:05:05 -0700 [thread overview]
Message-ID: <2c4a643ac3ddcbadcbc0bd16b297f092acdf2d12.1307001679.git.sgw@linux.intel.com> (raw)
In-Reply-To: <cover.1307001679.git.sgw@linux.intel.com>
In-Reply-To: <cover.1307001679.git.sgw@linux.intel.com>
From: Koen Kooi <koen@dominion.thruhere.net>
SElinux has been disabled in the recipe, leading to messages like this:
[ 167.643218] login[312]: PAM unable to dlopen(/lib/security/pam_selinux.so): /lib/security/pam_selinux.so: cannot open shared object file: No such file or directory
[ 167.670837] login[312]: PAM adding faulty module: /lib/security/pam_selinux.so
Signed-off-by: Koen Kooi <koen@dominion.thruhere.net>
---
meta/recipes-extended/shadow/files/pam.d/login | 7 -------
meta/recipes-extended/shadow/shadow.inc | 2 ++
2 files changed, 2 insertions(+), 7 deletions(-)
diff --git a/meta/recipes-extended/shadow/files/pam.d/login b/meta/recipes-extended/shadow/files/pam.d/login
index e41eb04..e4dacc2 100644
--- a/meta/recipes-extended/shadow/files/pam.d/login
+++ b/meta/recipes-extended/shadow/files/pam.d/login
@@ -26,13 +26,6 @@ auth [success=ok ignore=ignore user_unknown=ignore default=die] pam_secur
# (Replaces the `NOLOGINS_FILE' option from login.defs)
auth requisite pam_nologin.so
-# SELinux needs to be the first session rule. This ensures that any
-# lingering context has been cleared. Without out this it is possible
-# that a module could execute code in the wrong domain.
-# When the module is present, "required" would be sufficient (When SELinux
-# is disabled, this returns success.)
-session [success=ok ignore=ignore module_unknown=ignore default=bad] pam_selinux.so close
-
# This module parses environment configuration file(s)
# and also allows you to use an extended config
# file /etc/security/pam_env.conf.
diff --git a/meta/recipes-extended/shadow/shadow.inc b/meta/recipes-extended/shadow/shadow.inc
index 42f92a7..35bd6a8 100644
--- a/meta/recipes-extended/shadow/shadow.inc
+++ b/meta/recipes-extended/shadow/shadow.inc
@@ -6,6 +6,8 @@ LICENSE = "BSD | Artistic"
LIC_FILES_CHKSUM = "file://COPYING;md5=08c553a87d4e51bbed50b20e0adcaede \
file://src/passwd.c;firstline=8;endline=30;md5=2899a045e90511d0e043b85a7db7e2fe"
+PR = "r1"
+
PAM_PLUGINS = " libpam-runtime \
pam-plugin-faildelay \
pam-plugin-securetty \
--
1.7.3.4
next prev parent reply other threads:[~2011-06-02 8:08 UTC|newest]
Thread overview: 16+ messages / expand[flat|nested] mbox.gz Atom feed top
2011-06-02 8:04 [CONSOLIDATED PULL 00/12] 2-June-2011 Saul Wold
2011-06-02 8:05 ` [CONSOLIDATED PULL 01/12] m4: upgrade from 1.4.15 to 1.4.16 Saul Wold
2011-06-02 8:05 ` [CONSOLIDATED PULL 02/12] autoconf: upgrade from 2.65 to 2.68 Saul Wold
2011-06-02 8:05 ` [CONSOLIDATED PULL 03/12] bison: upgrade from 2.4.3 to 2.5 Saul Wold
2011-06-02 8:05 ` [CONSOLIDATED PULL 04/12] gettext-0.16.1: mark upstream status for gplv2 recipe's patches Saul Wold
2011-06-02 8:05 ` [CONSOLIDATED PULL 05/12] u-boot: package up u-boot.bin for field upgrades Saul Wold
2011-06-02 8:05 ` Saul Wold [this message]
2011-06-02 8:05 ` [CONSOLIDATED PULL 07/12] rootfs_ipk: delete opkg metadata if package management not required and all packages are configured Saul Wold
2011-06-02 8:05 ` [CONSOLIDATED PULL 08/12] avahi: enable service when using systemd Saul Wold
2011-06-02 8:05 ` [CONSOLIDATED PULL 09/12] ghostscript: Fix up file locations and add i686 Saul Wold
2011-06-02 8:05 ` [CONSOLIDATED PULL 10/12] gcc: Fix volatile access issue for ARM Saul Wold
2011-06-02 8:05 ` [CONSOLIDATED PULL 11/12] task-core-lsb: add cups and ghostscript into image Saul Wold
2011-06-02 8:05 ` [CONSOLIDATED PULL 12/12] libx11: fix libX11 keysyms to pass xts5 of lsb Saul Wold
2011-06-02 13:50 ` [CONSOLIDATED PULL 00/12] 2-June-2011 Richard Purdie
2011-06-02 14:57 ` Saul Wold
2011-06-02 15:03 ` Richard Purdie
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=2c4a643ac3ddcbadcbc0bd16b297f092acdf2d12.1307001679.git.sgw@linux.intel.com \
--to=sgw@linux.intel.com \
--cc=koen@dominion.thruhere.net \
--cc=openembedded-core@lists.openembedded.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox