On Fri, 2013-02-08 at 04:58 +0400, Dmitry V. Levin wrote:
On Thu, Feb 07, 2013 at 05:15:11PM +0100, Tomas Mraz wrote:
> The attached patch uses different way to check for passwd accessibility
> by root in pam_rootok module. This method allows for proper auditing the
> denial of access, so the user can find the user AVC message in the
> audit.log.
>
> OK to commit?
I need a bit more time to review this, but from a cursory glance the
selinux_check_root() return code check needs to be inverted.
Yes, you're right. Good catch.
--
Tomas Mraz
No matter how far down the wrong road you've gone, turn back.
Turkish proverb