#7: [PATCH] Allow changing of passwords in containers lacking CAP_AUDIT_WRITE
--------------------+-------------------------------
Reporter: lennart | Owner: pam-developers@…
Type: defect | Status: new
Priority: major | Component: modules
Version: | Resolution:
Keywords: | Blocked By:
Blocking: |
--------------------+-------------------------------
Comment (by lennart):
Replying to [comment:2 sgrubb]:
This loophole was created only for the gnome screensaver unlock -
which
is not part of any Common Criteria evaluation. The reality is that all use
of the authentication mechanism is supposed to be audited. This is a
mandatory requirement. So, it sounds like something is being creating that
violates this basic security requirement and the code is being changed so
it does not fail.
Whatever is calling pam needs CAP_AUDIT_WRITE if this is a system entry
point. Does this container have access to pam_faillock's state
directories? Does this container also correctly update btmp and wtmp for
the system?
We have requirements that any system access points be locked out after a
certain number of failed login attempts and that on successful login the
number of bad login attempts since last login as well as the last login
date and time be displayed. This must be shared across different services.
Umm, no. This is about running a second Fedora instance on another Fedora
instance inside a Linux container (i.e. something built from Linux
namespaces, cgroups and dropped capabilities). Since we don't want that
the second instance's auditing messages pollute the audit logs of the host
(since they make little sense outside the context of the container), we
turn off CAP_AUDIT_WRITE for the container. This works mostly fine except
that the audit stuff in PAM then chokes on this and in the ill belief it
was always in the possession of all capabilities refuses logins and
password changes.
The container maintains its own faillog, it's own wtmp, it's on btmp. It's
a second system within the host, that should share as little with the host
as possible. And one thing is the audit stuff.
--
Ticket URL: <
https://fedorahosted.org/linux-pam/ticket/7#comment:3>
linux-pam <
http://fedorahosted.org/linux-pam>
The Linux-PAM (Pluggable Authentication Modules) project