#37: Wrong SELinux AV used in pam_rootok?
---------------------+------------------------------
Reporter: bigon | Owner: pam-developers@…
Type: defect | Status: new
Priority: major | Component: modules
Version: 1.1.x | Keywords: selinux
Blocked By: | Blocking:
---------------------+------------------------------
Hello,
In the pam_rootok code there is the following SELinux check that check is
a user can su to root without password.
status = selinux_check_access(user_context, user_context, "passwd",
"passwd", NULL);
Both the class and the AV are "passwd".
Looking at the Fedora SELinux policy and the refpolicy, I see there is a
"rootok" AV in the passwd class with the comment "# pam_rootok check
(skip
auth)"
Shouldn't this be changed in the code too then?
--
Ticket URL: <
https://fedorahosted.org/linux-pam/ticket/37>
linux-pam <
http://fedorahosted.org/linux-pam>
The Linux-PAM (Pluggable Authentication Modules) project