On Feb 14, 2014, at 9:34 PM, Kayse, Josh <Joshua.Kayse@gtri.gatech.edu> wrote:


On Feb 11, 2014, at 11:17 PM, Shawn Wells <shawn@redhat.com> wrote:

On 2/11/14, 10:49 PM, Kayse, Josh wrote:

On Feb 7, 2014, at 7:56 PM, Trevor Vaughan <tvaughan@onyxpoint.com> wrote:

Josh,

I haven't seen this happening.

Do you happen to have a cron job that is trying to do something with sudo or su?

Trevor


Unfortunately I don’t.  Could you post your /etc/pam.d/cron file?


$ cat /etc/pam.d/crond
#
# The PAM configuration file for the cron daemon
#
#
# No PAM authentication called, auth modules not needed
account    required   pam_access.so
account    include    password-auth
session    required   pam_loginuid.so
session    include    password-auth
auth       include    password-auth
_______________________________________________
scap-security-guide mailing list
scap-security-guide@lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide

I figured out why cron stopped working for me.  If you disable the unconfined module it stops working.  So I’ll open a bugzilla for that.

1. semodule -d unconfineduser unconfined

Actual results:
cron stops working with the following log and AVC generated
Feb 14 18:27:01 localhost crond[2673]: (root) FAILED to open PAM security session (Error in service module)
Feb 14 18:27:01 (null) (null): audit(1392431221.248:729): avc: denied { read write } for pid=2673 comm=crond name=lastlog ino=666024 dev=sda2 scontext=system_u:system_r:crond_t:s0-s0:c0.c1023 tcontext=system_u:object_r:lastlog_t:s0 tclass=file 

Thanks for all the help.

-josh

One last comment, if I apply this patch then cron works even with unconfined disabled/removed.

--- password-auth-local 2014-02-16 13:27:46.805584897 -0500
+++ password-auth-local.cron 2014-02-15 21:03:42.100619845 -0500
@@ -24,7 +24,7 @@ password    required      pam_cracklib.s
 password    sufficient    pam_unix.so sha512 shadow try_first_pass use_authtok remember=24
 password    required      pam_deny.so
 
-session     required      pam_lastlog.so showfailed
+session     optional      pam_lastlog.so showfailed
 session     optional      pam_keyinit.so revoke
 session     required      pam_limits.so
 session     [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid

Perhaps the SSG can be updated to utilize this line.  I believe changing required to optional is an acceptable action because it is only used for displaying failed logins.  If a user were to fail to access the lastlog file they would fail during a previous service type like auth or account.

Thanks,
-josh