[Pam-developers] [linux-pam] #7: [PATCH] Allow changing of passwords in containers lacking CAP_AUDIT_WRITE
linux-pam
trac at fedorahosted.org
Mon Apr 23 11:45:00 UTC 2012
#7: [PATCH] Allow changing of passwords in containers lacking CAP_AUDIT_WRITE
--------------------+-------------------------------
Reporter: lennart | Owner: pam-developers@…
Type: defect | Status: new
Priority: major | Component: modules
Version: | Resolution:
Keywords: | Blocked By:
Blocking: |
--------------------+-------------------------------
Comment (by sgrubb):
This loophole was created only for the gnome screensaver unlock - which is
not part of any Common Criteria evaluation. The reality is that all use of
the authentication mechanism is supposed to be audited. This is a
mandatory requirement. So, it sounds like something is being creating that
violates this basic security requirement and the code is being changed so
it does not fail.
Whatever is calling pam needs CAP_AUDIT_WRITE if this is a system entry
point. Does this container have access to pam_faillock's state
directories? Does this container also correctly update btmp and wtmp for
the system?
We have requirements that any system access points be locked out after a
certain number of failed login attempts and that on successful login the
number of bad login attempts since last login as well as the last login
date and time be displayed. This must be shared across different services.
--
Ticket URL: <https://fedorahosted.org/linux-pam/ticket/7#comment:2>
linux-pam <http://fedorahosted.org/linux-pam>
The Linux-PAM (Pluggable Authentication Modules) project
More information about the Pam-developers
mailing list