[Pam-developers] [linux-pam] #7: [PATCH] Allow changing of passwords in containers lacking CAP_AUDIT_WRITE

linux-pam trac at fedorahosted.org
Mon Apr 23 11:45:00 UTC 2012


#7: [PATCH] Allow changing of passwords in containers lacking CAP_AUDIT_WRITE
--------------------+-------------------------------
Reporter:  lennart  |       Owner:  pam-developers@…
    Type:  defect   |      Status:  new
Priority:  major    |   Component:  modules
 Version:           |  Resolution:
Keywords:           |  Blocked By:
Blocking:           |
--------------------+-------------------------------

Comment (by sgrubb):

 This loophole was created only for the gnome screensaver unlock - which is
 not part of any Common Criteria evaluation. The reality is that all use of
 the authentication mechanism is supposed to be audited. This is a
 mandatory requirement. So, it sounds like something is being creating that
 violates this basic security requirement and the code is being changed so
 it does not fail.

 Whatever is calling pam needs CAP_AUDIT_WRITE if this is a system entry
 point. Does this container have access to pam_faillock's state
 directories? Does this container also correctly update btmp and wtmp for
 the system?

 We have requirements that any system access points be locked out after a
 certain number of failed login attempts and that on successful login the
 number of bad login attempts since last login as well as the last login
 date and time be displayed. This must be shared across different services.

-- 
Ticket URL: <https://fedorahosted.org/linux-pam/ticket/7#comment:2>
linux-pam <http://fedorahosted.org/linux-pam>
The Linux-PAM (Pluggable Authentication Modules) project


More information about the Pam-developers mailing list