[Pam-developers] [linux-pam] #7: [PATCH] Allow changing of passwords in containers lacking CAP_AUDIT_WRITE
Lennart Poettering
lpoetter at redhat.com
Mon Apr 23 11:45:06 UTC 2012
Heya,
On 23.04.2012 02:12, Kees Cook wrote:
> On Sun, Apr 22, 2012 at 11:45:07PM -0000, linux-pam wrote:
>> #7: [PATCH] Allow changing of passwords in containers lacking CAP_AUDIT_WRITE
>> ----------------------+------------------------------
>> Reporter: lennart | Owner: pam-developers@…
>> Type: defect | Status: new
>> Priority: major | Component: modules
>> Version: | Keywords:
>> Blocked By: | Blocking:
>> ----------------------+------------------------------
>> Currently, changing passwords fails in containers lacking CAP_AUDIT_WRITE
>> (i.e. most containers). The patch that is attached fixes this. See patch
>> comment for a longer explanation of what it does and why.
>
> Seems like it would be better to change the uid test to a CAP_AUDIT_WRITE test.
Well, there's more in this world than just capabalities. Some kind of
other security framework might still prohibit processes audit write
access for a reason: SELinux, AppArmor or any other LSM. I think it is
generally a bad idea to second-guess the kernel here, and try to come to
the same security check conclusion as the kernel without actually being
the kernel.
I think the best way to check whether writing to audit works is actually
doing it and looking for EPERM.
Lennart
More information about the Pam-developers
mailing list