[Pam-developers] [linux-pam] #7: [PATCH] Allow changing of passwords in containers lacking CAP_AUDIT_WRITE

Lennart Poettering lpoetter at redhat.com
Mon Apr 23 11:45:06 UTC 2012


Heya,

On 23.04.2012 02:12, Kees Cook wrote:
> On Sun, Apr 22, 2012 at 11:45:07PM -0000, linux-pam wrote:
>> #7: [PATCH] Allow changing of passwords in containers lacking CAP_AUDIT_WRITE
>> ----------------------+------------------------------
>>    Reporter:  lennart  |      Owner:  pam-developers@…
>>        Type:  defect   |     Status:  new
>>    Priority:  major    |  Component:  modules
>>     Version:           |   Keywords:
>> Blocked By:           |   Blocking:
>> ----------------------+------------------------------
>>   Currently, changing passwords fails in containers lacking CAP_AUDIT_WRITE
>>   (i.e. most containers). The patch that is attached fixes this. See patch
>>   comment for a longer explanation of what it does and why.
>
> Seems like it would be better to change the uid test to a CAP_AUDIT_WRITE test.

Well, there's more in this world than just capabalities. Some kind of 
other security framework might still prohibit processes audit write 
access for a reason: SELinux, AppArmor or any other LSM. I think it is 
generally a bad idea to second-guess the kernel here, and try to come to 
the same security check conclusion as the kernel without actually being 
the kernel.

I think the best way to check whether writing to audit works is actually 
doing it and looking for EPERM.

Lennart


More information about the Pam-developers mailing list