[Pam-developers] [linux-pam] #7: [PATCH] Allow changing of passwords in containers lacking CAP_AUDIT_WRITE

linux-pam trac at fedorahosted.org
Mon Apr 23 12:06:38 UTC 2012


#7: [PATCH] Allow changing of passwords in containers lacking CAP_AUDIT_WRITE
--------------------+-------------------------------
Reporter:  lennart  |       Owner:  pam-developers@…
    Type:  defect   |      Status:  new
Priority:  major    |   Component:  modules
 Version:           |  Resolution:
Keywords:           |  Blocked By:
Blocking:           |
--------------------+-------------------------------

Comment (by lennart):

 Replying to [comment:2 sgrubb]:
 > This loophole was created only for the gnome screensaver unlock - which
 is not part of any Common Criteria evaluation. The reality is that all use
 of the authentication mechanism is supposed to be audited. This is a
 mandatory requirement. So, it sounds like something is being creating that
 violates this basic security requirement and the code is being changed so
 it does not fail.
 >
 > Whatever is calling pam needs CAP_AUDIT_WRITE if this is a system entry
 point. Does this container have access to pam_faillock's state
 directories? Does this container also correctly update btmp and wtmp for
 the system?
 >
 > We have requirements that any system access points be locked out after a
 certain number of failed login attempts and that on successful login the
 number of bad login attempts since last login as well as the last login
 date and time be displayed. This must be shared across different services.

 Umm, no. This is about running a second Fedora instance on another Fedora
 instance inside a Linux container (i.e. something built from Linux
 namespaces, cgroups and dropped capabilities). Since we don't want that
 the second instance's auditing messages pollute the audit logs of the host
 (since they make little sense outside the context of the container), we
 turn off CAP_AUDIT_WRITE for the container. This works mostly fine except
 that the audit stuff in PAM then chokes on this and in the ill belief it
 was always in the possession of all capabilities refuses logins and
 password changes.

 The container maintains its own faillog, it's own wtmp, it's on btmp. It's
 a second system within the host, that should share as little with the host
 as possible. And one thing is the audit stuff.

-- 
Ticket URL: <https://fedorahosted.org/linux-pam/ticket/7#comment:3>
linux-pam <http://fedorahosted.org/linux-pam>
The Linux-PAM (Pluggable Authentication Modules) project


More information about the Pam-developers mailing list