locallogin: Grant local_login_t the dac_read_search capability
PATCH 1/2 locallogin: Grant local_login_t the dac_read_search capability
It already has dac_override, and depending on the pam modules being used, this may actually be neccessary. Due to the 4.13 changes, I'm now getting dac_read_search denials.
--- policy/modules/system/locallogin.te | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
policy/modules/system/locallogin.te +1 -1
@@ -32,7 +32,7 @@ role system_r types sulogin_t; # Local login local policy # -allow local_login_t self:capability { chown dac_override fowner fsetid kill setgid setuid sys_nice sys_resource sys_tty_config }; +allow local_login_t self:capability { chown dac_read_search dac_override fowner fsetid kill setgid setuid sys_nice sys_resource sys_tty_config }; dontaudit local_login_t self:capability net_admin; allow local_login_t self:process { setexec setrlimit setsched }; allow local_login_t self:fd use;
Signature · 1 line
2.15.0
PATCH 2/2 locallogin: Allow local_login_t to list Maildirs in home directories
--- policy/modules/system/locallogin.te | 3 +++ 1 file changed, 3 insertions(+)
policy/modules/system/locallogin.te +3 -0
@@ -183,6 +183,9 @@ optional_policy(` optional_policy(` # Search for mail spool file. mta_getattr_spool(local_login_t) + + # List contents of ~/Maildir + mta_list_mail_home_rw(local_login_t) ') optional_policy(`
Signature · 1 line
2.15.0
PATCH 2/2 locallogin: Allow local_login_t to list Maildirs in home directories
Why is that needed? Is there some pam module or something that is displaying mail status?
Quoted 18 lines · AEDT Luis Ressel via refpolicy
--- policy/modules/system/locallogin.te | 3 +++ 1 file changed, 3 insertions(+)(quoted diff) +0
-0b/policy/modules/system/locallogin.te index
ff8df49df..8a0660320100644policy/modules/system/locallogin.te +3
-0@@ -183,6 +183,9 @@ optional_policy(` optional_policy(` # Search for mail spool file. mta_getattr_spool(local_login_t) + + # List contents of ~/Maildir + mta_list_mail_home_rw(local_login_t) ') optional_policy(`
Signature · 2 lines
My Main Blog http://etbe.coker.com.au/ My Documents Blog http://doc.coker.com.au/
PATCH 2/2 locallogin: Allow local_login_t to list Maildirs in home directories
Quoted 2 lines · On Wed, 15 Nov 2017 20:40:54 +1100 Russell Coker via refpolicy…
Why is that needed? Is there some pam module or something that is displaying mail status?
Yes, indeed. Sorry, I'd been meaning to supply a more detailed description, but apparently I forgot.
My usecase is to let login display mail status via the pam_mail module. Since my MDA delivers directly to ~/Maildir, this requires the permission I submitted.
Regards,
Luis Ressel
PATCH 2/2 locallogin: Allow local_login_t to list Maildirs in home directories
Quoted 6 lines · Luis Ressel via refpolicy
Quoted 2 lines · On Wed, 15 Nov 2017 20:40:54 +1100 Russell Coker via refpolicy…
Why is that needed? Is there some pam module or something that is displaying mail status?
Quoted 6 lines
Yes, indeed. Sorry, I'd been meaning to supply a more detailed description, but apparently I forgot.
My usecase is to let login display mail status via the
pam_mailmodule. Since my MDA delivers directly to ~/Maildir, this requires the permission I submitted.
I would probably then consider adding this to authconfig. probably associate these rules with pam clients.
Quoted 7 lines
Regards,
Luis Ressel
_______________________________________________
refpolicy mailing list
refpolicy at oss.tresys.com
http://oss.tresys.com/mailman/listinfo/refpolicy
Signature · 10 lines
Key fingerprint = 5F4D 3CDB D3F8 3652 FBD8 02D5 3B6C 5F1D 2C7B 6B02 https://sks-keyservers.net/pks/lookup?op=get&search=0x3B6C5F1D2C7B6B02 Dominick Grift -------------- next part -------------- A non-text attachment was scrubbed... Name: not available Type: application/pgp-signature Size: 659 bytes Desc: not available Url : http://oss.tresys.com/pipermail/refpolicy/attachments/20171115/dbbe6c6c/attachment.bin
PATCH 2/2 locallogin: Allow local_login_t to list Maildirs in home directories
Quoted 7 lines · Dominick Grift
Quoted 6 lines · Luis Ressel via refpolicy
Quoted 2 lines · On Wed, 15 Nov 2017 20:40:54 +1100 Russell Coker via refpolicy…
Why is that needed? Is there some pam module or something that is displaying mail status?
Quoted 8 lines
Quoted 6 lines
Yes, indeed. Sorry, I'd been meaning to supply a more detailed description, but apparently I forgot.
My usecase is to let login display mail status via the
pam_mailmodule. Since my MDA delivers directly to ~/Maildir, this requires the permission I submitted.I would probably then consider adding this to authconfig. probably associate these rules with pam clients.
I meant to type "authlogin"
Quoted 13 lines
Quoted 8 lines
Regards,
Luis Ressel
_______________________________________________
refpolicy mailing list
refpolicy at oss.tresys.com
http://oss.tresys.com/mailman/listinfo/refpolicySignature · 3 lines
Key fingerprint = 5F4D 3CDB D3F8 3652 FBD8 02D5 3B6C 5F1D 2C7B 6B02 https://sks-keyservers.net/pks/lookup?op=get&search=0x3B6C5F1D2C7B6B02 Dominick Grift
Signature · 10 lines
Key fingerprint = 5F4D 3CDB D3F8 3652 FBD8 02D5 3B6C 5F1D 2C7B 6B02 https://sks-keyservers.net/pks/lookup?op=get&search=0x3B6C5F1D2C7B6B02 Dominick Grift -------------- next part -------------- A non-text attachment was scrubbed... Name: not available Type: application/pgp-signature Size: 659 bytes Desc: not available Url : http://oss.tresys.com/pipermail/refpolicy/attachments/20171115/56e71a1f/attachment.bin
PATCH 1/2 locallogin: Grant local_login_t the dac_read_search capability
In reply to Luis ResselQuoted 12 lines · Luis Ressel via refpolicy
It already has
dac_override, and depending on the pam modules being used, this may actually be neccessary. Due to the 4.13 changes, I'm now gettingdac_read_searchdenials.--- policy/modules/system/locallogin.te | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)policy/modules/system/locallogin.te +0
-0
policy/modules/system/locallogin.te role system_r types sulogin_t; · line 38
Quoted 8 lines
policy/modules/system/locallogin.te +1
-1@@ -32,7 +32,7 @@ role system_r types sulogin_t; # Local login local policy # -allow local_login_t self:capability { chown dac_override fowner fsetid kill setgid setuid sys_nice sys_resource sys_tty_config }; +allow local_login_t self:capability { chown dac_read_search dac_override fowner fsetid kill setgid setuid sys_nice sys_resource sys_tty_config }; dontaudit local_login_t self:capability net_admin; allow local_login_t self:process { setexec setrlimit setsched }; allow local_login_t self:fd use;
Merged.
Signature · 1 line
Chris PeBenito