RepoMirrors
/
selinux-refpolicy
mirror of https://github.com/SELinuxProject/refpolicy
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Make crond able to use pam_loginuid.so 

Entry point applications such as crond or atd use pam_loginuid.so for
the session phase of their PAM config files to set the process loginuid
attribute. Accordingly logging_set_loginuid interface should have been
called, otherwise we could run into below error message:

type=USER_START msg=audit(1296377641.212:213): user pid=2633 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s15:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=failed)'
type=USER_END msg=audit(1296377641.220:214): user pid=2633 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s15:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=failed)'
type=AVC msg=audit(1296377641.196:212): avc:  denied  { audit_control } for  pid=2633 comm="crond" capability=30 scontext=system_u:system_r:crond_t:s0-s15:c0.c1023 tcontext=system_u:system_r:crond_t:s0-s15:c0.c1023 tclass=capability

BTW, other entrypoint applications such as sshd/login/remote have had
this interface called for their domains.

Signed-off-by: Harry Ciao <qingtao.cao@windriver.com>
This commit is contained in:
Harry Ciao 2011-02-02 11:13:32 +08:00 committed by Chris PeBenito
parent 0737bf0d71
commit 1cc285ff3f
1 changed files with 1 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
policy/modules/services/cron.te
View File

@ -209,6 +209,7 @@ init_spec_domtrans_script(crond_t)
auth_use_nsswitch(crond_t)
logging_send_syslog_msg(crond_t)
logging_set_loginuid(crond_t)
seutil_read_config(crond_t)
seutil_read_default_contexts(crond_t)