From b6e18c553fbbdc087b806a5839a516dfba0054a8 Mon Sep 17 00:00:00 2001 From: Colin Watson Date: Wed, 22 May 2013 02:08:11 +0100 Subject: Bracket our session stack with calls to pam_selinux close/open (thanks, Laurent Bigonville; closes: #679458). --- debian/openssh-server.sshd.pam | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) (limited to 'debian/openssh-server.sshd.pam') diff --git a/debian/openssh-server.sshd.pam b/debian/openssh-server.sshd.pam index e61d67777..5f7ab2f60 100644 --- a/debian/openssh-server.sshd.pam +++ b/debian/openssh-server.sshd.pam @@ -13,6 +13,11 @@ account required pam_nologin.so # Standard Un*x authorization. @include common-account +# SELinux needs to be the first session rule. This ensures that any +# lingering context has been cleared. Without this it is possible that a +# module could execute code in the wrong domain. +session [success=ok ignore=ignore module_unknown=ignore default=bad] pam_selinux.so close + # Set the loginuid process attribute. session required pam_loginuid.so @@ -31,9 +36,6 @@ session optional pam_mail.so standard noenv # [1] # Set up user limits from /etc/security/limits.conf. session required pam_limits.so -# Set up SELinux capabilities (need modified pam) -# session required pam_selinux.so multiple - # Read environment variables from /etc/environment and # /etc/security/pam_env.conf. session required pam_env.so # [1] @@ -41,5 +43,10 @@ session required pam_env.so # [1] # /etc/default/locale, so read that as well. session required pam_env.so user_readenv=1 envfile=/etc/default/locale +# SELinux needs to intervene at login time to ensure that the process starts +# in the proper default security context. Only sessions which are intended +# to run in the user's context should be run after this. +session [success=ok ignore=ignore module_unknown=ignore default=bad] pam_selinux.so open + # Standard Un*x password updating. @include common-password -- cgit v1.2.3