Subject: Re: [PATCH 2/2] pam_faillock creates files in /run/faillock
To:     "Sugar, David" <dsugar@tresys.com>,
        "selinux-refpolicy@vger.kernel.org" 
        <selinux-refpolicy@vger.kernel.org>
References: <20181221014026.2867-1-dsugar@tresys.com>
 <20181221014026.2867-2-dsugar@tresys.com> <20181221103416.GA4520@brutus.lan>
 <2d2d6c7f-3084-d6f6-ce1b-42c9d9535969@tresys.com>
From:   Chris PeBenito <pebenito@ieee.org>
Message-ID: <7ffa48a1-2276-99cb-5b9a-62d026b76862@ieee.org>
Date:   Sat, 22 Dec 2018 14:20:41 -0500
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101
 Thunderbird/60.3.0
MIME-Version: 1.0
In-Reply-To: <2d2d6c7f-3084-d6f6-ce1b-42c9d9535969@tresys.com>
Content-Type: text/plain; charset=windows-1252; format=flowed
Content-Language: en-US
Content-Transfer-Encoding: 8bit
Sender: selinux-refpolicy-owner@vger.kernel.org
Precedence: bulk

On 12/21/18 9:58 PM, Sugar, David wrote:
> 
> On 12/21/18 5:34 AM, Dominick Grift wrote:
>> On Fri, Dec 21, 2018 at 01:41:25AM +0000, David Sugar wrote:
>>> These are changes needed when pam_fallock created files in /run/faillock
>>> (which is labeled faillog_t).  sudo and xdm (and probably other domains)
>>> will create files in this directory for successful and failed logins
>>> attempts.
>> The pam stuff has become a bit broken in my view.
>>
>> We use to use auth_use_pam() for these kinds of things but the interface was forgotten and not updated properly.
>>
>> So for example sudo does not even call auth_use_pam() and a lot of stuff was added directly to the login_pgm domain that should have been added to auth_use_pam() instead.
>>
>> My opinion is that this belongs in auth_use_pam()
> 
> Dominick,
> 
> I see those interfaces.? It looks like xdm_t already uses
> auth_login_pgm_domain(xdm_t).? It also isn't really clear to me what the
> difference is between auth_login_pgm_domain() and auth_use_pam().
It's a little muddy, but a "login" domain is as it seems; authentication 
for login programs.  The "use" one is other uses of PAM.


-- 
Chris PeBenito