Date:   Sun, 23 Dec 2018 11:20:00 +0100
From:   Dominick Grift <dac.override@gmail.com>
To:     "Sugar, David" <dsugar@tresys.com>
Cc:     "selinux-refpolicy@vger.kernel.org" 
        <selinux-refpolicy@vger.kernel.org>
Subject: Re: [PATCH 2/2] pam_faillock creates files in /run/faillock
Message-ID: <20181223102000.GA20992@brutus.lan>
Mail-Followup-To: "Sugar, David" <dsugar@tresys.com>,
        "selinux-refpolicy@vger.kernel.org" <selinux-refpolicy@vger.kernel.org>
References: <20181221014026.2867-1-dsugar@tresys.com>
 <20181221014026.2867-2-dsugar@tresys.com>
 <20181221103416.GA4520@brutus.lan>
 <2d2d6c7f-3084-d6f6-ce1b-42c9d9535969@tresys.com>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha256;
        protocol="application/pgp-signature"; boundary="1yeeQ81UyVL57Vl7"
Content-Disposition: inline
In-Reply-To: <2d2d6c7f-3084-d6f6-ce1b-42c9d9535969@tresys.com>
User-Agent: Every email client sucks, this one just sucks less.
Sender: selinux-refpolicy-owner@vger.kernel.org
Precedence: bulk


--1yeeQ81UyVL57Vl7
Content-Type: text/plain; charset=iso-8859-1
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Sat, Dec 22, 2018 at 02:58:41AM +0000, Sugar, David wrote:
>=20
> On 12/21/18 5:34 AM, Dominick Grift wrote:
> > On Fri, Dec 21, 2018 at 01:41:25AM +0000, David Sugar wrote:
> >> These are changes needed when pam_fallock created files in /run/faillo=
ck
> >> (which is labeled faillog_t).  sudo and xdm (and probably other domain=
s)
> >> will create files in this directory for successful and failed logins
> >> attempts.
> > The pam stuff has become a bit broken in my view.
> >
> > We use to use auth_use_pam() for these kinds of things but the interfac=
e was forgotten and not updated properly.
> >
> > So for example sudo does not even call auth_use_pam() and a lot of stuf=
f was added directly to the login_pgm domain that should have been added to=
 auth_use_pam() instead.
> >
> > My opinion is that this belongs in auth_use_pam()
>=20
> Dominick,
>=20
> I see those interfaces.=A0 It looks like xdm_t already uses=20
> auth_login_pgm_domain(xdm_t).=A0 It also isn't really clear to me what th=
e=20
> difference is between auth_login_pgm_domain() and auth_use_pam().=A0 I=20
> will make updates moving my change into auth_use_pam() and also update=20
> sudo_role_template() to use (I think) auth_login_pgm_domain ().

sudo is not an auth_login_pgm_domain() i believe

the auth_use_pam() is a subset of auth_login_pgm_domain()

so login_pgm domains are pam clients plus extras needed to log in users

a auth_use_pam() (pam client) has a pam stack but it might not actually do =
logins

sudo uses pam but its not a real login program, so afaik sudo should call a=
uth_use_pam()
xdm is a login_pgm, so is sshd etc

systemd is also a pam client, but not a login program

>=20
> I will resubmit this patch,
>=20
> --- snip ---

--=20
Key fingerprint =3D 5F4D 3CDB D3F8 3652 FBD8 02D5 3B6C 5F1D 2C7B 6B02
https://sks-keyservers.net/pks/lookup?op=3Dget&search=3D0x3B6C5F1D2C7B6B02
Dominick Grift

--1yeeQ81UyVL57Vl7
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQGzBAEBCAAdFiEEujmXliIBLFTc2Y4AJXSOVTf5R2kFAlwfYUsACgkQJXSOVTf5
R2lQsAv+KdAKd6Oiz221tP3Z+z8KCYeOngM9MRENQHXnq3VcKuv6daPWOw7QnN8r
qiFfyB6LeUdBvvPfUSgW2vPdFj0UPSjxKcHHFyQMgVsRxf+pJ9x780EiZZRuiPgZ
NeNmIEvMbyiOARy2y/6QR2vKJknowPX3Q2gs86qKYk3tj0SHBBm+G/4TxmoomR+9
Q0zk1/5voKcYqpNycGhv743qN1URVKc+tvfQeVMt3//vUK+0jN7sH/fYXCueN7SI
RhCoGRHB550XpDG70g4LhftYs12ONQyuoLNb2m4P3kKFhvB7PrONIVYzbvu8/yxY
jvdIbpM7LZFv8et0ehep2xudAXqV+9T4TdtE61+Vf+5nVPSv2QV9NU3v7SHJCGhc
u+Yq1LWISG8n7qUM08nIakhlQKRN9ML8oSOgN4i8ctNCYdL+kPnwERxNEp5j/Qvz
dGM0nmDj1FQlT/Eab84KOcF/YXoLqo0BHImVYpoUmEsJ1jEUPOHhZ9jfun2RX/MF
1iGqNNRD
=ihKq
-----END PGP SIGNATURE-----

--1yeeQ81UyVL57Vl7--