Date:   Sun, 23 Dec 2018 17:16:05 +0100
From:   Dominick Grift <dac.override@gmail.com>
To:     "Sugar, David" <dsugar@tresys.com>,
        "selinux-refpolicy@vger.kernel.org" 
        <selinux-refpolicy@vger.kernel.org>
Subject: Re: [PATCH 2/2] pam_faillock creates files in /run/faillock
Message-ID: <20181223161605.GE20992@brutus.lan>
Mail-Followup-To: "Sugar, David" <dsugar@tresys.com>,
        "selinux-refpolicy@vger.kernel.org" <selinux-refpolicy@vger.kernel.org>
References: <20181221014026.2867-1-dsugar@tresys.com>
 <20181221014026.2867-2-dsugar@tresys.com>
 <20181221103416.GA4520@brutus.lan>
 <2d2d6c7f-3084-d6f6-ce1b-42c9d9535969@tresys.com>
 <20181223102000.GA20992@brutus.lan>
 <20181223104648.GB20992@brutus.lan>
 <20181223160921.GD20992@brutus.lan>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha256;
        protocol="application/pgp-signature"; boundary="Rgf3q3z9SdmXC6oT"
Content-Disposition: inline
In-Reply-To: <20181223160921.GD20992@brutus.lan>
User-Agent: Every email client sucks, this one just sucks less.
Sender: selinux-refpolicy-owner@vger.kernel.org
Precedence: bulk


--Rgf3q3z9SdmXC6oT
Content-Type: text/plain; charset=iso-8859-1
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Sun, Dec 23, 2018 at 05:09:21PM +0100, Dominick Grift wrote:
> On Sun, Dec 23, 2018 at 11:46:48AM +0100, Dominick Grift wrote:
> > On Sun, Dec 23, 2018 at 11:20:00AM +0100, Dominick Grift wrote:
> > > On Sat, Dec 22, 2018 at 02:58:41AM +0000, Sugar, David wrote:
> > > >=20
> > > > On 12/21/18 5:34 AM, Dominick Grift wrote:
> > > > > On Fri, Dec 21, 2018 at 01:41:25AM +0000, David Sugar wrote:
> > > > >> These are changes needed when pam_fallock created files in /run/=
faillock
> > > > >> (which is labeled faillog_t).  sudo and xdm (and probably other =
domains)
> > > > >> will create files in this directory for successful and failed lo=
gins
> > > > >> attempts.
> > > > > The pam stuff has become a bit broken in my view.
> > > > >
> > > > > We use to use auth_use_pam() for these kinds of things but the in=
terface was forgotten and not updated properly.
> > > > >
> > > > > So for example sudo does not even call auth_use_pam() and a lot o=
f stuff was added directly to the login_pgm domain that should have been ad=
ded to auth_use_pam() instead.
> > > > >
> > > > > My opinion is that this belongs in auth_use_pam()
> > > >=20
> > > > Dominick,
> > > >=20
> > > > I see those interfaces.=A0 It looks like xdm_t already uses=20
> > > > auth_login_pgm_domain(xdm_t).=A0 It also isn't really clear to me w=
hat the=20
> > > > difference is between auth_login_pgm_domain() and auth_use_pam().=
=A0 I=20
> > > > will make updates moving my change into auth_use_pam() and also upd=
ate=20
> > > > sudo_role_template() to use (I think) auth_login_pgm_domain ().
> > >=20
> > > sudo is not an auth_login_pgm_domain() i believe
> > >=20
> > > the auth_use_pam() is a subset of auth_login_pgm_domain()
> > >=20
> > > so login_pgm domains are pam clients plus extras needed to log in use=
rs
> > >=20
> > > a auth_use_pam() (pam client) has a pam stack but it might not actual=
ly do logins
> > >=20
> > > sudo uses pam but its not a real login program, so afaik sudo should =
call auth_use_pam()
> > > xdm is a login_pgm, so is sshd etc
> > >=20
> > > systemd is also a pam client, but not a login program
> >=20
> > And yes systemd needs to be able to create these /run/faillock/USER fil=
es as well, but if you test this on RHEL then you wont see it because
> > RHEL doesnt use /etc/pam.d/systemd-user (i suppose)
> >=20
> > so:
> >=20
> > 1. auth_use_pam() =3D=3D "pam clients" (programs that have a file in /e=
tc/pam.d), they use pam for authentication of some sort
> > 2, auth_login_pgm_domain() =3D=3D superset (special pam clients that ne=
ed permissions to do actual logins)
>=20
> Another interesting detail is that pam_faillock clients need cap_dac_over=
ride to be able to write records to /run/faillock/USER files
> I wonder whether that is a bug
>=20
> for example sshd (root) creates /run/faillock/joe with joe.root and 0600 =
but then sshd (root) needs cap_dac_override to write records to that file
> Probably should have created the files with 0660 ... to avoid the need fo=
r cap_dac_override...

I filed a bugzilla for this, just to be sure: https://bugzilla.redhat.com/s=
how_bug.cgi?id=3D1661822

>=20
> >=20
> > >=20
> > > >=20
> > > > I will resubmit this patch,
> > > >=20
> > > > --- snip ---
> > >=20
> > > --=20
> > > Key fingerprint =3D 5F4D 3CDB D3F8 3652 FBD8 02D5 3B6C 5F1D 2C7B 6B02
> > > https://sks-keyservers.net/pks/lookup?op=3Dget&search=3D0x3B6C5F1D2C7=
B6B02
> > > Dominick Grift
> >=20
> >=20
> >=20
> > --=20
> > Key fingerprint =3D 5F4D 3CDB D3F8 3652 FBD8 02D5 3B6C 5F1D 2C7B 6B02
> > https://sks-keyservers.net/pks/lookup?op=3Dget&search=3D0x3B6C5F1D2C7B6=
B02
> > Dominick Grift
>=20
>=20
>=20
> --=20
> Key fingerprint =3D 5F4D 3CDB D3F8 3652 FBD8 02D5 3B6C 5F1D 2C7B 6B02
> https://sks-keyservers.net/pks/lookup?op=3Dget&search=3D0x3B6C5F1D2C7B6B02
> Dominick Grift


--=20
Key fingerprint =3D 5F4D 3CDB D3F8 3652 FBD8 02D5 3B6C 5F1D 2C7B 6B02
https://sks-keyservers.net/pks/lookup?op=3Dget&search=3D0x3B6C5F1D2C7B6B02
Dominick Grift

--Rgf3q3z9SdmXC6oT
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQGzBAEBCAAdFiEEujmXliIBLFTc2Y4AJXSOVTf5R2kFAlwftMEACgkQJXSOVTf5
R2l1mgwAgS/k9Cd356fgQV2taagfHzks1qnNNNhxz4y+rnSBakhzrXoTTMcXq03k
KISlPp7Mv1oXAx5RPMh66fEjbkJgo5d9o2EDiqViSjnEPxCazZA1gicLUTZAOK+0
yKe8Yvfbb26AbrYU2caI1Y+FfsrNJh+LxMKd/gfLByzbnjDndEn1fiF32oV2m7Uq
690VCdsAiurOIng958TJdKPhfuTzMMOu2cKNFuXFUbTwMEy3gwAWfcnCnecMCtpi
S7e6v0+E22SHA0y2XfKnqZYkLhO8G/P88diPAqP0c5H9gQtGGw3ec9B5n1uhk55h
vEYKKeOu1huzU+GokYR7G8pA1z9bsc3om9zILgNIk0LDn+90Ew8CyCo/Pox56owZ
M2PGFZYl7GhWMLtyo1ZCWJRi5AKNXDmR/AgwpgBfyIwoJBQPCHIAS9NKVKqgk1QG
A5Cjh6TNsDmh+iuxROUM5aZPchhlxjbar5htB66LfZopziS7bD209uyV8iV0t0Xg
JSjVY3RV
=2JjS
-----END PGP SIGNATURE-----

--Rgf3q3z9SdmXC6oT--