From: Mike Edenfield <kutulu@kutulu.org>
To: gentoo-hardened@lists.gentoo.org
Subject: Re: [gentoo-hardened] SeLinux system_u:system_r:initrc_t inside KDE
Date: Sat, 13 Aug 2011 14:33:21 -0400 [thread overview]
Message-ID: <8488509.YlHQJiIbuf@platypus> (raw)
In-Reply-To: <CAPzO=Ny7vzeH6NzxwgMq+D=CRmueKQ+3ZNM24Lg3Nnm98F00BQ@mail.gmail.com>
On Saturday, August 13, 2011 12:25:26 AM Sven Vermeulen wrote:
> On Thu, Aug 11, 2011 at 7:25 PM, Udo Siewert <algenib@lavabit.com> wrote:
> > /usr/bin/kdm system_u:object_r:xdm_exec_t
> > /usr/bin/xdm system_u:object_r:xdm_exec_t
> >
> > When starting KDE by /etc/init.d/xdm 'id -Z' ->
> > system_u:system_r:xdm_t
> >
> > and all KDE processes -> system_u:system_r:xdm_t
>
> Hmm... assuming xdm works through some PAM configuration, can you tell me
> how /etc/conf.d/xdm (or kdm, gdm, whatever) looks like?
>
> If it doesn't source system-auth (which is where we put the pam_selinux.so
> call in) that might be the reason...
My system-auth doesn't have anything about SELinux in it. The pam_selinux.so
calls are in system-login. This looks like what pambase is supposed to be
doing. system-login.in has these:
#if HAVE_SELINUX
session required pam_selinux.so close
#endif
and system-auth.in doesn't.
Which one should kdm/gdm be using? Right now /etc/pam.d/kde pulls in system-
auth. Can I just move the pam_selinux calls?
--Mike
next prev parent reply other threads:[~2011-08-13 18:44 UTC|newest]
Thread overview: 13+ messages / expand[flat|nested] mbox.gz Atom feed top
2011-08-10 18:57 [gentoo-hardened] SeLinux system_u:system_r:initrc_t inside KDE Radosław Smogura
2011-08-11 12:26 ` Mike Edenfield
2011-08-11 12:38 ` Udo Siewert
2011-08-11 14:52 ` Sven Vermeulen
2011-08-11 17:25 ` Udo Siewert
2011-08-12 22:25 ` Sven Vermeulen
2011-08-13 4:18 ` Udo Siewert
2011-08-15 1:17 ` Radosław Smogura
2011-08-13 18:33 ` Mike Edenfield [this message]
2011-08-14 9:25 ` Sven Vermeulen
2011-08-14 13:00 ` Udo Siewert
2011-08-14 13:02 ` Mike Edenfield
2011-08-14 13:27 ` Sven Vermeulen
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=8488509.YlHQJiIbuf@platypus \
--to=kutulu@kutulu.org \
--cc=gentoo-hardened@lists.gentoo.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox