Security Enhanced Linux
What's New
Frequently Asked Questions
Background
Documents
License
Download
Participating
Mail List
Archives
Remaining Work
Contributors
Related Work
Press Releases
Information Assurance Research
NIARL In-house Research Areas
Mathematical Sciences Program
Sabbaticals
Computer & Information Sciences Research
Technology Transfer
Advanced Computing
Advanced Mathematics
Communications & Networking
Information Processing
Microelectronics
Other Technologies
Technology Fact Sheets
Publications
Related Links
|
SELinux Mailing ListRe: system_u:system_r:system_chkpwd_t:UNCLASSIFIED, how did I get here?
From: Stephen Smalley <sds_at_tycho.nsa.gov>
Date: Mon, 10 Dec 2007 09:55:56 -0500
getdefaultcon in libselinux/utils can help you with investigating what context will be returned for a given user and from-context (i.e. context of the login process). First question is why is the user being mapped to system_u? Bad seusers configuration? semanage login -l As for chkpwd, get_ordered_context_list() first asks the kernel for the full set of reachable contexts for the user via security_compute_user(), which merely checks process transition permission. Thus, the chkpwd context is included in that set since it is reachable (since the login process does in fact transition to it when executing unix_chkpwd). But it normally gets pruned from the final list based on /etc/selinux/$SELINUXTYPE/contexts/default_contexts. However, if no matches are found there, it will return the original list from the kernel, and thus you could end up there (in permissive mode). There has been some talk of overhauling get_ordered_context_list. With regard to pam, there are no domain transitions on function calls, only on execve, so there are no domain transitions when invoking pam modules, only when those modules invoke helper programs like unix_chkpwd. The pam modules themselves run within the domain of the caller. -- Stephen Smalley National Security Agency -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with the words "unsubscribe selinux" without quotes as the message.Received on Mon 10 Dec 2007 - 09:55:59 EST |
|
Date Posted: Jan 15, 2009 | Last Modified: Jan 15, 2009 | Last Reviewed: Jan 15, 2009 |