NetCube-Systems-Austria/kumquat-buildroot
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

linux-pam: adjust login pam file for SELinux

Browse Source 
When SELinux support is enabled, the login pam file installed by
linux-pam should be adjusted to use the pam_selinux.so module.

To achieve this in a reasonably simple manner, we introduce the SELinux
related lines in login.pam as comments, and if SELinux support is
enabled, turn those commented lines into real lines.

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Tested-by: Bryce Ferguson <bryce.ferguson@rockwellcollins.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
This commit is contained in:
Thomas Petazzoni 2016-12-06 21:27:03 +01:00
parent cccaf5e046
commit be9157e1c0
2 changed files with 7 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
package/linux-pam/linux-pam.mk
View File

@ -29,6 +29,10 @@ endif
ifeq ($(BR2_PACKAGE_LIBSELINUX),y)
LINUX_PAM_CONF_OPTS += --enable-selinux
LINUX_PAM_DEPENDENCIES += libselinux
define LINUX_PAM_SELINUX_PAMFILE_TWEAK
$(SED) 's/^# \(.*pam_selinux.so.*\)$$/\1/' \
$(TARGET_DIR)/etc/pam.d/login
endef
else
LINUX_PAM_CONF_OPTS += --disable-selinux
endif
@ -46,6 +50,7 @@ define LINUX_PAM_INSTALL_CONFIG
$(TARGET_DIR)/etc/pam.d/login
$(INSTALL) -m 0644 -D package/linux-pam/other.pam \
$(TARGET_DIR)/etc/pam.d/other
$(LINUX_PAM_SELINUX_PAMFILE_TWEAK)
endef
LINUX_PAM_POST_INSTALL_TARGET_HOOKS += LINUX_PAM_INSTALL_CONFIG

2
package/linux-pam/login.pam
View File

@ -4,7 +4,9 @@ account required pam_unix.so
password required pam_unix.so nullok
# session required pam_selinux.so close
session required pam_limits.so
session required pam_env.so
session required pam_unix.so
session optional pam_lastlog.so
# session required pam_selinux.so open