Adding a custom PAM module and selinux

[Daniel J Walsh]

Jurgen Kramer wrote:
> On Sun, 2006-05-28 at 11:01 +0100, Paul Howarth wrote:
>   
>> On Sun, 2006-05-28 at 11:57 +0200, Jurgen Kramer wrote:
>>     
>>> On Sat, 2006-05-27 at 21:40 +0100, Paul Howarth wrote:
>>>       
>>>> On Sat, 2006-05-27 at 18:54 +0200, Jurgen Kramer wrote:
>>>>         
>>>>> I am trying to add a custom PAM module (pam_poldi.so) to my FC5 system
>>>>> to be able to login using a OpenPGP smartcard. I already changed the
>>>>> security context of /lib/security/pam_poldi.so to match the other pam
>>>>> modules (system_u:object_r:lib_t) but it seems that is not enough. In
>>>>> syslog I still see:
>>>>>
>>>>> su: PAM unable to dlopen(/lib/security/pam_poldi.so)
>>>>> su: PAM [error: /lib/security/pam_poldi.so: cannot restore segment prot
>>>>> after reloc: Permission denied]
>>>>>
>>>>> This can propably be fixed with a chcon -t
>>>>> texrel_shlib_t /lib/security/pam_poldi.so
>>>>>
>>>>> This will probably not survice an selinux update or relabel session.
>>>>> What is the proper way to add the module so it will survice relabels and
>>>>> selinux updates?
>>>>>           
>>>> This should do it:
>>>>
>>>> # semanage fcontext -a -t textrel_shlib_t -f
>>>> -- /lib/security/pam_poldi.so
>>>>
>>>> (that's all one long line)
>>>>
>>>> You could test it by changing the context back to lib_t and then doing:
>>>>
>>>> # restorecon -v /lib/security/pam_poldi.so
>>>>
>>>> which should set it back to textrel_shlib_t.
>>>>         
>>> Unfortunately that did not do it :( 
>>>
>>> I still get:
>>>
>>> su: PAM unable to dlopen(/lib/security/pam_poldi.so)
>>> su: PAM [error: /lib/security/pam_poldi.so: cannot restore segment prot
>>> after reloc: Permission denied]
>>> su: PAM adding faulty module: /lib/security/pam_poldi.so
>>>
>>> Any ideas?
>>>       
>> 1. Is the context type of /lib/security/pam_poldi.so currently set to
>> textrel_shlib_t?
>>     
>
> [root at paragon ~]# ls -Z /lib/security/pam_poldi.so
> -rwxr-xr-x  root     root
> system_u:object_r:lib_t          /lib/security/pam_poldi.so
>   
chcon -t textrel_shlib_t /lib/security/pam_poldi.so

Also report this as a bug to the shippers of /lib/security/pam_poldi.so
they probably have a build problem.

Reference

SELinux Memory Protection Tests 
<http://people.redhat.com/%7Edrepper/selinux-mem.html>

Dan
>   
>> 2. What "avc:  denied" messages, if any, do you see in /var/log/messages
>> relating to this?
>>     
>
> audit(1148810039.087:6): avc:  denied  { execmod } for  pid=5144
> comm="su" name="pam_poldi.so" dev=sdb6 ino=13631516
> scontext=user_u:system_r:unconfined_t:s0
> tcontext=system_u:object_r:lib_t:s0 tclass=file
> audit(1148810079.358:7): avc:  denied  { execheap } for  pid=5172
> comm="su" scontext=user_u:system_r:unconfined_t:s0
> tcontext=user_u:system_r:unconfined_t:s0 tclass=process
>
>
> Jurgen
>
>
>