apparmor/changehat/pam_apparmor/pam_apparmor.h

57 lines
2.2 KiB
C
Raw Permalink Normal View History

This (updated) patch provides some limited configurability for pam_apparmor pam module. The default behavior is to use the user's primary groupname, and to fall back to the DEFAULT hat. You can change this behavior by appending order=type1[,type2,type3] to the pam_apparmor session line in the pam config for the application you're applying pam_apparmor to. The available types are 'user' for username, 'group' for groupname, and 'default' for DEFAULT. Thus, adding a configuration entry like: session optional pam_apparmor.so order=group,default is equivalent to the default behavior for pam_apparmor. The parse_option code got a little more complicated than I'd hoped it would be; I could have just had types by space delimited options to module, but I thought I'd leave open the possibility of adding additional options to the module ('debug' immediately comes to mind). I disabled the short-circuit that occurs if EPERM is returned by change_hat, as we can't detect that this is because there's no hats or that the application is entirely undefined; if ECHILD makes it in then we can re-enable this. I am less convinced now that pam_apparmor needs to be 'optional' than 'required'; killing the session if none of the change_hats succeeds is starting to feel like reasonable behavior. --- changehat/pam_apparmor/Makefile | 11 + changehat/pam_apparmor/README | 74 +++++++++++++ changehat/pam_apparmor/get_options.c | 157 ++++++++++++++++++++++++++++ changehat/pam_apparmor/pam_apparmor.c | 155 +++++++++++++++++++-------- changehat/pam_apparmor/pam_apparmor.h | 56 +++++++++ changehat/pam_apparmor/pam_apparmor.spec.in | 2 6 files changed, 406 insertions(+), 49 deletions(-)
2006-10-31 15:54:47 +00:00
/* pam_apparmor module */
/*
* Written by Jesse Michael <jmichael@suse.de> 2006/08/24
* and Steve Beattie <sbeattie@suse.de> 2006/10/25
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, and the entire permission notice in its entirety,
* including the disclaimer of warranties.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
* 3. The name of the author may not be used to endorse or promote
* products derived from this software without specific prior
* written permission.
*
* ALTERNATIVELY, this product may be distributed under the terms of
* the GNU Public License, in which case the provisions of the GPL are
* required INSTEAD OF the above restrictions. (This clause is
* necessary due to a potential bad interaction between the GPL and
* the restrictions contained in a BSD-style copyright.)
*
* THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
* WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
* OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
* DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT,
* INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
* (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
* SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
* STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
* OF THE POSSIBILITY OF SUCH DAMAGE.
*/
enum hat_t {
eNoEntry,
eUsername,
eGroupname,
eDefault,
};
typedef enum hat_t hat_t;
#define MAX_HAT_TYPES 3
struct config {
hat_t hat_type[MAX_HAT_TYPES];
};
extern int debug_flag;
This (updated) patch provides some limited configurability for pam_apparmor pam module. The default behavior is to use the user's primary groupname, and to fall back to the DEFAULT hat. You can change this behavior by appending order=type1[,type2,type3] to the pam_apparmor session line in the pam config for the application you're applying pam_apparmor to. The available types are 'user' for username, 'group' for groupname, and 'default' for DEFAULT. Thus, adding a configuration entry like: session optional pam_apparmor.so order=group,default is equivalent to the default behavior for pam_apparmor. The parse_option code got a little more complicated than I'd hoped it would be; I could have just had types by space delimited options to module, but I thought I'd leave open the possibility of adding additional options to the module ('debug' immediately comes to mind). I disabled the short-circuit that occurs if EPERM is returned by change_hat, as we can't detect that this is because there's no hats or that the application is entirely undefined; if ECHILD makes it in then we can re-enable this. I am less convinced now that pam_apparmor needs to be 'optional' than 'required'; killing the session if none of the change_hats succeeds is starting to feel like reasonable behavior. --- changehat/pam_apparmor/Makefile | 11 + changehat/pam_apparmor/README | 74 +++++++++++++ changehat/pam_apparmor/get_options.c | 157 ++++++++++++++++++++++++++++ changehat/pam_apparmor/pam_apparmor.c | 155 +++++++++++++++++++-------- changehat/pam_apparmor/pam_apparmor.h | 56 +++++++++ changehat/pam_apparmor/pam_apparmor.spec.in | 2 6 files changed, 406 insertions(+), 49 deletions(-)
2006-10-31 15:54:47 +00:00
extern int get_options(pam_handle_t *pamh, struct config **config,
int argc, const char **argv);