2006-04-11 21:52:54 +00:00
|
|
|
# ----------------------------------------------------------------------
|
|
|
|
# Copyright (c) 1999, 2004, 2005 NOVELL (All rights reserved)
|
2016-12-10 10:25:31 -08:00
|
|
|
# Copyright (c) 2016 Canonical, Ltd.
|
2006-04-11 21:52:54 +00:00
|
|
|
#
|
|
|
|
# This program is free software; you can redistribute it and/or
|
|
|
|
# modify it under the terms of version 2 of the GNU General Public
|
|
|
|
# License published by the Free Software Foundation.
|
|
|
|
#
|
|
|
|
# This program is distributed in the hope that it will be useful,
|
|
|
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
|
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
|
|
# GNU General Public License for more details.
|
|
|
|
#
|
|
|
|
# You should have received a copy of the GNU General Public License
|
|
|
|
# along with this program; if not, contact Novell, Inc.
|
|
|
|
# ----------------------------------------------------------------------
|
|
|
|
NAME=pam_apparmor
|
|
|
|
all:
|
|
|
|
COMMONDIR=../../common/
|
|
|
|
|
2015-01-23 15:52:09 -08:00
|
|
|
include $(COMMONDIR)/Make.rules
|
2006-04-11 21:52:54 +00:00
|
|
|
|
2014-01-09 11:57:13 -08:00
|
|
|
ifdef USE_SYSTEM
|
|
|
|
LIBAPPARMOR = $(shell if pkg-config --exists libapparmor ; then \
|
|
|
|
pkg-config --silence-errors --libs libapparmor ; \
|
|
|
|
elif ldconfig -p | grep -q libapparmor\.so$$ ; then \
|
|
|
|
echo -lapparmor ; \
|
|
|
|
fi )
|
|
|
|
ifeq ($(strip $(LIBAPPARMOR)),)
|
2014-03-11 14:42:23 -07:00
|
|
|
ERROR_MESSAGE = $(error ${nl}\
|
|
|
|
************************************************************************${nl}\
|
|
|
|
Unable to find libapparmor installed on this system; either${nl}\
|
|
|
|
install libapparmor devel packages, set the LIBAPPARMOR variable${nl}\
|
|
|
|
manually, or build against in-tree libapparmor.${nl}\
|
|
|
|
************************************************************************${nl})
|
2014-01-09 11:57:13 -08:00
|
|
|
endif
|
|
|
|
LIBAPPARMOR_INCLUDE =
|
|
|
|
AA_LDLIBS = $(LIBAPPARMOR)
|
|
|
|
AA_LINK_FLAGS =
|
|
|
|
else
|
|
|
|
LIBAPPARMOR_SRC := ../../libraries/libapparmor/
|
|
|
|
LIBAPPARMOR_INCLUDE_PATH = $(LIBAPPARMOR_SRC)/include
|
|
|
|
LIBAPPARMOR_PATH := $(LIBAPPARMOR_SRC)/src/.libs/
|
|
|
|
ifeq ($(realpath $(LIBAPPARMOR_PATH)/libapparmor.a),)
|
2014-03-11 14:42:23 -07:00
|
|
|
ERROR_MESSAGE = $(error ${nl}\
|
|
|
|
************************************************************************${nl}\
|
|
|
|
$(LIBAPPARMOR_PATH)/libapparmor.a is missing; either build against${nl}\
|
|
|
|
the in-tree libapparmor by building it first and then trying again${nl}\
|
|
|
|
(see the top-level README for help) or build against the system${nl}\
|
|
|
|
libapparmor by adding USE_SYSTEM=1 to your make command.${nl}\
|
|
|
|
************************************************************************${nl})
|
2014-01-09 11:57:13 -08:00
|
|
|
endif
|
|
|
|
LIBAPPARMOR_INCLUDE = -I$(LIBAPPARMOR_INCLUDE_PATH)
|
|
|
|
AA_LINK_FLAGS = -L$(LIBAPPARMOR_PATH)
|
|
|
|
AA_LDLIBS = -lapparmor
|
|
|
|
endif
|
2020-05-28 09:55:31 -07:00
|
|
|
EXTRA_CFLAGS=$(CFLAGS) $(CPPFLAGS) -fPIC -shared -Wall $(EXTRA_WARNINGS) $(LIBAPPARMOR_INCLUDE)
|
2017-01-19 23:04:34 +00:00
|
|
|
LINK_FLAGS=-Xlinker -x $(AA_LINK_FLAGS) $(LDFLAGS)
|
2014-01-09 11:57:13 -08:00
|
|
|
LIBS=-lpam $(AA_LDLIBS)
|
This (updated) patch provides some limited configurability for
pam_apparmor pam module. The default behavior is to use the user's
primary groupname, and to fall back to the DEFAULT hat. You can change
this behavior by appending order=type1[,type2,type3] to the pam_apparmor
session line in the pam config for the application you're applying
pam_apparmor to. The available types are 'user' for username, 'group'
for groupname, and 'default' for DEFAULT. Thus, adding a configuration
entry like:
session optional pam_apparmor.so order=group,default
is equivalent to the default behavior for pam_apparmor.
The parse_option code got a little more complicated than I'd hoped
it would be; I could have just had types by space delimited options to
module, but I thought I'd leave open the possibility of adding additional
options to the module ('debug' immediately comes to mind).
I disabled the short-circuit that occurs if EPERM is returned by
change_hat, as we can't detect that this is because there's no hats or
that the application is entirely undefined; if ECHILD makes it in then
we can re-enable this.
I am less convinced now that pam_apparmor needs to be 'optional' than
'required'; killing the session if none of the change_hats succeeds is
starting to feel like reasonable behavior.
---
changehat/pam_apparmor/Makefile | 11 +
changehat/pam_apparmor/README | 74 +++++++++++++
changehat/pam_apparmor/get_options.c | 157 ++++++++++++++++++++++++++++
changehat/pam_apparmor/pam_apparmor.c | 155 +++++++++++++++++++--------
changehat/pam_apparmor/pam_apparmor.h | 56 +++++++++
changehat/pam_apparmor/pam_apparmor.spec.in | 2
6 files changed, 406 insertions(+), 49 deletions(-)
2006-10-31 15:54:47 +00:00
|
|
|
OBJECTS=${NAME}.o get_options.o
|
2006-04-11 21:52:54 +00:00
|
|
|
|
2014-01-09 12:11:19 -08:00
|
|
|
.PHONY: libapparmor_check
|
|
|
|
.SILENT: libapparmor_check
|
2014-03-11 14:42:23 -07:00
|
|
|
libapparmor_check: ; $(ERROR_MESSAGE)
|
2014-01-09 12:11:19 -08:00
|
|
|
|
2016-12-10 10:25:31 -08:00
|
|
|
all: libapparmor_check $(NAME).so docs
|
|
|
|
|
|
|
|
.PHONY: docs
|
|
|
|
# docs: we should have some
|
|
|
|
docs:
|
2006-04-11 21:52:54 +00:00
|
|
|
|
This (updated) patch provides some limited configurability for
pam_apparmor pam module. The default behavior is to use the user's
primary groupname, and to fall back to the DEFAULT hat. You can change
this behavior by appending order=type1[,type2,type3] to the pam_apparmor
session line in the pam config for the application you're applying
pam_apparmor to. The available types are 'user' for username, 'group'
for groupname, and 'default' for DEFAULT. Thus, adding a configuration
entry like:
session optional pam_apparmor.so order=group,default
is equivalent to the default behavior for pam_apparmor.
The parse_option code got a little more complicated than I'd hoped
it would be; I could have just had types by space delimited options to
module, but I thought I'd leave open the possibility of adding additional
options to the module ('debug' immediately comes to mind).
I disabled the short-circuit that occurs if EPERM is returned by
change_hat, as we can't detect that this is because there's no hats or
that the application is entirely undefined; if ECHILD makes it in then
we can re-enable this.
I am less convinced now that pam_apparmor needs to be 'optional' than
'required'; killing the session if none of the change_hats succeeds is
starting to feel like reasonable behavior.
---
changehat/pam_apparmor/Makefile | 11 +
changehat/pam_apparmor/README | 74 +++++++++++++
changehat/pam_apparmor/get_options.c | 157 ++++++++++++++++++++++++++++
changehat/pam_apparmor/pam_apparmor.c | 155 +++++++++++++++++++--------
changehat/pam_apparmor/pam_apparmor.h | 56 +++++++++
changehat/pam_apparmor/pam_apparmor.spec.in | 2
6 files changed, 406 insertions(+), 49 deletions(-)
2006-10-31 15:54:47 +00:00
|
|
|
$(NAME).so: ${OBJECTS}
|
|
|
|
$(CC) $(EXTRA_CFLAGS) $(LINK_FLAGS) -o $@ ${OBJECTS} $(LIBS)
|
|
|
|
|
|
|
|
%.o: %.c
|
|
|
|
$(CC) $(EXTRA_CFLAGS) -c -o $@ $<
|
2006-04-11 21:52:54 +00:00
|
|
|
|
|
|
|
# need some better way of determining this
|
|
|
|
DESTDIR=/
|
2011-02-08 07:21:20 -08:00
|
|
|
SECDIR ?= ${DESTDIR}/lib/security
|
2006-04-11 21:52:54 +00:00
|
|
|
|
|
|
|
.PHONY: install
|
2007-08-14 19:06:19 +00:00
|
|
|
install: $(NAME).so
|
2006-08-09 22:39:20 +00:00
|
|
|
install -m 755 -d $(SECDIR)
|
2018-01-19 08:22:35 +00:00
|
|
|
install -m 755 $(NAME).so $(SECDIR)/
|
2006-04-11 21:52:54 +00:00
|
|
|
|
|
|
|
.PHONY: clean
|
2015-01-23 15:52:09 -08:00
|
|
|
clean:
|
2006-10-25 20:13:48 +00:00
|
|
|
rm -f core core.* *.so *.o *.s *.a *~
|