Re: Adding a custom PAM module and selinux

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Sat, 2006-05-27 at 18:54 +0200, Jurgen Kramer wrote:
> I am trying to add a custom PAM module (pam_poldi.so) to my FC5 system
> to be able to login using a OpenPGP smartcard. I already changed the
> security context of /lib/security/pam_poldi.so to match the other pam
> modules (system_u:object_r:lib_t) but it seems that is not enough. In
> syslog I still see:
> 
> su: PAM unable to dlopen(/lib/security/pam_poldi.so)
> su: PAM [error: /lib/security/pam_poldi.so: cannot restore segment prot
> after reloc: Permission denied]
> 
> This can propably be fixed with a chcon -t
> texrel_shlib_t /lib/security/pam_poldi.so
> 
> This will probably not survice an selinux update or relabel session.
> What is the proper way to add the module so it will survice relabels and
> selinux updates?

This should do it:

# semanage fcontext -a -t textrel_shlib_t -f
-- /lib/security/pam_poldi.so

(that's all one long line)

You could test it by changing the context back to lib_t and then doing:

# restorecon -v /lib/security/pam_poldi.so

which should set it back to textrel_shlib_t.

Paul.


[Index of Archives]     [Current Fedora Users]     [Fedora Desktop]     [Fedora SELinux]     [Yosemite News]     [Yosemite Photos]     [KDE Users]     [Fedora Tools]     [Fedora Docs]
  Powered by Linux