On Sun, 2006-05-28 at 11:57 +0200, Jurgen Kramer wrote: > On Sat, 2006-05-27 at 21:40 +0100, Paul Howarth wrote: > > On Sat, 2006-05-27 at 18:54 +0200, Jurgen Kramer wrote: > > > I am trying to add a custom PAM module (pam_poldi.so) to my FC5 system > > > to be able to login using a OpenPGP smartcard. I already changed the > > > security context of /lib/security/pam_poldi.so to match the other pam > > > modules (system_u:object_r:lib_t) but it seems that is not enough. In > > > syslog I still see: > > > > > > su: PAM unable to dlopen(/lib/security/pam_poldi.so) > > > su: PAM [error: /lib/security/pam_poldi.so: cannot restore segment prot > > > after reloc: Permission denied] > > > > > > This can propably be fixed with a chcon -t > > > texrel_shlib_t /lib/security/pam_poldi.so > > > > > > This will probably not survice an selinux update or relabel session. > > > What is the proper way to add the module so it will survice relabels and > > > selinux updates? > > > > This should do it: > > > > # semanage fcontext -a -t textrel_shlib_t -f > > -- /lib/security/pam_poldi.so > > > > (that's all one long line) > > > > You could test it by changing the context back to lib_t and then doing: > > > > # restorecon -v /lib/security/pam_poldi.so > > > > which should set it back to textrel_shlib_t. > Unfortunately that did not do it :( > > I still get: > > su: PAM unable to dlopen(/lib/security/pam_poldi.so) > su: PAM [error: /lib/security/pam_poldi.so: cannot restore segment prot > after reloc: Permission denied] > su: PAM adding faulty module: /lib/security/pam_poldi.so > > Any ideas? 1. Is the context type of /lib/security/pam_poldi.so currently set to textrel_shlib_t? 2. What "avc: denied" messages, if any, do you see in /var/log/messages relating to this? Paul.
