| |||||||||||||
Shadow hardeningShadow hardeningPosted Mar 23, 2012 9:26 UTC (Fri) by phajdan.jr (subscriber, #83686)In reply to: Shadow hardening by dpquigl Parent article: Shadow hardening
Thank you for commenting about that. It's not really an incompatibility (and that has nothing to do with pam_selinux), but yeah there are at least two problems here:
1. The policies would need an update. It's not obvious to me how to do that though, since program names are the same as with shadow-utils, e.g. passwd and so on.
2. The code of hardened-shadow needs to be SELinux aware, e.g. to properly set SELinux context for files when replacing them (as far as I understand it).
I'm not sure if I'll find time to do the above myself, but patches to do #2 are welcome, and I can answer any questions to make creation/update of the policy easier.
People interested in the above are welcome to post on the project mailing lists listed on http://code.google.com/p/hardened-shadow/
(Log in to post comments)
Shadow hardening Posted Mar 23, 2012 13:09 UTC (Fri) by dpquigl (subscriber, #52852) [Link]
I'd recommend joining the SELinux mailing list at http://www.nsa.gov/research/selinux/list.shtml. I'm sure you will find people to help with both 1 and 2. I'm not sure of shadow utils is currently SELinux aware or not. It might be because there was no way of writing different type transition rules for two files in the same directory created by the same process. Eric Paris I believe fixed this by making type transitions optionally take a name as their last component. In newer versions of SELinux we should be able to use that to do all this work in policy. I also think that even that might not be needed. If I understand things properly this stores the new shadow information under its own directory right? We can label that parent directory properly and any directories under it and files created under those should have the right contexts.
|
|||||||||||||