Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

pam_zfs_key: Add SELinux policy for PAM module #13271

Draft
wants to merge 1 commit into
base: master
Choose a base branch
from
Draft

pam_zfs_key: Add SELinux policy for PAM module #13271

wants to merge 1 commit into from

Commits on Apr 3, 2022

  1. [Draft] pam_zfs_key: Add SELinux policy for PAM module 

    Provide a policy that allows pam_zfs_key to work on an SELinux protected
system without giving excessive access to the PAM module.  This way, any
exploited application using PAM remains unable to destroy datasets or do
anything similarly damaging.

Alas, libzfs opens the device with both read & write permissions, so any
policy that doesn't label the /dev/zfs device specially could open up
other devices to be exploited.  Unfortunately, relabeling the device has
the potential to impact existing systems, so it is not part of this
commit.

Signed-off-by: Chris Lindee <[email protected]>
    @ColMelvin
    ColMelvin committed Apr 3, 2022
    Configuration menu
    Copy the full SHA
    6d2beeb View commit details
    Browse the repository at this point in the history