mirrors/poky
1
0
Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-05-09 05:29:32 +00:00
Code Issues Projects Releases Wiki Activity

libpam: deny all services for the OTHER entries

Browse Source 
To be secure, change behavior of the OTHER entries to warn and deny
access to everything by stating pam_deny.so on all services.

(From OE-Core rev: 4ca0af699b5b4b3cf95b3e76482651949fd922ac)

Signed-off-by: Ming Liu <ming.liu@windriver.com>
Signed-off-by: Saul Wold <sgw@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This commit is contained in:
Ming Liu
2013-07-26 17:51:02 +08:00
committed by Richard Purdie
parent f02e5a656a
commit 82ac6aaa29
1 changed files with 6 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
meta/recipes-extended/pam/libpam/pam.d/other
+6 -9
View File
@@ -6,22 +6,19 @@
#pam_open_session, the session module out of /etc/pam.d/other is
#used.
#If you really want nothing to happen then use pam_permit.so or
#pam_deny.so as appropriate.
# We use pam_warn.so to generate syslog notes that the 'other'
#fallback rules are being used (as a hint to suggest you should setup
#specific PAM rules for the service and aid to debugging). We then
#fall back to the system default in /etc/pam.d/common-*
#specific PAM rules for the service and aid to debugging). Then to be
#secure, deny access to all services by default.
auth required pam_warn.so
auth include common-auth
auth required pam_deny.so
account required pam_warn.so
account include common-account
account required pam_deny.so
password required pam_warn.so
password include common-password
password required pam_deny.so
session required pam_warn.so
session include common-session
session required pam_deny.so