rpms/systemd
7
0
Fork 0
Code Issues Pull Requests Releases Activity

pam: add a call to pam_namespace

Browse Source 
A call to pam_namespace is required so that children of user@.service end up in
a namespace as expected. pam_namespace gets called as part of the stack that
creates a session (login, sshd, gdm, etc.) and those processes end up in a
namespace, but it also needs to be called from our stack which is parallel and
descends from pid1 itself.

The call to pam_namespace is similar to the call to pam_keyinit that was added
in ab79099. The pam stack for user@.service
creates a new session which is disconnected from the parent environment. Both
calls are not suitable for inclusion in the shared part of the stack (e.g.
@system-auth on Fedora/RHEL systems), because for example su/sudo/runuser
should not include them.

Fixes #17043 (Allow to execute user service into dedicated namespace
              if pam_namespace enabled)
Related to https://bugzilla.redhat.com/show_bug.cgi?id=1861836
(Polyinstantiation is ignored/bypassed in GNOME sessions)

rhel-only

Resolves: #2218184
This commit is contained in:
Jan Macku 2023-06-28 15:00:16 +02:00
parent 8478dae30b
commit c8e795b373
1 changed files with 1 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
systemd-user
View File

@ -10,4 +10,5 @@ session required pam_selinux.so nottys open
session required pam_loginuid.so session required pam_loginuid.so
session optional pam_keyinit.so force revoke session optional pam_keyinit.so force revoke
session optional pam_umask.so silent session optional pam_umask.so silent
session required pam_namespace.so
session include system-auth session include system-auth