Bug 646448
Summary: | Replace SETUID in spec file with the correct file capabilities. | ||
---|---|---|---|
Product: | [Fedora] Fedora | Reporter: | Daniel Walsh <dwalsh> |
Component: | pam | Assignee: | Tomas Mraz <tmraz> |
Status: | CLOSED WONTFIX | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
Severity: | medium | Docs Contact: | |
Priority: | low | ||
Version: | rawhide | CC: | bnocera, dwalsh, mgrepl, sgrubb, tmraz |
Target Milestone: | --- | ||
Target Release: | --- | ||
Hardware: | Unspecified | ||
OS: | Unspecified | ||
Whiteboard: | |||
Fixed In Version: | Doc Type: | Bug Fix | |
Doc Text: | Story Points: | --- | |
Clone Of: | 646443 | Environment: | |
Last Closed: | 2011-04-05 13:22:23 UTC | Type: | --- |
Regression: | --- | Mount Type: | --- |
Documentation: | --- | CRM: | |
Verified Versions: | Category: | --- | |
oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
Cloudforms Team: | --- | Target Upstream Version: | |
Embargoed: | |||
Bug Depends On: | |||
Bug Blocks: | 693731 |
Description
Daniel Walsh
2010-10-25 12:56:26 UTC
There are two simple helpers with setuid bit in pam - unix_chkpwd and pam_timestamp_check. Both would need cap_dac_override. The unix_chkpwd would also need cap_audit_write. Note that changing to capabilities instead of setuid on unix_chkpwd has potential to break some specific configurations such as using pam_unix to authenticate users with hashes obtained from LDAP server with nss_ldap. So I am not sure the very small benefit of having cap_dac_override instead of setuid is worth the potential regressions. Ok lets close these as wontfix |