| 1 |
On Sun, Nov 27, 2011 at 12:48:14PM -0700, Stan Sander wrote: |
| 2 |
> Thanks for the tip. I was running in staff_r when I got the denials. I |
| 3 |
> thought I read somewhere that staff was allowed to su, so never thought |
| 4 |
> the difference of when I entered the newrole to be that significant. |
| 5 |
> Anyway, I'll call newrole first but it still appears as though I need to |
| 6 |
> keep the calls to pam_selinux out of the su file as it fails when they |
| 7 |
> are in. Also pam_xauth doesn't appear as though it's able to play with |
| 8 |
> selinux, at least not inside the su file. |
| 9 |
|
| 10 |
Heh, my bad. There is no need to put pam_selinux for su in the first place. |
| 11 |
At least, I don't have it on my systems. The only place where pam_selinux is |
| 12 |
called is in the system-login definition for PAM (which is sourced by login, |
| 13 |
slim and sshd PAM definitions). |
| 14 |
|
| 15 |
Meh. |
| 16 |
|
| 17 |
Sven Vermeulen |
Archives