Relevant BUGIDs:

Purpose of commit: new feature

Commit summary:
---------------
        * modules/pam_namespace/pam_namespace.c: New module
        originally written by Janak Desai.
        * modules/pam_namespace/Makefile.am: New.
        * modules/pam_namespace/README: New.
        * modules/pam_namespace/md5.c: New.
        * modules/pam_namespace/md5.h: New.
        * modules/pam_namespace/namespace.conf: New.
        * modules/pam_namespace/namespace.conf.5: New.
        * modules/pam_namespace/namespace.conf.5.xml: New.
        * modules/pam_namespace/namespace.init: New.
        * modules/pam_namespace/pam_namespace.8: New.
        * modules/pam_namespace/pam_namespace.8.xml: New.
        * modules/Makefile.am: Added pam_namespace.
        * configure.in: Added pam_namespace, test for unshare
        library call.

1 files changed, 141 insertions, 0 deletions

diff --git a/modules/pam_namespace/pam_namespace.8 b/modules/pam_namespace/pam_namespace.8
new file mode 100644
index 00000000..88594304
--- /dev/null
+++ b/modules/pam_namespace/pam_namespace.8
@@ -0,0 +1,141 @@
+.\"Generated by db2man.xsl. Don't modify this, modify the source.
+.de Sh \" Subsection
+.br
+.if t .Sp
+.ne 5
+.PP
+\fB\\$1\fR
+.PP
+..
+.de Sp \" Vertical space (when we can't use .PP)
+.if t .sp .5v
+.if n .sp
+..
+.de Ip \" List item
+.br
+.ie \\n(.$>=3 .ne \\$3
+.el .ne 3
+.IP "\\$1" \\$2
+..
+.TH "PAM_NAMESPACE" 8 "" "" ""
+.SH NAME
+pam_namespace \- PAM module for configuring namespace for a session
+.SH "SYNOPSIS"
+.ad l
+.hy 0
+.HP 17
+\fBpam_namespace\&.so\fR [debug] [unmnt_remnt] [unmnt_only] [require_selinux] [gen_hash] [ignore_config_error] [ignore_instance_parent_mode]
+.ad
+.hy
+
+.SH "DESCRIPTION"
+
+.PP
+The pam_namespace PAM module sets up a private namespace for a session with polyinstantiated directories\&. A polyinstantiated directory provides a different instance of itself based on user name, or when using SELinux, user name, security context or both\&. If an executable script \fI/etc/security/namespace\&.init\fR exists, it is used to initialize the namespace every time a new instance directory is setup\&. The script receives the polyinstantiated directory path and the instance directory path as its arguments\&.
+
+.PP
+The pam_namespace module disassociates the session namespace from the parent namespace\&. Any mounts/unmounts performed in the parent namespace, such as mounting of devices, are not reflected in the session namespace\&. To propagate selected mount/unmount events from the parent namespace into the disassociated session namespace, an administrator may use the special shared\-subtree feature\&. For additional information on shared\-subtree feature, please refer to the mount(8) man page and the shared\-subtree description at http://lwn\&.net/Articles/159077 and http://lwn\&.net/Articles/159092\&.
+
+.SH "OPTIONS"
+
+.TP
+\fBdebug\fR
+A lot of debug information is logged using syslog
+
+.TP
+\fBunmnt_remnt\fR
+For programs such as su and newrole, the login session has already setup a polyinstantiated namespace\&. For these programs, polyinstantiation is performed based on new user id or security context, however the command first needs to undo the polyinstantiation performed by login\&. This argument instructs the command to first undo previous polyinstantiation before proceeding with new polyinstantiation based on new id/context
+
+.TP
+\fBunmnt_only\fR
+For trusted programs that want to undo any existing bind mounts and process instance directories on their own, this argument allows them to unmount currently mounted instance directories
+
+.TP
+\fBrequire_selinux\fR
+If selinux is not enabled, return failure
+
+.TP
+\fBgen_hash\fR
+Instead of using the security context string for the instance name, generate and use its md5 hash\&.
+
+.TP
+\fBignore_config_error\fR
+If a line in the configuration file corresponding to a polyinstantiated directory contains format error, skip that line process the next line\&. Without this option, pam will return an error to the calling program resulting in termination of the session\&.
+
+.TP
+\fBignore_instance_parent_mode\fR
+Instance parent directories by default are expected to have the restrictive mode of 000\&. Using this option, an administrator can choose to ignore the mode of the instance parent\&. This option should be used with caution as it will reduce security and isolation goals of the polyinstantiation mechanism\&.
+
+.SH "MODULE SERVICES PROVIDED"
+
+.PP
+The \fBsession\fR service is supported\&.
+
+.SH "RETURN VALUES"
+
+.TP
+PAM_SUCCESS
+Namespace setup was successful\&.
+
+.TP
+PAM_SERVICE_ERR
+Unexpected system error occurred while setting up namespace\&.
+
+.TP
+PAM_SESSION_ERR
+Unexpected namespace configuration error occurred\&.
+
+.SH "FILES"
+
+.TP
+\fI/etc/security/namespace\&.conf\fR
+Configuration file
+
+.SH "EXAMPLES"
+
+.PP
+For the <service>s you need polyinstantiation (login for example) put the following line in /etc/pam\&.d/<service> as the last line for session group:
+
+.PP
+session required pam_namespace\&.so [arguments]
+
+.PP
+To use polyinstantiation with graphical display manager gdm, insert the following line, before exit 0, in /etc/gdm/PostSession/Default:
+
+.PP
+/usr/sbin/gdm\-safe\-restart
+
+.PP
+This allows gdm to restart after each session and appropriately adjust namespaces of display manager and the X server\&. If polyinstantiation of /tmp is desired along with the graphical environment, then additional configuration changes are needed to address the interaction of X server and font server namespaces with their use of /tmp to create communication sockets\&. Please use the initialization script \fI/etc/security/namespace\&.init\fR to ensure that the X server and its clients can appropriately access the communication socket X0\&. Please refer to the sample instructions provided in the comment section of the instance initialization script \fI/etc/security/namespace\&.init\fR\&. In addition, perform the following changes to use graphical environment with polyinstantiation of /tmp:
+
+.PP
+ 
+
+.nf
+
+      1\&. Disable the use of font server by commenting out "FontPath"
+         line in /etc/X11/xorg\&.conf\&. If you do want to use the font server
+         then you will have to augment the instance initialization
+         script to appropriately provide /tmp/\&.font\-unix from the
+         polyinstantiated /tmp\&.
+      2\&. Ensure that the gdm service is setup to use pam_namespace,
+         as described above, by modifying /etc/pam\&.d/gdm\&.
+      3\&. Ensure that the display manager is configured to restart X server
+         with each new session\&. This default setup can be verified by
+         making sure that /usr/share/gdm/defaults\&.conf contains
+         "AlwaysRestartServer=true", and it is not overridden by
+         /etc/gdm/custom\&.conf\&.
+    
+.fi
+ 
+
+.SH "SEE ALSO"
+
+.PP
+ \fBnamespace\&.conf\fR(5), \fBpam\&.d\fR(8), \fBmount\fR(8), \fBpam\fR(8)\&.
+
+.SH "AUTHORS"
+
+.PP
+The namespace setup scheme was designed by Stephen Smalley, Janak Desai and Chad Sellers\&. The pam_namespace PAM module was developed by Janak Desai <janak@us\&.ibm\&.com>, Chad Sellers <csellers@tresys\&.com> and Steve Grubb <sgrubb@redhat\&.com>\&.
+