From 59812d1cf1127a1af65b530addff76be767092b1 Mon Sep 17 00:00:00 2001 From: Topi Miettinen Date: Fri, 10 May 2019 22:11:40 +0300 Subject: pam_namespace: secure tmp-inst directories When using polyinstantiation for /tmp and/or /var/tmp, pam_namespace creates subdirectories with fixed name tmp-inst. These paths should be secured as early as possible to avoid that somehow these directories could created and controlled by for example a malicious user or service. Ship a systemd service, which creates the directories early in boot sequence with correct permissions and ownership. Closes #111. Signed-off-by: Topi Miettinen --- modules/pam_namespace/pam_namespace_helper.in | 15 +++++++++++++++ 1 file changed, 15 insertions(+) create mode 100644 modules/pam_namespace/pam_namespace_helper.in (limited to 'modules/pam_namespace/pam_namespace_helper.in') diff --git a/modules/pam_namespace/pam_namespace_helper.in b/modules/pam_namespace/pam_namespace_helper.in new file mode 100644 index 00000000..b9c361fb --- /dev/null +++ b/modules/pam_namespace/pam_namespace_helper.in @@ -0,0 +1,15 @@ +#!/bin/sh + +CONF=@SCONFIGDIR@/namespace.conf + +# Match logic of process_line(), except lines with $HOME are ignored +# skip the leading white space, rip off the comments, ignore empty lines +sed -e 's/^[ ]*//g' -e 's/#.*//g' -e '/.*\$HOME.*/d' -e '/^$/d' < $CONF | \ + while read polydir instance_prefix method uids; do + if [ ! -e "$instance_prefix" ]; then + echo "mkdir $instance_prefix" + mkdir --parents --mode=0 -Z "$instance_prefix" + fi + done + +exit 0 -- cgit v1.2.3