mir/apparmor
2
0
Fork 0
mirror of https://gitlab.com/apparmor/apparmor synced 2025-08-22 10:07:12 +00:00
Code Issues Releases Wiki Activity

unix-chkpwd: Add read capability to profile

Browse Source 
Following the Security Technical Implementation Guide, it is better to
set the permissions to 0000 for the shadow file.
However, since PAM version 1.6.0, after this change [0], unix-chkpwd
will unconditionnaly read the shadow file. And with the previous
restriction, the binary has an access denied to the shadow which
blocks user authentications. Moreover the PAM changes is needed to fix
the CVE-2024-10041.
Giving the read caability to the unix-chkpwd profile allows it to
function properly. See bug report [1].

[0] - https://github.com/linux-pam/linux-pam/pull/686
[1] - https://bugzilla.suse.com/show_bug.cgi?id=1241678

Signed-off-by: vlefebvre <valentin.lefebvre@suse.com>
(cherry picked from commit 556396a172d09ea032404c7b346f4cf54a949a4e)
Signed-off-by: John Johansen <john.johansen@canonical.com>
This commit is contained in:
vlefebvre 2025-05-12 15:53:33 +00:00 committed by John Johansen
parent b50ee98352
commit 104d601657
1 changed files with 2 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
profiles/apparmor.d/unix-chkpwd
View File

@ -17,6 +17,8 @@ profile unix-chkpwd /{,usr/}{,s}bin/unix_chkpwd {
# To write records to the kernel auditing log.
capability audit_write,
# To read shadow with 000 permissions.
capability dac_read_search,
network netlink raw,