search

mcdope / pam_usb

Hardware authentication for Linux using ordinary flash media (USB & Card based).
GNU General Public License v2.0
194 stars 20 forks source link

[SELinux] SELinux set to anything except "permissive" causes issues with UDisks usage #201

Closed mcdope closed 4 months ago

mcdope commented 1 year ago

Understood

No, I'm just too lazy to provide the data you request for a bug

Text

This was already triaged in #199. It seems SELinux prevents accessing UDisks (or dbus? tbd) from the pam module at least on tty.

Maybe this was also the cause for #141, but this is waiting for reporter feedback.

Todos: [ ] Find a working SELinux config (except setting it to permissive :stuck_out_tongue: ) [ ] Document that config for source installs [ ] Ship that config with the packages if possible

mcdope commented 1 year ago

Doc on how to diagnose such stuff: https://www.redhat.com/sysadmin/diagnose-selinux-violations

... and even better, it mentions a tool to turn a fail log into an allowance config.

mcdope commented 5 months ago

Maybe fixed by #229, will test in the coming days...

mcdope commented 4 months ago

Seems to actually be fixed by that, lol. So SELinux just didn't liked my crappy C.

pamusb-check reports "fine", sudo works, login doesn't work though. still investigating. At least it doesn't crash anymore

grafik grafik

mcdope commented 4 months ago

nvm, still broken on tty :D grafik

mcdope commented 4 months ago

Interestingly, the behaviour is different on F40

grafik

mcdope commented 4 months ago

Got it working on tty login 🥳

grafik

... now let's fix graphical logins...

mcdope commented 4 months ago

Actually - this fixed GDM as well :O Nice surprise.

grafik

mcdope commented 4 months ago

Still getting the dbus errors from https://github.com/mcdope/pam_usb/issues/201#issuecomment-2214750336 on F37 though. Unrelated I guess?

mcdope commented 4 months ago

Considering it's now working on the latest Fedora with the new profile, and lack of feedback and/or interest, and lack of distributions actually shipping SELinux... This is done.

Will merge the Fedora profile I've created, but it won't be installed by default or shipped in packages. Instead I will add a wiki entry pointing to the files and how to install them, also having a tutorial on how to create your own profile.