Git-Mirrors/security-misc
1
0
Fork 0
mirror of https://github.com/Kicksecure/security-misc.git synced 2025-07-31 16:38:42 -04:00
Code Issues Projects Releases Packages Wiki Activity

security-misc /usr/share/pam-configs/permission-lockdown-security-misc is no longer required, removed.

Browse source 
Thereby fix apparmor issue.

> Dec 08 09:47:50 host audit[3232]: AVC apparmor="DENIED" operation="exec" profile="/usr/bin/whonixcheck" name="/usr/lib/security-misc/permission-lockdown" pid=3232 comm="sudo" requested_mask="x" denied_mask="x" fsuid=0 ouid=0
> Dec 08 09:47:50 host sudo[3232]: pam_exec(sudo:session): execve(/usr/lib/security-misc/permission-lockdown,...) failed: Permission denied

It is no longer required, because...

existing linux user accounts:

* Get permission lock down because security-misc `debian/security-misc.postinst` calls `/usr/lib/security-misc/permission-lockdown`.

new linux user accounts (created at first boot):

* security-misc `/usr/share/pam-configs/mkhomedir-security-misc` pam mkhomedir sets secure permissions using `umask=027`.
This commit is contained in:
Patrick Schleizer 2019-12-08 05:21:35 -05:00
parent edcc2de71d
commit c192644ee3
No known key found for this signature in database
GPG key ID: CB8D50BB77BB3C48
3 changed files with 4 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

2
usr/share/pam-configs/mkhomedir-security-misc
View file

@ -4,4 +4,4 @@ Priority: 100
Session-Type: Additional
Session-Interactive-Only: yes
Session:
optional pam_mkhomedir.so
optional pam_mkhomedir.so umask=027

6
usr/share/pam-configs/permission-lockdown-security-misc
View file

@ -1,6 +0,0 @@
Name: prevent users from reading other users /home/user folders (by package security-misc)
Default: yes
Priority: 50
Session-Type: Additional
Session:
optional pam_exec.so debug stdout seteuid /usr/lib/security-misc/permission-lockdown