mainOATH Toolkit - Support: sr #108723, RFE: Configurable lock file...

 
 

sr #108723: RFE: Configurable lock file location (for SELinux compatiblity)

Submitter:  Jaroslav Škarvada <yarda>
Submitted:  Fri 09 Jan 2015 02:31:44 PM UTC
   
 
Category:  None Priority:  5 - Normal
Severity:  3 - Normal Status:  None
Privacy:  Public Assigned to:  None
Open/Closed:  Open Operating System:  None
* Mandatory Fields

Add a New Comment Rich Markup
   

Fri 09 Jan 2015 02:31:44 PM UTC, original submission:  

Currently the pam_oath module doesn't work with SELinux out of the box, because it creates lock file when updating usersfile. The problem is that it creates the lock file in the same directory the usersfile is located and it's mostly not allowed by SELinux rules to create new files by pam modules.

It seems it is not possible to remove the external lock file and use only advisory locking on usersfile, because it will introduce race condition.

So I tried to extend the liboath API by oath_set_lockfile_path call which sets the lockfile location for all successive API calls. If not used or the lockfile path is set to NULL, previous behaviour (i.e. no global lock, only local usersfile lock) is used. I also extended pam module to use this new API call and create its global lock as: /var/lock/pam_oath.lock. This should resolve the SELinux problem. I think using one global lock for pam module shouldn't be performance bottleneck in most cases, but for cases where it is, I also added lockfile pam module parameter, so arbitrary usersfile/lockfiles (without one global lock) can be also used.

Attached patch is proof of concept, feel free to change/rework it as needed.

There is Fedora bug report about this problem:
https://bugzilla.redhat.com/show_bug.cgi?id=1178036

Jaroslav Škarvada <yarda>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

Attached Files
file #32799:  oath-toolkit-2.4.1-lockfile.patch added by yarda (5KiB - text/x-diff - Proposed fix)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by yarda (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follows 1 latest change.

    Date Changed by Updated Field Previous Value => Replaced by
    2015-01-09 yarda Attached File- Added oath-toolkit-2.4.1-lockfile.patch, #32799

    Back to the top

    Powered by Savane 3.13-d3ae.
    Corresponding source code