diff options
Diffstat (limited to '')
| -rw-r--r-- | modules/pam_group/pam_group.8 | 109 | ||||
| -rw-r--r-- | modules/pam_group/pam_group.8.xml | 162 |
2 files changed, 271 insertions, 0 deletions
diff --git a/modules/pam_group/pam_group.8 b/modules/pam_group/pam_group.8 new file mode 100644 index 0000000..94b4afb --- /dev/null +++ b/modules/pam_group/pam_group.8 @@ -0,0 +1,109 @@ +'\" t +.\" Title: pam_group +.\" Author: [see the "AUTHORS" section] +.\" Generator: DocBook XSL Stylesheets v1.79.1 <http://docbook.sf.net/> +.\" Date: 06/08/2020 +.\" Manual: Linux-PAM Manual +.\" Source: Linux-PAM Manual +.\" Language: English +.\" +.TH "PAM_GROUP" "8" "06/08/2020" "Linux-PAM Manual" "Linux-PAM Manual" +.\" ----------------------------------------------------------------- +.\" * Define some portability stuff +.\" ----------------------------------------------------------------- +.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +.\" http://bugs.debian.org/507673 +.\" http://lists.gnu.org/archive/html/groff/2009-02/msg00013.html +.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +.ie \n(.g .ds Aq \(aq +.el .ds Aq ' +.\" ----------------------------------------------------------------- +.\" * set default formatting +.\" ----------------------------------------------------------------- +.\" disable hyphenation +.nh +.\" disable justification (adjust text to left margin only) +.ad l +.\" ----------------------------------------------------------------- +.\" * MAIN CONTENT STARTS HERE * +.\" ----------------------------------------------------------------- +.SH "NAME" +pam_group \- PAM module for group access +.SH "SYNOPSIS" +.HP \w'\fBpam_group\&.so\fR\ 'u +\fBpam_group\&.so\fR +.SH "DESCRIPTION" +.PP +The pam_group PAM module does not authenticate the user, but instead it grants group memberships (in the credential setting phase of the authentication module) to the user\&. Such memberships are based on the service they are applying for\&. +.PP +By default rules for group memberships are taken from config file +/etc/security/group\&.conf\&. +.PP +This module\*(Aqs usefulness relies on the file\-systems accessible to the user\&. The point being that once granted the membership of a group, the user may attempt to create a +\fBsetgid\fR +binary with a restricted group ownership\&. Later, when the user is not given membership to this group, they can recover group membership with the precompiled binary\&. The reason that the file\-systems that the user has access to are so significant, is the fact that when a system is mounted +\fInosuid\fR +the user is unable to create or execute such a binary file\&. For this module to provide any level of security, all file\-systems that the user has write access to should be mounted +\fInosuid\fR\&. +.PP +The pam_group module functions in parallel with the +/etc/group +file\&. If the user is granted any groups based on the behavior of this module, they are granted +\fIin addition\fR +to those entries +/etc/group +(or equivalent)\&. +.SH "OPTIONS" +.PP +This module does not recognise any options\&. +.SH "MODULE TYPES PROVIDED" +.PP +Only the +\fBauth\fR +module type is provided\&. +.SH "RETURN VALUES" +.PP +PAM_SUCCESS +.RS 4 +group membership was granted\&. +.RE +.PP +PAM_ABORT +.RS 4 +Not all relevant data could be gotten\&. +.RE +.PP +PAM_BUF_ERR +.RS 4 +Memory buffer error\&. +.RE +.PP +PAM_CRED_ERR +.RS 4 +Group membership was not granted\&. +.RE +.PP +PAM_IGNORE +.RS 4 +\fBpam_sm_authenticate\fR +was called which does nothing\&. +.RE +.PP +PAM_USER_UNKNOWN +.RS 4 +The user is not known to the system\&. +.RE +.SH "FILES" +.PP +/etc/security/group\&.conf +.RS 4 +Default configuration file +.RE +.SH "SEE ALSO" +.PP +\fBgroup.conf\fR(5), +\fBpam.d\fR(5), +\fBpam\fR(8)\&. +.SH "AUTHORS" +.PP +pam_group was written by Andrew G\&. Morgan <morgan@kernel\&.org>\&. diff --git a/modules/pam_group/pam_group.8.xml b/modules/pam_group/pam_group.8.xml new file mode 100644 index 0000000..2c1c905 --- /dev/null +++ b/modules/pam_group/pam_group.8.xml @@ -0,0 +1,162 @@ +<?xml version="1.0" encoding="ISO-8859-1"?> +<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.1.2//EN" + "http://www.oasis-open.org/docbook/xml/4.1.2/docbookx.dtd"> + +<refentry id='pam_group'> + + <refmeta> + <refentrytitle>pam_group</refentrytitle> + <manvolnum>8</manvolnum> + <refmiscinfo class='setdesc'>Linux-PAM Manual</refmiscinfo> + </refmeta> + + <refnamediv id='pam_group-name'> + <refname>pam_group</refname> + <refpurpose> + PAM module for group access + </refpurpose> + </refnamediv> + +<!-- body begins here --> + + <refsynopsisdiv> + <cmdsynopsis id="pam_group-cmdsynopsis"> + <command>pam_group.so</command> + </cmdsynopsis> + </refsynopsisdiv> + + + <refsect1 id="pam_group-description"> + <title>DESCRIPTION</title> + <para> + The pam_group PAM module does not authenticate the user, but instead + it grants group memberships (in the credential setting phase of the + authentication module) to the user. Such memberships are based on the + service they are applying for. + </para> + <para> + By default rules for group memberships are taken from config file + <filename>/etc/security/group.conf</filename>. + </para> + <para> + This module's usefulness relies on the file-systems + accessible to the user. The point being that once granted the + membership of a group, the user may attempt to create a + <function>setgid</function> binary with a restricted group ownership. + Later, when the user is not given membership to this group, they can + recover group membership with the precompiled binary. The reason that + the file-systems that the user has access to are so significant, is the + fact that when a system is mounted <emphasis>nosuid</emphasis> the user + is unable to create or execute such a binary file. For this module to + provide any level of security, all file-systems that the user has write + access to should be mounted <emphasis>nosuid</emphasis>. + </para> + <para> + The pam_group module functions in parallel with the + <filename>/etc/group</filename> file. If the user is granted any groups + based on the behavior of this module, they are granted + <emphasis>in addition</emphasis> to those entries + <filename>/etc/group</filename> (or equivalent). + </para> + </refsect1> + + <refsect1 id="pam_group-options"> + <title>OPTIONS</title> + <para>This module does not recognise any options.</para> + </refsect1> + + <refsect1 id="pam_group-types"> + <title>MODULE TYPES PROVIDED</title> + <para> + Only the <option>auth</option> module type is provided. + </para> + </refsect1> + + <refsect1 id="pam_group-return_values"> + <title>RETURN VALUES</title> + <variablelist> + <varlistentry> + <term>PAM_SUCCESS</term> + <listitem> + <para> + group membership was granted. + </para> + </listitem> + </varlistentry> + <varlistentry> + <term>PAM_ABORT</term> + <listitem> + <para> + Not all relevant data could be gotten. + </para> + </listitem> + </varlistentry> + <varlistentry> + <term>PAM_BUF_ERR</term> + <listitem> + <para> + Memory buffer error. + </para> + </listitem> + </varlistentry> + <varlistentry> + <term>PAM_CRED_ERR</term> + <listitem> + <para> + Group membership was not granted. + </para> + </listitem> + </varlistentry> + <varlistentry> + <term>PAM_IGNORE</term> + <listitem> + <para> + <function>pam_sm_authenticate</function> was called which does nothing. + </para> + </listitem> + </varlistentry> + <varlistentry> + <term>PAM_USER_UNKNOWN</term> + <listitem> + <para> + The user is not known to the system. + </para> + </listitem> + </varlistentry> + </variablelist> + </refsect1> + + <refsect1 id="pam_group-files"> + <title>FILES</title> + <variablelist> + <varlistentry> + <term><filename>/etc/security/group.conf</filename></term> + <listitem> + <para>Default configuration file</para> + </listitem> + </varlistentry> + </variablelist> + </refsect1> + + <refsect1 id="pam_group-see_also"> + <title>SEE ALSO</title> + <para> + <citerefentry> + <refentrytitle>group.conf</refentrytitle><manvolnum>5</manvolnum> + </citerefentry>, + <citerefentry> + <refentrytitle>pam.d</refentrytitle><manvolnum>5</manvolnum> + </citerefentry>, + <citerefentry> + <refentrytitle>pam</refentrytitle><manvolnum>8</manvolnum> + </citerefentry>. + </para> + </refsect1> + + <refsect1 id="pam_group-authors"> + <title>AUTHORS</title> + <para> + pam_group was written by Andrew G. Morgan <morgan@kernel.org>. + </para> + </refsect1> +</refentry> |