Adding upstream version 1.5.2.upstream/1.5.2upstream

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

1 files changed, 276 insertions, 0 deletions

diff --git a/modules/pam_selinux/pam_selinux.8.xml b/modules/pam_selinux/pam_selinux.8.xml
new file mode 100644
index 0000000..28d465f
--- /dev/null
+++ b/modules/pam_selinux/pam_selinux.8.xml
@@ -0,0 +1,276 @@
+<?xml version="1.0" encoding='UTF-8'?>
+<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.3//EN"
+	"http://www.oasis-open.org/docbook/xml/4.3/docbookx.dtd">
+
+<refentry id="pam_selinux">
+
+  <refmeta>
+    <refentrytitle>pam_selinux</refentrytitle>
+    <manvolnum>8</manvolnum>
+    <refmiscinfo class="sectdesc">Linux-PAM Manual</refmiscinfo>
+  </refmeta>
+
+  <refnamediv id="pam_selinux-name">
+    <refname>pam_selinux</refname>
+    <refpurpose>PAM module to set the default security context</refpurpose>
+  </refnamediv>
+
+  <refsynopsisdiv>
+    <cmdsynopsis id="pam_selinux-cmdsynopsis">
+      <command>pam_selinux.so</command>
+      <arg choice="opt">
+	open
+      </arg>
+      <arg choice="opt">
+	close
+      </arg>
+      <arg choice="opt">
+	restore
+      </arg>
+      <arg choice="opt">
+	nottys
+      </arg>
+      <arg choice="opt">
+	debug
+      </arg>
+      <arg choice="opt">
+	verbose
+      </arg>
+      <arg choice="opt">
+	select_context
+      </arg>
+      <arg choice="opt">
+	env_params
+      </arg>
+      <arg choice="opt">
+	use_current_range
+      </arg>
+    </cmdsynopsis>
+  </refsynopsisdiv>
+
+  <refsect1 id="pam_selinux-description">
+    <title>DESCRIPTION</title>
+    <para>
+      pam_selinux is a PAM module that sets up the default SELinux security
+      context for the next executed process.
+    </para>
+    <para>
+      When a new session is started, the open_session part of the module
+      computes and sets up the execution security context used for the next
+      <citerefentry>
+        <refentrytitle>execve</refentrytitle><manvolnum>2</manvolnum>
+      </citerefentry>
+      call, the file security context for the controlling terminal, and
+      the security context used for creating a new kernel keyring.
+    </para>
+    <para>
+      When the session is ended, the close_session part of the module restores
+      old security contexts that were in effect before the change made
+      by the open_session part of the module.
+    </para>
+    <para>
+      Adding pam_selinux into the PAM stack might disrupt behavior of other
+      PAM modules which execute applications.  To avoid that,
+      <emphasis>pam_selinux.so open</emphasis> should be placed after such
+      modules in the PAM stack, and <emphasis>pam_selinux.so close</emphasis>
+      should be placed before them.  When such a placement is not feasible,
+      <emphasis>pam_selinux.so restore</emphasis> could be used to temporary
+      restore original security contexts.
+    </para>
+  </refsect1>
+
+  <refsect1 id="pam_selinux-options">
+    <title>OPTIONS</title>
+    <variablelist>
+      <varlistentry>
+        <term>
+          <option>open</option>
+        </term>
+        <listitem>
+          <para>
+            Only execute the open_session part of the module.
+          </para>
+        </listitem>
+      </varlistentry>
+      <varlistentry>
+        <term>
+          <option>close</option>
+        </term>
+        <listitem>
+          <para>
+            Only execute the close_session part of the module.
+          </para>
+        </listitem>
+      </varlistentry>
+      <varlistentry>
+        <term>
+          <option>restore</option>
+        </term>
+        <listitem>
+          <para>
+            In open_session part of the module, temporarily restore the
+            security contexts as they were before the previous call of
+            the module.  Another call of this module without the restore
+            option will set up the new security contexts again.
+          </para>
+        </listitem>
+      </varlistentry>
+      <varlistentry>
+        <term>
+          <option>nottys</option>
+        </term>
+        <listitem>
+          <para>
+            Do not setup security context of the controlling terminal.
+          </para>
+        </listitem>
+      </varlistentry>
+      <varlistentry>
+        <term>
+          <option>debug</option>
+        </term>
+        <listitem>
+          <para>
+            Turn on debug messages via
+            <citerefentry>
+              <refentrytitle>syslog</refentrytitle><manvolnum>3</manvolnum>
+            </citerefentry>.
+          </para>
+        </listitem>
+      </varlistentry>
+      <varlistentry>
+        <term>
+          <option>verbose</option>
+        </term>
+        <listitem>
+          <para>
+            Attempt to inform the user when security context is set.
+          </para>
+        </listitem>
+      </varlistentry>
+      <varlistentry>
+        <term>
+          <option>select_context</option>
+        </term>
+        <listitem>
+          <para>
+            Attempt to ask the user for a custom security context role.
+            If MLS is on, ask also for sensitivity level.
+          </para>
+        </listitem>
+      </varlistentry>
+      <varlistentry>
+        <term>
+          <option>env_params</option>
+        </term>
+        <listitem>
+          <para>
+            Attempt to obtain a custom security context role from PAM environment.
+            If MLS is on, obtain also sensitivity level.  This option and the
+            select_context option are mutually exclusive.  The respective PAM
+            environment variables are <emphasis>SELINUX_ROLE_REQUESTED</emphasis>,
+            <emphasis>SELINUX_LEVEL_REQUESTED</emphasis>, and
+            <emphasis>SELINUX_USE_CURRENT_RANGE</emphasis>.  The first two variables
+            are self describing and the last one if set to 1 makes the PAM module behave as
+            if the use_current_range was specified on the command line of the module.
+          </para>
+        </listitem>
+      </varlistentry>
+      <varlistentry>
+        <term>
+          <option>use_current_range</option>
+        </term>
+        <listitem>
+          <para>
+            Use the sensitivity level of the current process for the user context
+            instead of the default level. Also suppresses asking of the
+            sensitivity level from the user or obtaining it from PAM environment.
+          </para>
+        </listitem>
+      </varlistentry>
+    </variablelist>
+  </refsect1>
+
+  <refsect1 id="pam_selinux-types">
+    <title>MODULE TYPES PROVIDED</title>
+    <para>
+      Only the <option>session</option> module type is provided.
+    </para>
+  </refsect1>
+
+  <refsect1 id='pam_selinux-return_values'>
+    <title>RETURN VALUES</title>
+    <variablelist>
+      <varlistentry>
+        <term>PAM_SUCCESS</term>
+        <listitem>
+          <para>
+            The security context was set successfully.
+          </para>
+        </listitem>
+      </varlistentry>
+      <varlistentry>
+        <term>PAM_SESSION_ERR</term>
+        <listitem>
+          <para>
+            Unable to get or set a valid context.
+          </para>
+        </listitem>
+      </varlistentry>
+      <varlistentry>
+        <term>PAM_USER_UNKNOWN</term>
+        <listitem>
+          <para>
+            The user is not known to the system.
+          </para>
+        </listitem>
+      </varlistentry>
+      <varlistentry>
+        <term>PAM_BUF_ERR</term>
+        <listitem>
+          <para>
+            Memory allocation error.
+          </para>
+        </listitem>
+      </varlistentry>
+    </variablelist>
+  </refsect1>
+
+  <refsect1 id='pam_selinux-examples'>
+    <title>EXAMPLES</title>
+    <programlisting>
+auth     required  pam_unix.so
+session  required  pam_permit.so
+session  optional  pam_selinux.so
+    </programlisting>
+  </refsect1>
+
+  <refsect1 id='pam_selinux-see_also'>
+    <title>SEE ALSO</title>
+    <para>
+      <citerefentry>
+	<refentrytitle>execve</refentrytitle><manvolnum>2</manvolnum>
+      </citerefentry>,
+      <citerefentry>
+	<refentrytitle>tty</refentrytitle><manvolnum>4</manvolnum>
+      </citerefentry>,
+      <citerefentry>
+	<refentrytitle>pam.d</refentrytitle><manvolnum>5</manvolnum>
+      </citerefentry>,
+      <citerefentry>
+	<refentrytitle>pam</refentrytitle><manvolnum>8</manvolnum>
+      </citerefentry>,
+      <citerefentry>
+	<refentrytitle>selinux</refentrytitle><manvolnum>8</manvolnum>
+      </citerefentry>
+    </para>
+  </refsect1>
+
+  <refsect1 id='pam_selinux-author'>
+    <title>AUTHOR</title>
+      <para>
+        pam_selinux was written by Dan Walsh &lt;dwalsh@redhat.com&gt;.
+      </para>
+  </refsect1>
+
+</refentry>