FM / txts

/usr/share/doc/pam/txts

Name	Size	Mode	Actions
README.pam_access	5253	0644	edit dl rm
README.pam_chroot	1510	0644	edit dl rm
README.pam_console	1925	0644	edit dl rm
README.pam_cracklib	9757	0644	edit dl rm
README.pam_debug	1995	0644	edit dl rm
README.pam_deny	1035	0644	edit dl rm
README.pam_echo	1100	0644	edit dl rm
README.pam_env	3627	0644	edit dl rm
README.pam_exec	2230	0644	edit dl rm
README.pam_faildelay	827	0644	edit dl rm
README.pam_faillock	6062	0644	edit dl rm
README.pam_filter	3102	0644	edit dl rm
README.pam_ftp	1699	0644	edit dl rm
README.pam_group	2175	0644	edit dl rm
README.pam_issue	1356	0644	edit dl rm
README.pam_keyinit	2245	0644	edit dl rm
README.pam_lastlog	2597	0644	edit dl rm
README.pam_limits	2421	0644	edit dl rm
README.pam_listfile	3626	0644	edit dl rm
README.pam_localuser	1167	0644	edit dl rm
README.pam_loginuid	1117	0644	edit dl rm
README.pam_mail	2009	0644	edit dl rm
README.pam_mkhomedir	1361	0644	edit dl rm
README.pam_motd	2588	0644	edit dl rm
README.pam_namespace	11543	0644	edit dl rm
README.pam_nologin	1348	0644	edit dl rm
README.pam_permit	907	0644	edit dl rm
README.pam_postgresok	346	0644	edit dl rm
README.pam_pwhistory	2243	0644	edit dl rm
README.pam_rhosts	1882	0644	edit dl rm
README.pam_rootok	1086	0644	edit dl rm
README.pam_securetty	1342	0644	edit dl rm
README.pam_selinux	2909	0644	edit dl rm
README.pam_sepermit	1648	0644	edit dl rm
README.pam_shells	653	0644	edit dl rm
README.pam_stress	2060	0644	edit dl rm
README.pam_succeed_if	2864	0644	edit dl rm
README.pam_time	1301	0644	edit dl rm
README.pam_timestamp	1616	0644	edit dl rm
README.pam_tty_audit	2779	0644	edit dl rm
README.pam_umask	1631	0644	edit dl rm
README.pam_unix	7265	0644	edit dl rm
README.pam_userdb	2973	0644	edit dl rm
README.pam_usertype	1200	0644	edit dl rm
README.pam_warn	1224	0644	edit dl rm
README.pam_wheel	1968	0644	edit dl rm
README.pam_xauth	3695	0644	edit dl rm

Edit: /usr/share/doc/pam/txts/README.pam_selinux (2909B)

pam_selinux — PAM module to set the default security context

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

DESCRIPTION

pam_selinux is a PAM module that sets up the default SELinux security context
for the next executed process.

When a new session is started, the open_session part of the module computes and
sets up the execution security context used for the next execve(2) call, the
file security context for the controlling terminal, and the security context
used for creating a new kernel keyring.

When the session is ended, the close_session part of the module restores old
security contexts that were in effect before the change made by the
open_session part of the module.

Adding pam_selinux into the PAM stack might disrupt behavior of other PAM
modules which execute applications. To avoid that, pam_selinux.so open should
be placed after such modules in the PAM stack, and pam_selinux.so close should
be placed before them. When such a placement is not feasible, pam_selinux.so
restore could be used to temporary restore original security contexts.

OPTIONS

open

Only execute the open_session part of the module.

Only execute the close_session part of the module.

restore

In open_session part of the module, temporarily restore the security
    contexts as they were before the previous call of the module. Another call
    of this module without the restore option will set up the new security
    contexts again.

nottys

Do not setup security context of the controlling terminal.

debug

Turn on debug messages via syslog(3).

verbose

Attempt to inform the user when security context is set.

select_context

Attempt to ask the user for a custom security context role. If MLS is on,
    ask also for sensitivity level.

env_params

Attempt to obtain a custom security context role from PAM environment. If
    MLS is on, obtain also sensitivity level. This option and the
    select_context option are mutually exclusive. The respective PAM
    environment variables are SELINUX_ROLE_REQUESTED, SELINUX_LEVEL_REQUESTED,
    and SELINUX_USE_CURRENT_RANGE. The first two variables are self describing
    and the last one if set to 1 makes the PAM module behave as if the
    use_current_range was specified on the command line of the module.

use_current_range

Use the sensitivity level of the current process for the user context
    instead of the default level. Also suppresses asking of the sensitivity
    level from the user or obtaining it from PAM environment.

EXAMPLES

auth     required  pam_unix.so
session  required  pam_permit.so
session  optional  pam_selinux.so

AUTHOR

pam_selinux was written by Dan Walsh <dwalsh@redhat.com>.

cmd: