[Pkg-shadow-devel] [shadow] 03/20: Move pam_selinux open call higher in the session stack

[Balint Reczey]

This is an automated email from the git hooks/post-receive script.

rbalint pushed a commit to annotated tag debian/1%4.4-2
in repository shadow.

commit 60d4dc5ae0b727cb0503a50fb76dc93c97dfdefe
Author: Laurent Bigonville <bigon at bigon.be>
Date:   Thu May 8 08:46:37 2014 +0200

    Move pam_selinux open call higher in the session stack
    
    Closes: #747313
---
 debian/login.pam | 24 ++++++++++++------------
 1 file changed, 12 insertions(+), 12 deletions(-)

diff --git a/debian/login.pam b/debian/login.pam
index b165d02..7825a0a 100644
--- a/debian/login.pam
+++ b/debian/login.pam
@@ -35,13 +35,23 @@ auth [success=ok new_authtok_reqd=ok ignore=ignore user_unknown=bad default=die]
 # (Replaces the `NOLOGINS_FILE' option from login.defs)
 auth       requisite  pam_nologin.so
 
-# SELinux needs to be the first session rule. This ensures that any 
-# lingering context has been cleared. Without out this it is possible 
+# SELinux needs to be the first session rule. This ensures that any
+# lingering context has been cleared. Without this it is possible
 # that a module could execute code in the wrong domain.
 # When the module is present, "required" would be sufficient (When SELinux
 # is disabled, this returns success.)
 session [success=ok ignore=ignore module_unknown=ignore default=bad] pam_selinux.so close
 
+# Sets the loginuid process attribute
+session    required     pam_loginuid.so
+
+# SELinux needs to intervene at login time to ensure that the process
+# starts in the proper default security context. Only sessions which are
+# intended to run in the user's context should be run after this.
+session [success=ok ignore=ignore module_unknown=ignore default=bad] pam_selinux.so open
+# When the module is present, "required" would be sufficient (When SELinux
+# is disabled, this returns success.)
+
 # This module parses environment configuration file(s)
 # and also allows you to use an extended config
 # file /etc/security/pam_env.conf.
@@ -95,17 +105,7 @@ session    optional   pam_motd.so
 # See comments in /etc/login.defs
 session    optional   pam_mail.so standard
 
-# Sets the loginuid process attribute
-session    required     pam_loginuid.so
-
 # Standard Un*x account and session
 @include common-account
 @include common-session
 @include common-password
-
-# SELinux needs to intervene at login time to ensure that the process
-# starts in the proper default security context. Only sessions which are
-# intended to run in the user's context should be run after this.
-session [success=ok ignore=ignore module_unknown=ignore default=bad] pam_selinux.so open
-# When the module is present, "required" would be sufficient (When SELinux
-# is disabled, this returns success.)

-- 
Alioth's /usr/local/bin/git-commit-notice on /srv/git.debian.org/git/pkg-shadow/shadow.git