diff --git a/general.ent b/general.ent index 0f39b8c1f0..04e63a1095 100644 --- a/general.ent +++ b/general.ent @@ -1,12 +1,12 @@ - + - + diff --git a/introduction/welcome/changelog.xml b/introduction/welcome/changelog.xml index 0d2271ddb3..50c91cbdc5 100644 --- a/introduction/welcome/changelog.xml +++ b/introduction/welcome/changelog.xml @@ -41,6 +41,15 @@ --> + + May 24th, 2019 + + + [dj] - Add Linux-PAM configuration for libcap. + + + + May 21st, 2019 diff --git a/postlfs/security/libcap.xml b/postlfs/security/libcap.xml index e762f2409b..8eb9e3141b 100644 --- a/postlfs/security/libcap.xml +++ b/postlfs/security/libcap.xml @@ -87,6 +87,31 @@ install -v -m644 pam_cap/capability.conf /etc/security + + Configuring Libcap + + In order to allow Linux-PAM to grant + privileges based on POSIX capabilites, you need to add the libcap module + to the begining of the /etc/pam.d/system-auth file. + Make the required edits with the following commands: + +mv -v /etc/pam.d/system-auth{,.bak} && +cat > /etc/pam.d/system-auth << "EOF" && +# Begin /etc/pam.d/system-auth + +auth optional pam_cap.so +EOF +tail -n +3 /etc/pam.d/system-auth.bak << /etc/pam.d/system-auth + + Additonally, you'll need to modify the + /etc/security/capability.conf file to grant necessary + privileges to users, and utilize the setcap + utiltiy to set capabilities on specific utilities as needed. See + man 8 setcap and man 3 cap_from_text + for additional information. + + + Contents