Linux command
pam_selinux 命令
文本
复制后可按需替换文件名、目录或参数。
常用示例
Set SELinux context
session required pam_selinux.so
Close session
session required pam_selinux.so close
Open session
session required pam_selinux.so open
Prompt user to select
session required pam_selinux.so select_context
Obtain context from PAM environment
session required pam_selinux.so env_params
Enable verbose output
session required pam_selinux.so open verbose
说明
pam_selinux is a PAM module that sets the default SELinux security context for authenticated user sessions. It operates in two phases: open_session sets up the execution and controlling terminal security contexts, and close_session restores the previously saved contexts when the session ends. In a typical PAM configuration, this module is called twice -- once with close before other session modules, and once with open after them. This ensures that other modules run with the caller's context, while the user session receives the appropriate SELinux context.
参数
- open
- Execute only the open_session portion of the module, which sets the execution and terminal security contexts.
- close
- Execute only the close_session portion of the module, which restores previous security contexts.
- restore
- In open_session, temporarily restore security contexts as they were before the previous call of the module. Useful when open and close cannot be placed around other session modules.
- nottys
- Do not set the security context of the controlling terminal.
- debug
- Turn on debug messages via syslog(3).
- verbose
- Attempt to inform the user when the security context is set.
- select_context
- Prompt the user to select a custom role for the security context. Mutually exclusive with env_params.
- env_params
- Obtain a custom security context role from PAM environment variables (SELINUX_ROLE_REQUESTED, SELINUX_LEVEL_REQUESTED, SELINUX_USE_CURRENT_RANGE). Mutually exclusive with select_context.
- use_current_range
- Use the current process MLS sensitivity level rather than the default.
FAQ
What is the pam_selinux command used for?
pam_selinux is a PAM module that sets the default SELinux security context for authenticated user sessions. It operates in two phases: open_session sets up the execution and controlling terminal security contexts, and close_session restores the previously saved contexts when the session ends. In a typical PAM configuration, this module is called twice -- once with close before other session modules, and once with open after them. This ensures that other modules run with the caller's context, while the user session receives the appropriate SELinux context.
How do I run a basic pam_selinux example?
Run `session required pam_selinux.so` in a terminal, then adjust file names, paths, flags, or remote targets for your system.
What does open do in pam_selinux?
Execute only the open_session portion of the module, which sets the execution and terminal security contexts.