1

I have created omiserver snap which uses inbuilt PAM Authentication mechanism. In Ubuntu desktop, it's working fine but in snappy environment it's failing with entries in syslog:

Feb 20 10:58:01 localhost kernel: [60856.512891] audit: type=1400 audit(1487588281.113:363): apparmor="DENIED" operation="open" profile="snap.omiserver" name="/etc/pam.d/other" pid=6524 comm="omiserver" requested_mask="r" denied_mask="r" fsuid=0 ouid=0

My question is

  1. Is it possible to grant access to my snap for reading and writing to /etc folder in Ubuntu snappy core?

  2. Is it feasible/possible to write our own PAM module for authentication in case of snappy environment?

  3. For OMI server code can we completely remove dependency on PAM module i.e. No authentication required?

Thanks

  • We don't allow this access by default as we don't let snaps modify PAM/etc or perform login operations. The details are pretty thin though-- 'inbuilt uses PAM authentication' doesn't give enough detail to recommend an approach. Can you please share the use case for using PAM specifically? How are you using it specifically? – Manik Taneja Feb 21 '17 at 21:49
  • My snap is running properly in unconfined mode. Is there any interfaces needed for PAM authentication to work in confined mode. My snap is using /etc/Pam.d/other file. Inbuilt I mean to say OMI is open source implementation by Microsoft which uses above file for auth. – SAMIR SHAIKH Feb 23 '17 at 3:55
1

Applications (currently) don't have access to processing logins via libpam. It is possible to add an interface for this, but it would be quite privileged in order to perform the authentication. The interface would also get potentially messy on (at least) classic since any number of pam modules might be installed on the system that might require additional accesses.

I'm unfamiliar with OMI-- why is it using libpam as opposed to something like sudo?

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.