用法概要

The Solaris Trusted Extensions service module for PAM, /usr/lib/security/pam_tsol_account.so.1, checks account limitations that are related to labels. The pam_tsol_account.so.1 module is a shared object that can be dynamically loaded to provide the necessary functionality upon demand. Its path is specified in the PAM configuration file.

pam_tsol_account.so.1 contains a function to perform account management, pam_sm_acct_mgmt(). The function checks for the allowed label range for the user. The allowable label range is set by the defaults in the label_encodings(4) file. These defaults can be overridden by entries in the user_attr(4) database.

By default, this module requires that remote hosts connecting to the global zone must have a CIPSO host type. To disable this policy, add the allow_unlabeled keyword as an option to the entry in pam.conf(4), as in:

other  account required    pam_tsol_account allow_unlabeled

The equivalent PAM configuration in /etc/pam.d/ would be the following entry in /etc/pam.d/other:

account required           pam_tsol_account allow_unlabeled

选项

The following options can be passed to the module:

allow_unlabeled: Allows remote connections from hosts with unlabeled template types.
debug: Provides debugging information at the LOG_DEBUG level. See syslog(3C).

返回值

The following values are returned:

PAM_SUCCESS: The account is valid for use at this time and label.
PAM_PERM_DENIED: The current process label is outside the user's label range, or the label information for the process is unavailable, or the remote host type is not valid.
Other values: Returns an error code that is consistent with typical PAM operations. For information on error-related return values, see the pam(3PAM) man page.

属性

See attributes(5) for description of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Interface Stability	Committed
MT Level	MT-Safe with exceptions

The interfaces in libpam(3LIB) are MT-Safe only if each thread within the multi-threaded application uses its own PAM handle.

另请参见

keylogin(1), libpam(3LIB), pam(3PAM), pam_sm_acct_mgmt(3PAM), pam_start(3PAM), syslog(3C), label_encodings(4), pam.conf(4), user_attr(4), attributes(5)

《Oracle Solaris 11.1 管理：安全服务》中的第 14 章 "使用可插拔验证模块"

附注

The functionality described on this manual page is available only if the system is configured with Trusted Extensions.

跳过导航链接
退出打印视图
	手册页第 5 部分：标准、环境和宏 Oracle Solaris 11.1 Information Library (简体中文)