mbox series

[meta-selinux,0/1] openssh: Add pam_env support

Message ID fb045381-3f15-414d-a948-3f606057b085@gmail.com
Headers show
Series openssh: Add pam_env support | expand

Message

Clayton Casciato Jan. 28, 2026, 5:38 p.m. UTC 
core-image-selinux testing with Whinlatter base and master meta-selinux

pam_env-related files exist by default:
```
root@qemuarm64:~# ls /etc/environment /etc/security/pam_env.conf
/etc/environment  /etc/security/pam_env.conf
```

pam_env.so already in use:
```
root@qemuarm64:/etc/pam.d# grep session login
# SELinux needs to be the first session rule. This ensures that any 
session [success=ok ignore=ignore module_unknown=ignore default=bad] pam_selinux.so close
session       required   pam_env.so readenv=1
session    required   pam_limits.so
#session    optional   pam_lastlog.so
session    optional   pam_motd.so
session    optional   pam_mail.so standard
# Standard Un*x account and session
session    include      common-session
# starts in the proper default security context. Only sessions which are
session [success=ok ignore=ignore module_unknown=ignore default=bad] pam_selinux.so open
```

TTY functionality testing:
```
root@qemuarm64:~# tail -n 1 /etc/security/pam_env.conf
TEST    DEFAULT=arst

root@qemuarm64:~# echo $TEST
arst

root@qemuarm64:~# tail -1 /etc/environment
BLAH=arst

root@qemuarm64:~# echo $BLAH
arst
```

Enable root SSH for testing:
```
root@qemuarm64:~# setsebool ssh_sysadm_login 1
```

SSH session test:
```
root@qemuarm64:~# echo $BLAH

root@qemuarm64:~# echo $TEST

```

Add pam_env.so session:
```
root@qemuarm64:~# sed -n -e 18,25p /etc/pam.d/sshd
session    required     pam_env.so

# SELinux needs to intervene at login time to ensure that the process
# starts in the proper default security context. Only sessions which are
# intended to run in the user's context should be run after this.
# When the module is present, "required" would be sufficient (When SELinux
# is disabled, this returns success.)
session [success=ok ignore=ignore module_unknown=ignore default=bad] pam_selinux.so open
```

On pam_env.so order difference from /etc/pam.d/login:
https://man7.org/linux/man-pages/man8/pam_env.8.html
"Since setting of PAM environment variables can have side effects to
other modules, this module should be the last one on the stack."

Post-change SSH session:
```
root@qemuarm64:~# echo $BLAH
arst
root@qemuarm64:~# echo $TEST
arst
```

No new AVC denials observed (ausearch, journalctl).

Change:

Clayton Casciato(1):
  openssh: Add pam_env support

 recipes-connectivity/openssh/files/sshd | 1 +
 1 file changed, 1 insertion(+)