Difference between revisions of "Resmgr"
(→Bootscript) |
(→Multilib) |
||
Line 31: | Line 31: | ||
=== 32Bit === | === 32Bit === | ||
− | + | Compile the package: | |
+ | |||
+ | sed -i "1i\#include <sys/syslog.h>" pam_resmgr.c && | ||
+ | make CC="gcc ${BUILD32}" | ||
+ | |||
+ | Install the package | ||
+ | |||
+ | make install | ||
=== N32 === | === N32 === | ||
− | + | Compile the package: | |
+ | |||
+ | sed -i "1i\#include <sys/syslog.h>" pam_resmgr.c && | ||
+ | make CC="gcc ${BUILDN32}" | ||
+ | |||
+ | Install the package | ||
+ | |||
+ | make LIBDIR=/usr/lib32 PAMDIR=/lib32/security install | ||
=== 64Bit === | === 64Bit === | ||
− | + | ||
+ | Compile the package: | ||
+ | |||
+ | sed -i "1i\#include <sys/syslog.h>" pam_resmgr.c && | ||
+ | make CC="gcc ${BUILD64}" | ||
+ | |||
+ | Install the package | ||
+ | |||
+ | make LIBDIR=/usr/lib64 PAMDIR=/lib64/security install | ||
== Configuring == | == Configuring == |
Revision as of 09:24, 27 January 2007
Download Source: | ftp://ftp.lst.de/pub/people/okir/resmgr/resmgr-1.0.tar.bz2 |
---|
Contents
Introduction to Resmgr
Resmgr will provide unprivileged users access to device files via ACLs.
Dependencies
Required
Non-Multilib
Compile the package:
sed -i "1i\#include <sys/syslog.h>" pam_resmgr.c && make
Install the package
make install
Multilib
32Bit
Compile the package:
sed -i "1i\#include <sys/syslog.h>" pam_resmgr.c && make CC="gcc ${BUILD32}"
Install the package
make install
N32
Compile the package:
sed -i "1i\#include <sys/syslog.h>" pam_resmgr.c && make CC="gcc ${BUILDN32}"
Install the package
make LIBDIR=/usr/lib32 PAMDIR=/lib32/security install
64Bit
Compile the package:
sed -i "1i\#include <sys/syslog.h>" pam_resmgr.c && make CC="gcc ${BUILD64}"
Install the package
make LIBDIR=/usr/lib64 PAMDIR=/lib64/security install
Configuring
A good place to start reading about configuring resmgr would be man resmgr.conf and man pam_resmgr. The resmgr.conf man page has the following in it:
For example, the following statements for the resource class desktop will deny access to users uucp and news, but grant access to everyone in group wheel, and everyone else as long as they're logged in at the console or a local X11 session:
deny desktop user=uucp || user=news allow desktop group=wheel allow desktop tty=/dev/tty[0-9]* || tty=:0
This would be a good time to edit /etc/resmgr.conf and set the rules according to your needs.
PAM Rule
By default most, if not all, of the Linux-PAM rules include system-auth. By adding pam_resmgr.so' to this file we're ensuring it gets loaded regardless of the service. If you do not want this you can add it to the individual service you wish to grant privleges, eg. just the display manager.
echo "session optional pam_resmgr.so" >> /etc/pam.d/system-auth
Bootscript
Create the bootscript:
cat > /etc/rc.d/init.d/resmgrd << "EOF" #!/bin/sh # Begin $rc_base/init.d/resmgrd . /etc/sysconfig/rc . ${rc_functions} case "${1}" in start) boot_mesg "Starting resmgrd..." loadproc /sbin/resmgrd ;; stop) boot_mesg "Stopping resmgrd..." killproc /sbin/resmgrd ;; restart) ${0} stop sleep 1 ${0} start ;; status) statusproc /sbin/resmgrd ;; *) echo "Usage: ${0} {start|stop|restart|status}" exit 1 ;; esac # End $rc_base/init.d/resmgrd EOF chmod -v 754 /etc/rc.d/init.d/resmgrd
Link it into the runlevels:
for link in /etc/rc.d/rc{{0,1,6}.d/K50,{2,3,4,5}.d/S15}resmgrd; do ln -sfv ../init.d/resmgrd $link; done
Contents
- Installed Programs: resmgr resmgrd
- Installed Libraries: libresmgr.so.1.0 pam_resmgr.so
- Installed Directories: