1NAMESPACE.CONF(5) Linux-PAM Manual NAMESPACE.CONF(5)
2
6 namespace.conf - the namespace configuration file
7
9 This module allows setup of private namespaces with polyinstantiated
10 directories. Directories can be polyinstantiated based on user name or,
11 in the case of SELinux, user name, sensitivity level or complete
12 security context. If an executable script /etc/security/namespace.init
13 exists, it is used to initialize the namespace every time a new
14 instance directory is setup. The script receives the polyinstantiated
15 directory path and the instance directory path as its arguments.
16 The /etc/security/namespace.conf file specifies which directories are
18 polyinstantiated, how they are polyinstantiated, how instance
19 directories would be named, and any users for whom polyinstantiation
20 would not be performed.
21 When someone logs in, the file namespace.conf is scanned where each non
23 comment line represents one polyinstantiated directory with space
24 separated fields as follows:
25 polydir
27 instance_prefix
28 method
29 list_of_uids
30 The first field, polydir, is the absolute pathname of the directory to
32 polyinstantiate. Special entry $HOME is supported to designate user´s
33 home directory. This field cannot be blank.
34 The second field, instance_prefix is the string prefix used to build
36 the pathname for the instantiation of <polydir>. The directory security
37 context, or optionally its md5sum string (32 hex characters), is
38 appended to the prefix to generate the final instance directory path.
39 This directory is created if it did not exist already, and is then bind
40 mounted on the <polydir> to provide an instance of <polydir> based on
41 the <method> column. The special string $HOME is replaced with the
42 user´s home directory, and $USER with the username. This field cannot
43 be blank. The directory where polyinstantiated instances are to be
44 created, must exist and must have, by default, the mode of 000. The
45 requirement that the instance parent be of mode 000 can be overridden
46 with the command line option <ignore_instance_parent_mode>
47 The third field, method, is the method used for polyinstantiation. It
49 can take 3 different values; "user" for polyinstantiation based on user
50 name, "level" for polyinstantiation based on process MLS level and user
51 name, and "context" for polyinstantiation based on process security
52 context and user name Methods "context" and "level" are only available
53 with SELinux. This field cannot be blank.
54 The fourth field, list_of_uids, is a comma separated list of user names
56 for whom the polyinstantiation is not performed. If left blank,
57 polyinstantiation will be performed for all users.
58 In case of context or level polyinstantiation the SELinux context which
60 is used for polyinstantiation is the context used for executing a new
61 process as obtained by getexeccon. This context must be set by the
62 calling application or pam_selinux.so module. If this context is not
63 set the polyinstatiation will be based just on user name.
64
66 These are some example lines which might be specified in
67 /etc/security/namespace.conf.
68 # The following three lines will polyinstantiate /tmp,
70 # /var/tmp and user´s home directories. /tmp and /var/tmp
71 # will be polyinstantiated based on the security level
72 # as well as user name, whereas home directory will be
73 # polyinstantiated based on the full security context and user name.
74 # Polyinstantiation will not be performed for user root
75 # and adm for directories /tmp and /var/tmp, whereas home
76 # directories will be polyinstantiated for all users.
77 #
78 # Note that instance directories do not have to reside inside
79 # the polyinstantiated directory. In the examples below,
80 # instances of /tmp will be created in /tmp-inst directory,
81 # where as instances of /var/tmp and users home directories
82 # will reside within the directories that are being
83 # polyinstantiated.
84 #
85 /tmp /tmp-inst/ level root,adm
86 /var/tmp /var/tmp/tmp-inst/ level root,adm
87 $HOME $HOME/$USER.inst/inst- context
88 For the <service>s you need polyinstantiation (login for example) put
91 the following line in /etc/pam.d/<service> as the last line for session
92 group:
93 session required pam_namespace.so [arguments]
95 This module also depends on pam_selinux.so setting the context.
97
99 pam_namespace(8), pam.d(5), pam(8)
100
102 The namespace.conf manual page was written by Janak Desai
103 <janak@us.ibm.com>.
104Linux-PAM Manual 11/28/2007 NAMESPACE.CONF(5)