.\"Generated by db2man.xsl. Don't modify this, modify the source. .de Sh \" Subsection .br .if t .Sp .ne 5 .PP \fB\\$1\fR .PP .. .de Sp \" Vertical space (when we can't use .PP) .if t .sp .5v .if n .sp .. .de Ip \" List item .br .ie \\n(.$>=3 .ne \\$3 .el .ne 3 .IP "\\$1" \\$2 .. .TH "PAM_NAMESPACE" 8 "" "" "" .SH NAME pam_namespace \- PAM module for configuring namespace for a session .SH "SYNOPSIS" .ad l .hy 0 .HP 17 \fBpam_namespace\&.so\fR [debug] [unmnt_remnt] [unmnt_only] [require_selinux] [gen_hash] [ignore_config_error] [ignore_instance_parent_mode] .ad .hy .SH "DESCRIPTION" .PP The pam_namespace PAM module sets up a private namespace for a session with polyinstantiated directories\&. A polyinstantiated directory provides a different instance of itself based on user name, or when using SELinux, user name, security context or both\&. If an executable script \fI/etc/security/namespace\&.init\fR exists, it is used to initialize the namespace every time a new instance directory is setup\&. The script receives the polyinstantiated directory path and the instance directory path as its arguments\&. .PP The pam_namespace module disassociates the session namespace from the parent namespace\&. Any mounts/unmounts performed in the parent namespace, such as mounting of devices, are not reflected in the session namespace\&. To propagate selected mount/unmount events from the parent namespace into the disassociated session namespace, an administrator may use the special shared\-subtree feature\&. For additional information on shared\-subtree feature, please refer to the mount(8) man page and the shared\-subtree description at http://lwn\&.net/Articles/159077 and http://lwn\&.net/Articles/159092\&. .SH "OPTIONS" .TP \fBdebug\fR A lot of debug information is logged using syslog .TP \fBunmnt_remnt\fR For programs such as su and newrole, the login session has already setup a polyinstantiated namespace\&. For these programs, polyinstantiation is performed based on new user id or security context, however the command first needs to undo the polyinstantiation performed by login\&. This argument instructs the command to first undo previous polyinstantiation before proceeding with new polyinstantiation based on new id/context .TP \fBunmnt_only\fR For trusted programs that want to undo any existing bind mounts and process instance directories on their own, this argument allows them to unmount currently mounted instance directories .TP \fBrequire_selinux\fR If selinux is not enabled, return failure .TP \fBgen_hash\fR Instead of using the security context string for the instance name, generate and use its md5 hash\&. .TP \fBignore_config_error\fR If a line in the configuration file corresponding to a polyinstantiated directory contains format error, skip that line process the next line\&. Without this option, pam will return an error to the calling program resulting in termination of the session\&. .TP \fBignore_instance_parent_mode\fR Instance parent directories by default are expected to have the restrictive mode of 000\&. Using this option, an administrator can choose to ignore the mode of the instance parent\&. This option should be used with caution as it will reduce security and isolation goals of the polyinstantiation mechanism\&. .SH "MODULE SERVICES PROVIDED" .PP The \fBsession\fR service is supported\&. .SH "RETURN VALUES" .TP PAM_SUCCESS Namespace setup was successful\&. .TP PAM_SERVICE_ERR Unexpected system error occurred while setting up namespace\&. .TP PAM_SESSION_ERR Unexpected namespace configuration error occurred\&. .SH "FILES" .TP \fI/etc/security/namespace\&.conf\fR Configuration file .SH "EXAMPLES" .PP For the s you need polyinstantiation (login for example) put the following line in /etc/pam\&.d/ as the last line for session group: .PP session required pam_namespace\&.so [arguments] .PP To use polyinstantiation with graphical display manager gdm, insert the following line, before exit 0, in /etc/gdm/PostSession/Default: .PP /usr/sbin/gdm\-safe\-restart .PP This allows gdm to restart after each session and appropriately adjust namespaces of display manager and the X server\&. If polyinstantiation of /tmp is desired along with the graphical environment, then additional configuration changes are needed to address the interaction of X server and font server namespaces with their use of /tmp to create communication sockets\&. Please use the initialization script \fI/etc/security/namespace\&.init\fR to ensure that the X server and its clients can appropriately access the communication socket X0\&. Please refer to the sample instructions provided in the comment section of the instance initialization script \fI/etc/security/namespace\&.init\fR\&. In addition, perform the following changes to use graphical environment with polyinstantiation of /tmp: .PP .nf 1\&. Disable the use of font server by commenting out "FontPath" line in /etc/X11/xorg\&.conf\&. If you do want to use the font server then you will have to augment the instance initialization script to appropriately provide /tmp/\&.font\-unix from the polyinstantiated /tmp\&. 2\&. Ensure that the gdm service is setup to use pam_namespace, as described above, by modifying /etc/pam\&.d/gdm\&. 3\&. Ensure that the display manager is configured to restart X server with each new session\&. This default setup can be verified by making sure that /usr/share/gdm/defaults\&.conf contains "AlwaysRestartServer=true", and it is not overridden by /etc/gdm/custom\&.conf\&. .fi .SH "SEE ALSO" .PP \fBnamespace\&.conf\fR(5), \fBpam\&.d\fR(8), \fBmount\fR(8), \fBpam\fR(8)\&. .SH "AUTHORS" .PP The namespace setup scheme was designed by Stephen Smalley, Janak Desai and Chad Sellers\&. The pam_namespace PAM module was developed by Janak Desai , Chad Sellers and Steve Grubb \&.