Add pam_cap.so "default=<IAB>" module argument support
Add a new optional argument to pam_cap.so. This argument substitutes
for a line like this in the capability.conf file:
<IAB> *
That is, it supplies the default <IAB> 3-tuple of capability vectors.
Any * value in the prevailing capability.conf file overrides this default.
However, the admin can supply arguments like this:
auth pam_cap.so autoauth config=/dev/null default=^cap_wake_alarm
to grant everyone who executes it the ambient capability cap_wake_alarm.
This addresses:
https://bugzilla.kernel.org/show_bug.cgi?id=213611
However, see:
https://bugzilla.kernel.org/show_bug.cgi?id=212945
for issues limiting PAM application support for ambient capabilities in
general at present.
Signed-off-by: Andrew G. Morgan <[email protected]>
4 files changed
