The libcap package was installed in LFS, but if Linux-PAM support is desired, the PAM module must be built (after installation of Linux-PAM).
This package is known to build and work properly using an LFS 12.2 platform.
Download (HTTP): https://www.kernel.org/pub/linux/libs/security/linux-privs/libcap2/libcap-2.70.tar.xz
Download MD5 sum: df0e20c6eeca849347b87d5d6a8870c0
Download size: 188 KB
Estimated disk space required: 2.2 MB
Estimated build time: less than 0.1 SBU
If you are upgrading libcap from a previous version, use the instructions in LFS libcap page to upgrade libcap. If Linux-PAM-1.6.1 has been built, the PAM module will automatically be built too.
Install libcap by running the following commands:
make -C pam_cap
This package does not come with a test suite.
Now, as the root
user:
install -v -m755 pam_cap/pam_cap.so /usr/lib/security && install -v -m644 pam_cap/capability.conf /etc/security
In order to allow Linux-PAM to
grant privileges based on POSIX capabilities, you need to add the
libcap module to the beginning of the /etc/pam.d/system-auth
file. Make the required
edits with the following commands:
mv -v /etc/pam.d/system-auth{,.bak} &&
cat > /etc/pam.d/system-auth << "EOF" &&
# Begin /etc/pam.d/system-auth
auth optional pam_cap.so
EOF
tail -n +3 /etc/pam.d/system-auth.bak >> /etc/pam.d/system-auth
Additionally, you'll need to modify the /etc/security/capability.conf
file to grant
necessary privileges to users, and utilize the setcap utility to set
capabilities on specific utilities as needed. See man 8 setcap and man 3 cap_from_text for
additional information.