{{tag>Brouillon PAM CA}} # Notes userhelper - usermode # userhelper - usermode Voir : * https://pagure.io/usermode/ * https://www.linux-magazine.com/content/download/63014/486800/version/1/file/Customizing_the_Root_Password_Window.pdf * consolehelper * [[Notes sécurité PAM]] * https://www.stigviewer.com/stig/red_hat_enterprise_linux_8/2021-12-03/finding/V-230431 * https://www.cyberciti.biz/faq/restrict-execution-of-userhelper-to-console-users/ * https://access.redhat.com/articles/1537873 Voir aussi : * [[notes_sudo_et_sudoers]] * [[Rootkit pwnkit - local privilege escalation vulnerability pkexec cve-2021-4034]] usermode contains the userhelper program, which can be used to allow configured programs to be run with superuser privileges by ordinary users, and several graphical tools for users: * userinfo allows users to change their finger information. * usermount lets users mount, unmount, and format filesystems. * userpasswd allows users to change their passwords. ~~~bash sudo /usr/sbin/userhelper -t -w subscription-manager identity ~~~ `/etc/security/console.apps/config-util` ~~~ini USER=root UGROUPS=wheel ~~~ `/etc/security/console.apps/subscription-manager` ~~~ini USER=root PROGRAM=/usr/sbin/subscription-manager SESSION=true ~~~ ~~~ # ls -l /usr/bin/subscription-manager lrwxrwxrwx. 1 root root 22 Feb 23 07:16 /usr/bin/subscription-manager -> /usr/bin/consolehelper # grep '^PROGRAM=' /etc/security/console.apps/subscription-manager PROGRAM=/usr/sbin/subscription-manager ~~~ ## Test `/etc/pam.d/sleep` ~~~ #%PAM-1.0 auth include config-util account include config-util session include config-util ~~~ ou `/etc/pam.d/sleep` ~~~ #%PAM-1.0 auth sufficient pam_rootok.so auth required pam_warn.so auth required pam_deny.so auth include system-auth account include system-auth password include system-auth session include system-auth ~~~ `/etc/security/console.apps/sleep` ~~~ini USER=root #UGROUPS=wheel PROGRAM=/usr/bin/sleep SESSION=true #KEEP_ENV_VARS=http_proxy,ftp_proxy #FALLBACK=yes ~~~ ~~~bash /usr/sbin/userhelper -t -w sleep 1 ~~~