From f29d3519ce073ec30f99754d93304324f7f26d65 Mon Sep 17 00:00:00 2001
From: Deposite Pirate
Date: Sun, 16 Sep 2018 18:47:05 +0200
Subject: Initial commit.

---
 base/pam/pam-policy/90-nproc.conf       |  6 ++++++
 base/pam/pam-policy/Makefile            | 18 ++++++++++++++++++
 base/pam/pam-policy/other               |  5 +++++
 base/pam/pam-policy/system-auth         | 17 +++++++++++++++++
 base/pam/pam-policy/system-local-login  |  6 ++++++
 base/pam/pam-policy/system-login        | 19 +++++++++++++++++++
 base/pam/pam-policy/system-remote-login |  6 ++++++
 base/pam/pam-policy/system-services     | 11 +++++++++++
 8 files changed, 88 insertions(+)
 create mode 100644 base/pam/pam-policy/90-nproc.conf
 create mode 100644 base/pam/pam-policy/Makefile
 create mode 100644 base/pam/pam-policy/other
 create mode 100644 base/pam/pam-policy/system-auth
 create mode 100644 base/pam/pam-policy/system-local-login
 create mode 100644 base/pam/pam-policy/system-login
 create mode 100644 base/pam/pam-policy/system-remote-login
 create mode 100644 base/pam/pam-policy/system-services

(limited to 'base/pam/pam-policy')

diff --git a/base/pam/pam-policy/90-nproc.conf b/base/pam/pam-policy/90-nproc.conf
new file mode 100644
index 0000000..104dffd
--- /dev/null
+++ b/base/pam/pam-policy/90-nproc.conf
@@ -0,0 +1,6 @@
+# Default limit for number of user's processes to prevent
+# accidental fork bombs.
+# See rhbz #432903 for reasoning.
+
+*          soft    nproc     1024
+root       soft    nproc     unlimited
diff --git a/base/pam/pam-policy/Makefile b/base/pam/pam-policy/Makefile
new file mode 100644
index 0000000..860ae17
--- /dev/null
+++ b/base/pam/pam-policy/Makefile
@@ -0,0 +1,18 @@
+PAMCFG=other system-auth system-local-login system-login system-remote-login system-services
+LIMITSCFG=90-nproc.conf
+
+INSTALL=/usr/bin/install
+INSTALLDIR=$(INSTALL) -m 0755 -d
+INSTALLCFG=$(INSTALL) -m 0644
+
+SYSCONFDIR=/etc
+ETCPAMDDIR=$(SYSCONFDIR)/pam.d
+LIMITSDDIR=$(SYSCONFDIR)/security/limits.d
+
+install:
+	$(INSTALLDIR) $(DESTDIR)$(ETCPAMDDIR)
+	$(INSTALLCFG) $(PAMCFG) $(DESTDIR)$(ETCPAMDDIR)
+	$(INSTALLDIR) $(DESTDIR)$(LIMITSDDIR)
+	$(INSTALLCFG) $(LIMITSCFG) $(DESTDIR)$(LIMITSDDIR)
+
+.PHONY: install
diff --git a/base/pam/pam-policy/other b/base/pam/pam-policy/other
new file mode 100644
index 0000000..08498b4
--- /dev/null
+++ b/base/pam/pam-policy/other
@@ -0,0 +1,5 @@
+#%PAM-1.0
+auth		required	pam_unix.so
+account		required	pam_unix.so
+password	required	pam_unix.so
+session		required	pam_unix.so
diff --git a/base/pam/pam-policy/system-auth b/base/pam/pam-policy/system-auth
new file mode 100644
index 0000000..b28a7e9
--- /dev/null
+++ b/base/pam/pam-policy/system-auth
@@ -0,0 +1,17 @@
+#%PAM-1.0
+
+auth      required  pam_env.so
+auth      required  pam_unix.so     try_first_pass nullok
+auth      optional  pam_permit.so
+
+account   required  pam_unix.so
+account   optional  pam_permit.so
+account   required  pam_time.so
+
+password  required  pam_unix.so     try_first_pass nullok sha512 shadow
+password  optional  pam_permit.so
+
+session   required  pam_limits.so
+session   required  pam_env.so
+session   required  pam_unix.so
+session   optional  pam_permit.so
diff --git a/base/pam/pam-policy/system-local-login b/base/pam/pam-policy/system-local-login
new file mode 100644
index 0000000..347b815
--- /dev/null
+++ b/base/pam/pam-policy/system-local-login
@@ -0,0 +1,6 @@
+#%PAM-1.0
+
+auth      include   system-login
+account   include   system-login
+password  include   system-login
+session   include   system-login
diff --git a/base/pam/pam-policy/system-login b/base/pam/pam-policy/system-login
new file mode 100644
index 0000000..acb4e96
--- /dev/null
+++ b/base/pam/pam-policy/system-login
@@ -0,0 +1,19 @@
+#%PAM-1.0
+
+auth       required   pam_tally.so         onerr=succeed file=/var/log/faillog
+auth       required   pam_shells.so
+auth       requisite  pam_nologin.so
+auth       include    system-auth
+
+account    required   pam_access.so
+account    required   pam_nologin.so
+account    include    system-auth
+
+password   include    system-auth
+
+session    optional   pam_loginuid.so
+session    required   pam_env.so
+session    include    system-auth
+session    optional   pam_motd.so          motd=/etc/motd
+session    optional   pam_mail.so          dir=/var/spool/mail standard quiet
+-session   optional   pam_systemd.so
diff --git a/base/pam/pam-policy/system-remote-login b/base/pam/pam-policy/system-remote-login
new file mode 100644
index 0000000..347b815
--- /dev/null
+++ b/base/pam/pam-policy/system-remote-login
@@ -0,0 +1,6 @@
+#%PAM-1.0
+
+auth      include   system-login
+account   include   system-login
+password  include   system-login
+session   include   system-login
diff --git a/base/pam/pam-policy/system-services b/base/pam/pam-policy/system-services
new file mode 100644
index 0000000..311c0d6
--- /dev/null
+++ b/base/pam/pam-policy/system-services
@@ -0,0 +1,11 @@
+#%PAM-1.0
+
+auth      sufficient  pam_permit.so
+
+account   include     system-auth
+
+session   optional    pam_loginuid.so
+session   required    pam_limits.so
+session   required    pam_env.so
+session   required    pam_unix.so
+session   optional    pam_permit.so
-- 
cgit v1.2.3-70-g09d2