Red Hat ENTERPRISE LINUX 3 Reference Manual page 254

236
15.7.1. Device Ownership
When a user logs into a Red Hat Enterprise Linux system, the
or the graphical login programs, gdm and kdm. If this user is the first user to log in at the
by
login
physical console — called the console user — the module grants the user ownership of a variety of
devices normally owned by root. The console user owns these devices until the last local session for
that user ends. Once the user has logged out, ownership of the devices reverts back to the root user.
The devices affected include, but are not limited to, sound cards, diskette drives, and CD-ROM drives.
This allows a local user to manipulate these devices without attaining root access, thus simplifying
common tasks for the console user.
By modifying the file
vices controlled by
pam_console.so
Warning
If the gdm, kdm, or xdm display manager configuration file has been altered to allow remote users
to log in and the host is configured to run at runlevel 5, it is advisable to change the
directives within the
xconsole
console =tty[0-9][0-9]* vc/[0-9][0-9]* :0\.[0-9] :0
xconsole =:0\.[0-9] :0
Doing this will prevent remote users from gaining access to devices and restricted applications on
the machine.
If the gdm, kdm, or xdm display manager configuration file has been altered to allow remote users
to log in and the host is configured to run at any multiple user runlevel other than 5, it is advisable
to remove the
xconsole
value:
console =tty[0-9][0-9]* vc/[0-9][0-9]*
15.7.2. Application Access
The console user is also allowed access to certain programs with a file bearing the command name in
the
/etc/security/console.apps/
One notable group of applications the console user has access to are three programs which shut off or
reboot the system. These are:
• /sbin/halt
• /sbin/reboot
•
/sbin/poweroff
Because these are PAM-aware applications, they call the
for use.
For more information, refer to the Section 15.8.1 Installed Documentation.
Chapter 15. Pluggable Authentication Modules (PAM)
/etc/security/console.perms
.
/etc/security/console.perms
directive entirely and change the
directory.
pam_console.so
, the administrator can edit the list of de-
to the following values:
console
module as a requirement
pam_console.so
module is called
and
console
directive to the following