Pam And Device Ownership; Device Ownership - Red Hat ENTERPRISE LINUX 4.5.0 Reference Manual

The
pam_timestamp.so
used options:
•
timestamp_timeout
is valid (in seconds). The default value is 300 seconds (five minutes).
• — Specifies the directory in which the timestamp file is stored. The default
timestampdir
value is
/var/run/sudo/
For more information about controlling the
"Installed Documentation".

7. PAM and Device Ownership

Red Hat Enterprise Linux allows the first user to log in on the physical console of the machine
the ability to manipulate some devices and perform some tasks normally reserved for the root
user. This is controlled by a PAM module called

7.1. Device Ownership

When a user logs into a Red Hat Enterprise Linux system, the
called by or the graphical login programs, gdm and kdm. If this user is the first user to
login
log in at the physical console — called the console user — the module grants the user
ownership of a variety of devices normally owned by root. The console user owns these devices
until the last local session for that user ends. Once the user has logged out, ownership of the
devices reverts back to the root user.
The devices affected include, but are not limited to, sound cards, diskette drives, and CD-ROM
drives.
This allows a local user to manipulate these devices without attaining root access, thus
simplifying common tasks for the console user.
By modifying the file
/etc/security/console.perms
devices controlled by
pam_console.so
Warning
If the gdm, kdm, or xdm display manager configuration file has been altered to
allow remote users to log in and the host is configured to run at runlevel 5, it is
advisable to change the
/etc/security/console.perms
<console>=tty[0-9][0-9]* vc/[0-9][0-9]* :0\.[0-9] :0 <xconsole>=:0\.[0-9]
:0
module accepts several directives. Below are the two most commonly
— Specifies the number of seconds the during which the timestamp file
.
pam_timestamp.so
.
<console>
PAM and Device Ownership
module, refer to
.
pam_console.so
pam_console.so
, the administrator can edit the list of
and directives within the
<xconsole>
to the following values:
Section 8.1,
module is
305