To make other applications accessible to console users, a bit
more work is required.
First of all, console access only works
for applications which reside in /sbin/
or /usr/sbin/, so the application that
you wish to run must be there. After verifying that, do the
following steps:
-
Create a link from the name of your application, such as our
sample foo
program, to the /usr/bin/consolehelper
application:
cd /usr/bin
ln -s consolehelper foo
|
-
Create the file /etc/security/console.apps/foo:
touch /etc/security/console.apps/foo
|
-
Create a PAM configuration file for the foo service in
/etc/pam.d/. An easy way to do this is to
start with a copy of the halt service's PAM configuration file, and
then modify the file if you want to change the behavior:
cp /etc/pam.d/halt /etc/pam.d/foo
|
Now, when /usr/bin/foo is executed, consolehelper is called, which authenticates the
user with the help of /usr/sbin/userhelper. To authenticate the user,
consolehelper asks for the user's password
if /etc/pam.d/foo is a copy of /etc/pam.d/halt (otherwise, it does precisely what
is specified in /etc/pam.d/foo) and then runs /usr/sbin/foo with
root permissions.
In the PAM configuration file, an application can be configured
to use the pam_timestamp module to
remember (or cache) a successful authentication attempt. When an
application is started and proper authentication is provided (the
root password), a timestamp file is created. By default, a
successful authentication is cached for five minutes. During this
time, any other application that is configured to use pam_timestamp and run from the same session is
automatically authenticated for the user — the user does not
have to enter the root password again.
This module is included in the pam
package. To enable this feature, the PAM configuration file in
etc/pam.d/ must include the following
lines:
auth sufficient /lib/security/pam_timestamp.so
session optional /lib/security/pam_timestamp.so
|
The first line that begins with auth should be after any other auth sufficient lines, and the line that
begins with session should be
after any other session
optional lines.
If an application configured to use pam_timestamp is successfully authenticated from
the (on the Panel), the
icon is displayed in
the notification area of the panel if you are running the GNOME or
KDE desktop environment. After the authentication expires (the
default is five minutes), the icon disappears.
The user can select to forget the cached authentication by
clicking on the icon and selecting the option to forget
authentication.
