Removing shadow breaks PAM logins

Removing shadow breaks PAM logins

[Matt Madison]

For one of my projects, I have a read-only rootfs, but I do use PAM
plugins for controlling login access to the device, as well as group
controls and non-root users for daemons and such.  After my latest
update to master, I ran into an problem where all logins failed and some
daemons failed to start.  I tracked it down to this recent commit:

http://cgit.openembedded.org/openembedded-core/commit/meta/lib/oe/rootfs.py?id=f4932e2e640764d16f1f6d398390ebfb376f4cf1

The problem is that the shadow package includes not only the utilities
for manipulating the password and groups files, but it also includes the
full-featured /bin/login and the su, sg, groups, and newgrp utilities,
plus the login PAM rules file.

I worked around the issue by repackaging shadow so the programs and
config files that aren't related to changing the passwd and group files
ended up in a separate package that remained in the rootfs.  That seemed
to be the cleanest way to deal with the problem, and it did the trick
for me.  If there's interest, I can submit a patch.

-Matt

Re: Removing shadow breaks PAM logins

[Khem Raj]

On Sat, Apr 4, 2015 at 7:36 AM, Matt Madison <matt@madison.systems> wrote:
> I worked around the issue by repackaging shadow so the programs and
> config files that aren't related to changing the passwd and group files
> ended up in a separate package that remained in the rootfs.  That seemed
> to be the cleanest way to deal with the problem, and it did the trick
> for me.  If there's interest, I can submit a patch.

yes please