From: Ludwig Nussel <ludwig.nussel@suse.de>
To: Karel Zak <kzak@redhat.com>
Cc: Thorsten Kukuk <kukuk@suse.de>, util-linux@vger.kernel.org
Subject: Re: login: PAM-only, login.defs, -H
Date: Thu, 24 Nov 2011 10:29:12 +0100 [thread overview]
Message-ID: <4ECE0E68.4000104@suse.de> (raw)
In-Reply-To: <20111118121420.GQ7916@nb.net.home>
Karel Zak wrote:
> On Thu, Nov 17, 2011 at 11:31:47AM +0100, Thorsten Kukuk wrote:
>> On Mon, Oct 17, Karel Zak wrote:
>>
>>> Git tree: https://karelzak@github.com/karelzak/util-linux.git branch 'login'.
>>> URL: https://github.com/karelzak/util-linux/tree/login
>>
>> Ok, I found one bug: pam_setcred() is only called after pam_open_session(),
>> but has to be called before:
>
> Well, this is discussable... login(1) for years called pam_setcred()
> after pam_open_session(), but I agree it's not optional.
>
> After discussion with our PAM maintainer we decided that the best is
> probably to use PAM_ESTABLISH_CRED before and PAM_REINITIALIZE_CRED
> after pam_open_session(). This solution should be probably the most
> robust (it's probably used by openssh).
Modules must work with one call before pam_open_session() as that's the
only documented and correct way. So that's what other applications such
as login managers, su etc do. IOW a module that would break due to login
using pam calls in the correct order is quite unlikely to exist at all.
cu
Ludwig
--
(o_ Ludwig Nussel
//\
V_/_ http://www.suse.de/
SUSE LINUX Products GmbH, GF: Jeff Hawn, Jennifer Guild, Felix Imendörffer, HRB 16746 (AG Nürnberg)
prev parent reply other threads:[~2011-11-24 9:29 UTC|newest]
Thread overview: 54+ messages / expand[flat|nested] mbox.gz Atom feed top
2011-10-17 11:02 login: PAM-only, login.defs, -H Karel Zak
2011-10-17 11:14 ` [PATCH 00/49] login refactoring Karel Zak
2011-10-17 11:14 ` [PATCH 01/49] login: remove kerberos specific code Karel Zak
2011-10-17 11:14 ` [PATCH 02/49] login: remove dead code and comments Karel Zak
2011-10-17 11:14 ` [PATCH 03/49] login: move _PATH_BTMP to pathnames.h Karel Zak
2011-10-17 11:14 ` [PATCH 04/49] login: remove non-PAM code Karel Zak
2011-10-17 11:14 ` [PATCH 05/49] build-sys: require PAM for login-utils Karel Zak
2011-10-17 11:14 ` [PATCH 06/49] login: remove PAM_FAIL_CHECK and PAM_END macros Karel Zak
2011-10-17 11:14 ` [PATCH 07/49] lib: cleanup setproctitle.c Karel Zak
2011-10-17 11:14 ` [PATCH 08/49] login: cleanup begin of the login.c file Karel Zak
2011-10-17 11:14 ` [PATCH 09/49] login: remove obsolete code, clean up macros names Karel Zak
2011-10-17 11:14 ` [PATCH 10/49] login: indent -linux Karel Zak
2011-10-17 11:14 ` [PATCH 11/49] login: add struct login_context, consolidate tty code Karel Zak
2011-10-17 11:14 ` [PATCH 12/49] login: add hostname to login_context struct Karel Zak
2011-10-17 11:14 ` [PATCH 13/49] login: add pid " Karel Zak
2011-10-17 11:14 ` [PATCH 14/49] login: add username " Karel Zak
2011-10-17 11:14 ` [PATCH 15/49] login: use login_context struct in audit stuff Karel Zak
2011-10-17 11:14 ` [PATCH 16/49] login: lastlog code refactoring Karel Zak
2011-10-17 11:14 ` [PATCH 17/49] login: utmp " Karel Zak
2011-10-17 11:14 ` [PATCH 18/49] login: use getpwnam_r() rather than manually copy passwd struct Karel Zak
2011-10-17 11:14 ` [PATCH 19/49] login: tty chown.chmod refactoring Karel Zak
2011-10-17 11:14 ` [PATCH 20/49] login: use setgroups(0, NULL) for root Karel Zak
2011-10-17 11:15 ` [PATCH 21/49] login: improve hushed mode (merge suse changes) Karel Zak
2011-10-17 11:15 ` [PATCH 22/49] login: remove unused code and tests Karel Zak
2011-10-17 11:15 ` [PATCH 23/49] login: PAM initialization refactoring Karel Zak
2011-10-17 11:15 ` [PATCH 24/49] login: PAM auth refactoring Karel Zak
2011-10-17 11:15 ` [PATCH 25/49] login: PAM account checks refactoring Karel Zak
2011-10-17 11:15 ` [PATCH 26/49] login: PAM session initialization refactoring Karel Zak
2011-10-17 11:15 ` [PATCH 27/49] login: remove pam_handle_t from main() Karel Zak
2011-10-17 11:15 ` [PATCH 28/49] login: fork & session initialization refactoring Karel Zak
2011-10-17 11:15 ` [PATCH 29/49] login: env " Karel Zak
2011-10-17 11:15 ` [PATCH 30/49] login: use xalloc.h Karel Zak
2011-10-17 11:15 ` [PATCH 31/49] login: log good logins refactoring Karel Zak
2011-10-17 11:15 ` [PATCH 32/49] login: move signal stuff to the one place Karel Zak
2011-10-17 11:15 ` [PATCH 33/49] login: remove unnecessary variables Karel Zak
2011-10-17 11:15 ` [PATCH 34/49] login: host{name,address} initialization refactoring Karel Zak
2011-10-17 11:15 ` [PATCH 35/49] tests: cleanup islocal test Karel Zak
2011-10-17 11:15 ` [PATCH 36/49] login: add login.defs code and tests Karel Zak
2011-10-17 11:15 ` [PATCH 37/49] tests: remove obsolete checktty test Karel Zak
2011-10-17 11:15 ` [PATCH 38/49] login: remove obsolete info from man page Karel Zak
2011-10-17 11:15 ` [PATCH 39/49] login: rewrite motd(), use MOTD_FILE from login.defs Karel Zak
2011-10-17 11:15 ` [PATCH 40/49] login: use LOGIN_TIMEOUT " Karel Zak
2011-10-17 11:15 ` [PATCH 41/49] login: use FAIL_DELAY " Karel Zak
2011-10-17 11:15 ` [PATCH 42/49] login: use TTYPERM " Karel Zak
2011-10-17 11:15 ` [PATCH 43/49] login: use TTYGROUP " Karel Zak
2011-10-17 11:15 ` [PATCH 44/49] login: use HUSHLOGIN_FILE " Karel Zak
2011-10-17 11:15 ` [PATCH 45/49] login: use DEFAULT_HOME " Karel Zak
2011-10-17 11:15 ` [PATCH 46/49] login: use LOG_UNKFAIL_ENAB from login.defs, improve logging Karel Zak
2011-10-17 11:15 ` [PATCH 47/49] login: add -H option for compatibility with Suse Karel Zak
2011-10-17 11:15 ` [PATCH 48/49] login: use ENV_PATH and ENV_{ROOT,SU}PATH from login.defs Karel Zak
2011-10-17 11:15 ` [PATCH 49/49] login: cosmetic changes in docs Karel Zak
2011-11-17 10:31 ` login: PAM-only, login.defs, -H Thorsten Kukuk
2011-11-18 12:14 ` Karel Zak
2011-11-24 9:29 ` Ludwig Nussel [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=4ECE0E68.4000104@suse.de \
--to=ludwig.nussel@suse.de \
--cc=kukuk@suse.de \
--cc=kzak@redhat.com \
--cc=util-linux@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).