Re: [mituc@xxxxxxxxxxxxxx: pam limits drops privileges]

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Thu, Sep 13, 2001 at 04:17:06PM -0400, Nalin Dahyabhai wrote:
> On Thu, Sep 13, 2001 at 02:26:18PM -0500, Steve Langasek wrote:
> > On Wed, 12 Sep 2001, Nalin Dahyabhai wrote:
> > Seems to trade reentrancy problems in the system as a whole for reentrancy
> > problems within the modules.  I'd rather that each function/module that's a
> > consumer of getpwnam_r() be expected to keep track of its own buffers and free
> > them when necessary.
> 
> I'd prefer just the opposite.  Expecting each module to handle the ERANGE
> error independently is going to require large-scale changes, and I'd
> rather that the logic to do so be put in one place to avoid the need to
> change similar code in numerous places in the future if something is found
> to be incorrect in the implementation.

Problem is: PAM_USER can be changed by the modules, so having a global
pw buf is asking for trouble unless the modules will change that when
they change PAM_USER. Also, not all modules will need to do
getpwnam_r(). And, this would be adding a new API of sorts.

OTOH, PAM needs its API extended (e.g., to better handle logging). So
I have to agree that an API for accessing a shared pw buf is appealing.

> Nalin
> 


Nico
--

Visit our website at http://www.ubswarburg.com

This message contains confidential information and is intended only 
for the individual named.  If you are not the named addressee you 
should not disseminate, distribute or copy this e-mail.  Please 
notify the sender immediately by e-mail if you have received this 
e-mail by mistake and delete this e-mail from your system.

E-mail transmission cannot be guaranteed to be secure or error-free 
as information could be intercepted, corrupted, lost, destroyed, 
arrive late or incomplete, or contain viruses.  The sender therefore 
does not accept liability for any errors or omissions in the contents 
of this message which arise as a result of e-mail transmission.  If 
verification is required please request a hard-copy version.  This 
message is provided for informational purposes and should not be 
construed as a solicitation or offer to buy or sell any securities or 
related financial instruments.





[Index of Archives]     [Fedora Users]     [Kernel]     [Red Hat Install]     [Linux for the blind]     [Gimp]

  Powered by Linux