Karel Zak wrote: > On Thu, Nov 17, 2011 at 11:31:47AM +0100, Thorsten Kukuk wrote: >> On Mon, Oct 17, Karel Zak wrote: >> >>> Git tree: https://karelzak@xxxxxxxxxx/karelzak/util-linux.git branch 'login'. >>> URL: https://github.com/karelzak/util-linux/tree/login >> >> Ok, I found one bug: pam_setcred() is only called after pam_open_session(), >> but has to be called before: > > Well, this is discussable... login(1) for years called pam_setcred() > after pam_open_session(), but I agree it's not optional. > > After discussion with our PAM maintainer we decided that the best is > probably to use PAM_ESTABLISH_CRED before and PAM_REINITIALIZE_CRED > after pam_open_session(). This solution should be probably the most > robust (it's probably used by openssh). Modules must work with one call before pam_open_session() as that's the only documented and correct way. So that's what other applications such as login managers, su etc do. IOW a module that would break due to login using pam calls in the correct order is quite unlikely to exist at all. cu Ludwig -- (o_ Ludwig Nussel //\ V_/_ http://www.suse.de/ SUSE LINUX Products GmbH, GF: Jeff Hawn, Jennifer Guild, Felix Imendörffer, HRB 16746 (AG Nürnberg) -- To unsubscribe from this list: send the line "unsubscribe util-linux" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
