On Fri, May 22, 2020 at 12:14:42PM +0200, Tomas Mraz wrote:
On Sun, 2020-05-17 at 20:57 +0300, Dmitry V. Levin wrote:
Hi,
At least since the very first git commit ea488580c42e8918445a945484de3c8a5addc761 pam_permit sets PAM_USER to "nobody" when pam_get_user returns an empty string as the user name.
I couldn't find any rationale for this behaviour, and it doesn't make any sense to me.
Do you have any reason to keep it? If not, I'd rather remove it.
Likewise, pam_debug introduced lated by commit 6180f388df5004d5435cd6912445130cf260f94e has exactly the same behaviour.
Other modules don't behave this way.
As the pam_permit behavior is documented, I am against changing it. I do not think it is in any sense insecure or dangerous as the return value is PAM_USER_UNKNOWN anwyay and someone theoretically could depend on it.
The documentation also states that "pam_permit is a PAM module that always permit access" and its RETURN VALUES section claims that the module always returns PAM_SUCCESS. Consequently, pam_permit users must be assuming that pam_permit never fails. However, in practice pam_permit can return an error value if either pam_get_user or pam_set_item returned an error.
I bet most of pam_permit users would be surprised (to say the least) to learn about the real pam_permit behaviour.