On Sun, 2020-05-17 at 20:57 +0300, Dmitry V. Levin wrote:
Hi,
At least since the very first git commit ea488580c42e8918445a945484de3c8a5addc761 pam_permit sets PAM_USER to "nobody" when pam_get_user returns an empty string as the user name.
I couldn't find any rationale for this behaviour, and it doesn't make any sense to me.
Do you have any reason to keep it? If not, I'd rather remove it.
Likewise, pam_debug introduced lated by commit 6180f388df5004d5435cd6912445130cf260f94e has exactly the same behaviour.
Other modules don't behave this way.
As the pam_permit behavior is documented, I am against changing it. I do not think it is in any sense insecure or dangerous as the return value is PAM_USER_UNKNOWN anwyay and someone theoretically could depend on it.
For the pam_debug I do not care that much - you can either document the existing behavior or drop it.