On Mon, Apr 12, 2010 at 01:55:22PM +0000, Thorsten Kukuk wrote:
========== files committed ===============
Linux-PAM/doc/man pam.conf-syntax.xml 1.6 -> 1.7
============= commit log =================
Update of /cvsroot/pam/Linux-PAM/doc/man In directory sfp-cvsdas-2.v30.ch3.sourceforge.com:/tmp/cvs-serv9747/doc/man
Modified Files: pam.conf-syntax.xml Log Message: Relevant BUGIDs:
Purpose of commit: enhancement
Commit summary:
2010-04-12 Thorsten Kukuk kukuk@thkukuk.de
* doc/man/pam.conf-syntax.xml: Better documentation of "actionN". Patch from Michal Soltys <soltys@ziu.info>.
The corresponding commit 871a6e14d65c3c446ae0af51166dabc7a47a2b56 changes the documentation to state the following:
N (an unsigned integer) equivalent to ok with the side effect of jumping over the next N modules in the stack. Note that N equal to 0 is not allowed (and it would be identical to ok in such case).
According to _pam_dispatch_aux, this is not what's actually implemented: "equivalent to ok" is happening with cached chains only (e.g. pam_setcred and pam_close_session, see libpam/pam_dispatch.c:260), with all the rest it's rather "equivalent to ignore".
Should we change the documentation to match the implementation?
On Tue, 2020-05-12 at 19:20 +0300, Dmitry V. Levin wrote:
On Mon, Apr 12, 2010 at 01:55:22PM +0000, Thorsten Kukuk wrote:
========== files committed ===============
Linux-PAM/doc/man pam.conf-syntax.xml 1.6 -> 1.7
============= commit log =================
Update of /cvsroot/pam/Linux-PAM/doc/man In directory sfp-cvsdas-2.v30.ch3.sourceforge.com:/tmp/cvs- serv9747/doc/man
Modified Files: pam.conf-syntax.xml Log Message: Relevant BUGIDs:
Purpose of commit: enhancement
Commit summary:
2010-04-12 Thorsten Kukuk kukuk@thkukuk.de
* doc/man/pam.conf-syntax.xml: Better documentation of "actionN". Patch from Michal Soltys <soltys@ziu.info>.
The corresponding commit 871a6e14d65c3c446ae0af51166dabc7a47a2b56 changes the documentation to state the following:
N (an unsigned integer) equivalent to ok with the side effect of jumping over the next N modules in the stack. Note that N equal to 0 is not allowed (and it would be identical to ok in such case).
According to _pam_dispatch_aux, this is not what's actually implemented: "equivalent to ok" is happening with cached chains only (e.g. pam_setcred and pam_close_session, see libpam/pam_dispatch.c:260), with all the rest it's rather "equivalent to ignore".
Should we change the documentation to match the implementation?
Yes, I believe the documentation should be changed. Changing the code is IMO not a good idea as it could change behavior of existing configurations. The code is implemented this way for a very long time.
On Tue, May 12, 2020 at 08:02:05PM +0200, Tomas Mraz wrote:
On Tue, 2020-05-12 at 19:20 +0300, Dmitry V. Levin wrote:
On Mon, Apr 12, 2010 at 01:55:22PM +0000, Thorsten Kukuk wrote:
========== files committed ===============
Linux-PAM/doc/man pam.conf-syntax.xml 1.6 -> 1.7
============= commit log =================
Update of /cvsroot/pam/Linux-PAM/doc/man In directory sfp-cvsdas-2.v30.ch3.sourceforge.com:/tmp/cvs- serv9747/doc/man
Modified Files: pam.conf-syntax.xml Log Message: Relevant BUGIDs:
Purpose of commit: enhancement
Commit summary:
2010-04-12 Thorsten Kukuk kukuk@thkukuk.de
* doc/man/pam.conf-syntax.xml: Better documentation of "actionN". Patch from Michal Soltys <soltys@ziu.info>.
The corresponding commit 871a6e14d65c3c446ae0af51166dabc7a47a2b56 changes the documentation to state the following:
N (an unsigned integer) equivalent to ok with the side effect of jumping over the next N modules in the stack. Note that N equal to 0 is not allowed (and it would be identical to ok in such case).
According to _pam_dispatch_aux, this is not what's actually implemented: "equivalent to ok" is happening with cached chains only (e.g. pam_setcred and pam_close_session, see libpam/pam_dispatch.c:260), with all the rest it's rather "equivalent to ignore".
Should we change the documentation to match the implementation?
Yes, I believe the documentation should be changed. Changing the code is IMO not a good idea as it could change behavior of existing configurations. The code is implemented this way for a very long time.
By the way, is the cached chains feature documented somewhere besides pam_dispatch.c? I'd like to reuse the already existing documentation but I couldn't find any mentioning of the feature in doc directory.
On Wed, 2020-05-13 at 04:28 +0300, Dmitry V. Levin wrote:
On Tue, May 12, 2020 at 08:02:05PM +0200, Tomas Mraz wrote:
On Tue, 2020-05-12 at 19:20 +0300, Dmitry V. Levin wrote:
On Mon, Apr 12, 2010 at 01:55:22PM +0000, Thorsten Kukuk wrote:
========== files committed ===============
Linux-PAM/doc/man pam.conf-syntax.xml 1.6 -> 1.7
============= commit log =================
Update of /cvsroot/pam/Linux-PAM/doc/man In directory sfp-cvsdas-2.v30.ch3.sourceforge.com:/tmp/cvs- serv9747/doc/man
Modified Files: pam.conf-syntax.xml Log Message: Relevant BUGIDs:
Purpose of commit: enhancement
Commit summary:
2010-04-12 Thorsten Kukuk kukuk@thkukuk.de
* doc/man/pam.conf-syntax.xml: Better documentation of "actionN". Patch from Michal Soltys <soltys@ziu.info>.
The corresponding commit 871a6e14d65c3c446ae0af51166dabc7a47a2b56 changes the documentation to state the following:
N (an unsigned integer) equivalent to ok with the side effect of jumping over the next N modules in the stack. Note that N equal to 0 is not allowed (and it would be identical to ok in such case).
According to _pam_dispatch_aux, this is not what's actually implemented: "equivalent to ok" is happening with cached chains only (e.g. pam_setcred and pam_close_session, see libpam/pam_dispatch.c:260), with all the rest it's rather "equivalent to ignore".
Should we change the documentation to match the implementation?
Yes, I believe the documentation should be changed. Changing the code is IMO not a good idea as it could change behavior of existing configurations. The code is implemented this way for a very long time.
By the way, is the cached chains feature documented somewhere besides pam_dispatch.c? I'd like to reuse the already existing documentation but I couldn't find any mentioning of the feature in doc directory.
Hmm, I can't find it either. So probably it is not documented anywhere.
Every stack jump, besides the jump itself, has a side effect which is one of 'ignore', 'ok', or 'bad'. Unfortunately, the side effect is far from obvious because it depends on the PAM function call, and the documentation that contradicts the implementation does not help either.
* doc/man/pam.conf-syntax.xml (actionN): Rewrite the description of stack jump effects to match the implementation.
Fixes: 871a6e14d65c3c446ae0af51166dabc7a47a2b56 --- doc/man/pam.conf-syntax.xml | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-)
diff --git a/doc/man/pam.conf-syntax.xml b/doc/man/pam.conf-syntax.xml index da7cfb70..7b4edbf2 100644 --- a/doc/man/pam.conf-syntax.xml +++ b/doc/man/pam.conf-syntax.xml @@ -306,9 +306,19 @@ <term>N (an unsigned integer)</term> <listitem> <para> - equivalent to ok with the side effect of jumping over the - next N modules in the stack. Note that N equal to 0 is not - allowed (and it would be identical to ok in such case). + jump over the next N modules in the stack. + Note that N equal to 0 is not allowed, + it would be treated as <emphasis>ignore</emphasis> in such case. + The side effect depends on the PAM function call: + for <emphasis>pam_authenticate</emphasis>, + <emphasis>pam_acct_mgmt</emphasis>, + <emphasis>pam_chauthtok</emphasis>, and + <emphasis>pam_open_session</emphasis> + it is <emphasis>ignore</emphasis>; + for <emphasis>pam_setcred</emphasis> and + <emphasis>pam_close_session</emphasis> it is + one of <emphasis>ignore</emphasis>, <emphasis>ok</emphasis>, + or <emphasis>bad</emphasis> depending on the module's return value. </para> </listitem> </varlistentry>
LGTM, please merge.
On Sun, 2020-05-17 at 16:07 +0300, Dmitry V. Levin wrote:
Every stack jump, besides the jump itself, has a side effect which is one of 'ignore', 'ok', or 'bad'. Unfortunately, the side effect is far from obvious because it depends on the PAM function call, and the documentation that contradicts the implementation does not help either.
- doc/man/pam.conf-syntax.xml (actionN): Rewrite the description
of stack jump effects to match the implementation.
Fixes: 871a6e14d65c3c446ae0af51166dabc7a47a2b56
doc/man/pam.conf-syntax.xml | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-)
diff --git a/doc/man/pam.conf-syntax.xml b/doc/man/pam.conf- syntax.xml index da7cfb70..7b4edbf2 100644 --- a/doc/man/pam.conf-syntax.xml +++ b/doc/man/pam.conf-syntax.xml @@ -306,9 +306,19 @@ <term>N (an unsigned integer)</term> <listitem> <para>
equivalent to ok with the side effect of jumping over the
next N modules in the stack. Note that N equal to 0 is not
allowed (and it would be identical to ok in such case).
jump over the next N modules in the stack.
Note that N equal to 0 is not allowed,
it would be treated as <emphasis>ignore</emphasis> in
such case.
The side effect depends on the PAM function call:
for <emphasis>pam_authenticate</emphasis>,
<emphasis>pam_acct_mgmt</emphasis>,
<emphasis>pam_chauthtok</emphasis>, and
<emphasis>pam_open_session</emphasis>
it is <emphasis>ignore</emphasis>;
for <emphasis>pam_setcred</emphasis> and
<emphasis>pam_close_session</emphasis> it is
one of <emphasis>ignore</emphasis>,
<emphasis>ok</emphasis>,
or <emphasis>bad</emphasis> depending on the module's
return value. </para> </listitem> </varlistentry>
pam-developers@lists.fedorahosted.org