On Fri, May 22, 2020 at 12:14:42PM +0200, Tomas Mraz wrote:
On Sun, 2020-05-17 at 20:57 +0300, Dmitry V. Levin wrote:
> Hi,
>
> At least since the very first git commit
> ea488580c42e8918445a945484de3c8a5addc761
> pam_permit sets PAM_USER to "nobody" when pam_get_user returns an
> empty
> string as the user name.
>
> I couldn't find any rationale for this behaviour,
> and it doesn't make any sense to me.
>
> Do you have any reason to keep it? If not, I'd rather remove it.
>
> Likewise, pam_debug introduced lated by commit
> 6180f388df5004d5435cd6912445130cf260f94e
> has exactly the same behaviour.
>
> Other modules don't behave this way.
As the pam_permit behavior is documented, I am against changing it. I
do not think it is in any sense insecure or dangerous as the return
value is PAM_USER_UNKNOWN anwyay and someone theoretically could depend
on it.
The documentation also states that "pam_permit is a PAM module that always
permit access" and its RETURN VALUES section claims that the module always
returns PAM_SUCCESS. Consequently, pam_permit users must be assuming that
pam_permit never fails. However, in practice pam_permit can return an
error value if either pam_get_user or pam_set_item returned an error.
I bet most of pam_permit users would be surprised (to say the least)
to learn about the real pam_permit behaviour.
--
ldv