On Tue, 2020-05-12 at 19:20 +0300, Dmitry V. Levin wrote:
On Mon, Apr 12, 2010 at 01:55:22PM +0000, Thorsten Kukuk wrote:
========== files committed ===============
Linux-PAM/doc/man pam.conf-syntax.xml 1.6 -> 1.7
============= commit log =================
Update of /cvsroot/pam/Linux-PAM/doc/man In directory sfp-cvsdas-2.v30.ch3.sourceforge.com:/tmp/cvs- serv9747/doc/man
Modified Files: pam.conf-syntax.xml Log Message: Relevant BUGIDs:
Purpose of commit: enhancement
Commit summary:
2010-04-12 Thorsten Kukuk kukuk@thkukuk.de
* doc/man/pam.conf-syntax.xml: Better documentation of "actionN". Patch from Michal Soltys <soltys@ziu.info>.
The corresponding commit 871a6e14d65c3c446ae0af51166dabc7a47a2b56 changes the documentation to state the following:
N (an unsigned integer) equivalent to ok with the side effect of jumping over the next N modules in the stack. Note that N equal to 0 is not allowed (and it would be identical to ok in such case).
According to _pam_dispatch_aux, this is not what's actually implemented: "equivalent to ok" is happening with cached chains only (e.g. pam_setcred and pam_close_session, see libpam/pam_dispatch.c:260), with all the rest it's rather "equivalent to ignore".
Should we change the documentation to match the implementation?
Yes, I believe the documentation should be changed. Changing the code is IMO not a good idea as it could change behavior of existing configurations. The code is implemented this way for a very long time.