On Mon, Nov 12, 2012 at 08:57:44PM +0100, Tomas Mraz wrote:
It runs with real uid == 0 when the pam_pwhistory does not enforce
the
restriction anymore. The following patch fixes the test:
diff --git a/xtests/tst-pam_pwhistory1.pamd b/xtests/tst-pam_pwhistory1.pamd
index 68e1b94..d60db7c 100644
--- a/xtests/tst-pam_pwhistory1.pamd
+++ b/xtests/tst-pam_pwhistory1.pamd
@@ -1,6 +1,6 @@
#%PAM-1.0
auth required pam_permit.so
account required pam_permit.so
-password required pam_pwhistory.so remember=10 retry=1
+password required pam_pwhistory.so remember=10 retry=1 enforce_for_root
password required pam_unix.so use_authtok md5
session required pam_permit.so
OK to commit?
If pam_pwhistory is supposed to apply enforce_for_root check to getuid()
instead of the authenticated user id, then yes.
--
ldv