On St, 2014-09-03 at 18:59 +0400, Dmitry V. Levin wrote:
On Wed, Sep 03, 2014 at 04:45:17PM +0200, Tomas Mraz wrote:
> On St, 2014-09-03 at 18:07 +0400, Dmitry V. Levin wrote:
> > On Wed, Sep 03, 2014 at 03:33:57PM +0200, Tomas Mraz wrote:
> > [...]
> > > Well at least the pam module name cannot be /.so but grantor=/ could be
> > > confusing as well. I'll stick with the original grantor=? as
supporting
> > > module named ?.so is something we do not really have to :).
> >
> > Well, I've never had a module named ?.so before, but I have it now,
> > and it works perfectly well. :)
>
> But should it? What if we rejected such module name explicitly? Would
> you accept that?
As we don't pass mod_name to glob(3), fnmatch(3), wordexp(3), etc.,
there is no risk to accept a module named "?.so".
So what would be the rationale for this change?
That it confuses the audit trail?
Does "?.so" look too suspicious for a valid pam module
name? :)
And that as well.
--
Tomas Mraz
No matter how far down the wrong road you've gone, turn back.
Turkish proverb
(You'll never know whether the road is wrong though.)