On Wed, Sep 03, 2014 at 05:13:55PM +0200, Tomas Mraz wrote:
On St, 2014-09-03 at 18:59 +0400, Dmitry V. Levin wrote:
> On Wed, Sep 03, 2014 at 04:45:17PM +0200, Tomas Mraz wrote:
> > On St, 2014-09-03 at 18:07 +0400, Dmitry V. Levin wrote:
> > > On Wed, Sep 03, 2014 at 03:33:57PM +0200, Tomas Mraz wrote:
> > > [...]
> > > > Well at least the pam module name cannot be /.so but grantor=/ could
be
> > > > confusing as well. I'll stick with the original grantor=? as
supporting
> > > > module named ?.so is something we do not really have to :).
> > >
> > > Well, I've never had a module named ?.so before, but I have it now,
> > > and it works perfectly well. :)
> >
> > But should it? What if we rejected such module name explicitly? Would
> > you accept that?
>
> As we don't pass mod_name to glob(3), fnmatch(3), wordexp(3), etc.,
> there is no risk to accept a module named "?.so".
> So what would be the rationale for this change?
That it confuses the audit trail?
> Does "?.so" look too suspicious for a valid pam module name? :)
And that as well.
Fair enough.
--
ldv