On Sun, 2020-05-17 at 20:57 +0300, Dmitry V. Levin wrote:
Hi,
At least since the very first git commit
ea488580c42e8918445a945484de3c8a5addc761
pam_permit sets PAM_USER to "nobody" when pam_get_user returns an
empty
string as the user name.
I couldn't find any rationale for this behaviour,
and it doesn't make any sense to me.
Do you have any reason to keep it? If not, I'd rather remove it.
Likewise, pam_debug introduced lated by commit
6180f388df5004d5435cd6912445130cf260f94e
has exactly the same behaviour.
Other modules don't behave this way.
As the pam_permit behavior is documented, I am against changing it. I
do not think it is in any sense insecure or dangerous as the return
value is PAM_USER_UNKNOWN anwyay and someone theoretically could depend
on it.
For the pam_debug I do not care that much - you can either document the
existing behavior or drop it.
--
Tomáš Mráz
No matter how far down the wrong road you've gone, turn back.
Turkish proverb
[You'll know whether the road is wrong if you carefully listen to your
conscience.]