On Fri, 2011-06-10 at 10:44 -0700, Kees Cook wrote:
On Fri, Jun 10, 2011 at 04:36:52PM +0200, Thorsten Kukuk wrote:
>
https://fedorahosted.org/linux-pam/ticket/1
>
> It is about that pam_securetty should always allow root login from
> devices listed in /sys/class/tty/console/active.
> I think the reason for this patch (ttyS0 missing in /etc/securetty
> on s390x) is wrong, if I build a distribution, I have to add the
> device there.
> But we have already the console= option, and this is equivalent
> to it.
What about systems that have intentionally removed entries from
/etc/security that this new behavior would effectively bypass?
They can add the noconsole option to pam_securetty that disables this
automatic behavior.
--
Tomas Mraz
No matter how far down the wrong road you've gone, turn back.
Turkish proverb