On Tue, 2012-11-13 at 01:31 +0400, Dmitry V. Levin wrote:
On Mon, Nov 12, 2012 at 08:57:44PM +0100, Tomas Mraz wrote:
> It runs with real uid == 0 when the pam_pwhistory does not enforce the
> restriction anymore. The following patch fixes the test:
>
> diff --git a/xtests/tst-pam_pwhistory1.pamd b/xtests/tst-pam_pwhistory1.pamd
> index 68e1b94..d60db7c 100644
> --- a/xtests/tst-pam_pwhistory1.pamd
> +++ b/xtests/tst-pam_pwhistory1.pamd
> @@ -1,6 +1,6 @@
> #%PAM-1.0
> auth required pam_permit.so
> account required pam_permit.so
> -password required pam_pwhistory.so remember=10 retry=1
> +password required pam_pwhistory.so remember=10 retry=1 enforce_for_root
> password required pam_unix.so use_authtok md5
> session required pam_permit.so
>
> OK to commit?
If pam_pwhistory is supposed to apply enforce_for_root check to getuid()
instead of the authenticated user id, then yes.
Yes, this is the same logic as in the pam_cracklib module.
--
Tomas Mraz
No matter how far down the wrong road you've gone, turn back.
Turkish proverb