On Sat, 2020-05-23 at 04:16 +0300, Dmitry V. Levin wrote:
On Fri, May 22, 2020 at 12:14:42PM +0200, Tomas Mraz wrote:
> On Sun, 2020-05-17 at 20:57 +0300, Dmitry V. Levin wrote:
> > Hi,
> >
> > At least since the very first git commit
> > ea488580c42e8918445a945484de3c8a5addc761
> > pam_permit sets PAM_USER to "nobody" when pam_get_user returns an
> > empty
> > string as the user name.
> >
> > I couldn't find any rationale for this behaviour,
> > and it doesn't make any sense to me.
> >
> > Do you have any reason to keep it? If not, I'd rather remove it.
> >
> > Likewise, pam_debug introduced lated by commit
> > 6180f388df5004d5435cd6912445130cf260f94e
> > has exactly the same behaviour.
> >
> > Other modules don't behave this way.
>
> As the pam_permit behavior is documented, I am against changing it.
> I
> do not think it is in any sense insecure or dangerous as the return
> value is PAM_USER_UNKNOWN anwyay and someone theoretically could
> depend
> on it.
The documentation also states that "pam_permit is a PAM module that
always
permit access" and its RETURN VALUES section claims that the module
always
returns PAM_SUCCESS. Consequently, pam_permit users must be assuming
that
pam_permit never fails. However, in practice pam_permit can return
an
error value if either pam_get_user or pam_set_item returned an error.
I bet most of pam_permit users would be surprised (to say the least)
to learn about the real pam_permit behaviour.
I am afraid we cannot please everyone, however in this case I would
really prefer to change the documentation to reflect the current
sources.
--
Tomáš Mráz
No matter how far down the wrong road you've gone, turn back.
Turkish proverb
[You'll know whether the road is wrong if you carefully listen to your
conscience.]