On Wed, Jan 16, 2019 at 9:46 AM Reindl Harald h.reindl@thelounge.net wrote:
Am 16.01.19 um 15:32 schrieb Stephen Gallagher:
OK, so while pam_open_session() runs with UID == the user logging in, it *also* runs with EUID (effective UID) of the application that called it. This is so that pam_open_session() can do things like creating or mounting the user's home directory.
So, we cannot rely on basic permissions to restrict the display of the MOTD (without modifying pam_motd sources). I guess that would have been too easy...
when it is properly packaged as "confignoreplace" just empty that file and you are done
That is entirely unrelated to the discussion at hand. The idea was to have the file readable only by root/wheel when cockpit is not running, so only the users with the ability to start cockpit would see the message. Then, when cockpit starts it would be replaced by a world-readable version that includes the address.