On 02/09/2016 03:42 PM, Pavel Reichl wrote:
> On 02/09/2016 08:17 AM, Jakub Hrozek wrote:
>> On Fri, Jan 29, 2016 at 02:30:36PM +0100, Pavel Reichl wrote:
>>> Hello, please see trivial patch attached. Thanks.
>>> From 6d5f6b71c2d2f891470dc1c9f08ae67f5b6c02f5 Mon Sep 17 00:00:00 2001
>>> From: Pavel Reichl <preichl(a)redhat.com>
>>> Date: Fri, 29 Jan 2016 08:27:01 -0500
>>> Subject: [PATCH] PAM: Clarify man page for domains option
>>> src/man/pam_sss.8.xml | 8 +++++---
>>> 1 file changed, 5 insertions(+), 3 deletions(-)
>>> diff --git a/src/man/pam_sss.8.xml b/src/man/pam_sss.8.xml
>>> --- a/src/man/pam_sss.8.xml
>>> +++ b/src/man/pam_sss.8.xml
>>> @@ -145,9 +145,11 @@
>>> SSSD domain names, as specified in the
>>> sssd.conf file.
>>> - NOTE: Must be used in conjunction with the
>>> - <quote>pam_trusted_users</quote> and
>>> - <quote>pam_public_domains</quote>
>>> + NOTE: If PAM service is being run by
>>> untrusted user
>>> + (<quote>pam_trusted_users</quote>
>>> + then please make
>>> + sure that restricted domains are public
>>> + (<quote>pam_public_domains</quote>
>>> Please see the
>> I'm sorry, but this doesn't read any better to me. Especially I
>> understand "restricted domains are public", sounds like an oxymoron to
> Oh, sorry. By "restricted domain" I thought only the domains you are
> restricting access to - like the only ones you can use. It's used in the
> context of the first paragraph of domains option.
> I'll try to rephrase.
> If PAM service is being run by untrusted
> user(<quote>pam_trusted_users</quote> option) then please make sure that
> domains entered into domains option are actually public
> (<quote>pam_public_domains</quote> option). Otherwise access will be
> denied because untrusted user would be trying to access non-public domain.
> Does it sound any better? Would you propose some other wording? Or we
> can drop the note completely.
I think any description will be confusing without the knowledge of pam_trusted_users and
pam_public_domains options. Since the default is that all users are considered to be
trusted I don't think we need to mentioned it here. How about:
Allows the administrator to restrict the domains a particular PAM
service is allowed to authenticate against. The format is a comma-
separated list of SSSD domain names, as specified in the sssd.conf
See also: pam_public_domains, pam_trusted_users in sssd.conf(5)
It's fine by me. Shall you prepare a patch or do we want Jakub's or Aneta's