On (04/11/15 14:40), Pavel Reichl wrote:
On 11/04/2015 02:23 PM, Sumit Bose wrote:
>On Wed, Nov 04, 2015 at 01:58:51PM +0100, Pavel Reichl wrote:
>>On 11/04/2015 01:19 PM, Lukas Slebodnik wrote:
>>>On (04/11/15 13:14), Pavel Reichl wrote:
>>>>On 11/04/2015 12:53 PM, Jakub Hrozek wrote:
>>>>>> From f9b5adc160d6c18c429cc4e12276896ccc6f7a6d Mon Sep 17 00:00:00
>>>>>>From: Pavel Reichl <preichl(a)redhat.com>
>>>>>>Date: Tue, 20 Oct 2015 09:13:53 -0400
>>>>>>Subject: [PATCH 3/3] TESTS: fix typo in PAM service name
>>>>>What is the purpose of this patch? Just to match the service name
>>>>>what is on Fedora?
>>>>My idea is that ssh daemon is the PAM service and not the ssh client no
>>>>matter the system, right? IIRC it does not matter in this test at all but
>>>>it's a typo anyway. I think I briefly asked Sumit about this change
>>>>expressed his consensus however I can't find the conversation now so I
>>>>But If you don't like the change feel free to drop it, it's no
doubt a nitpick.
>>>You can have any file in /etc/pam.d
>>>+1 for drop
>>I found the conversation I had with Sumit:
>>>preichl> Hello Sumit, sorry to bother you again, I have just a quick
question - test_pam_srv.c mock_input_pam() - why do we set pi.pam_service =
"ssh"; ? Should not service be rather sshd? Thanks!
>>><preichl> I'm just curious I thought that sshd has pam modules...but
I'm afraid I forget even the little I already knew about PAM.
>>><sbose> no, you are right 'sshd' is the right service name, I
guess it is just a typo.
>>><preichl> OK, so if you don't mind I'll send a patch as part og
the patchset I'm working on
>>><sbose> no, of course not, go ahead
>Yes, services using PAM can use any name. On the other hand there are
>some areas of the code which checks for the service name. From the top
>of my head I can think of the GPO code and the check to see if it make
>sense to look for an inserted Smartcard (the services in the GPO code
>are already configurable, I will make the list in the Smartcard
>configurable too, but I didn't want to add too many now options with the
>initial version). So in general it might be important to use an existing
>service name for some tests. In the given case the name is just a dummy
>because there has to be a service name. So maybe it would be better to
>not use 'ssh' or 'sshd' here at all but something like
>'pam_test_service' to indicate that it is a generic name.
Also one of few not yet tested corners of pam_reply() - 'Printing account
expiration warning for sshd' requires pam_service to be sshd, but I can
change when I will write another test (it might happen soon as pcech is
working on similar change in adjacent code).
That's exactly the reason why the default value should not be sshd.
And if there will be test for "Printing account expiration warning"
Then the name of service should be explicitelly set to sshd.