[Pam-developers] [PATCH] pam_exec: Support showing stdout via pam_info, and only running for a specified module type

Josh Triplett josh at joshtriplett.org
Tue Apr 24 04:58:14 UTC 2012


The attached patches implement two new options for the pam_exec module.

Patch 1 adds a "stdout" option, which shows the stdout (and stderr) of
the executed command via pam_info.  For instance, adding the following
line to /etc/pam.d/login right before the line for pam_motd:
session optional pam_exec.so stdout /usr/bin/seq 5
will print five lines (numbered 1-5) at the start and end of the
session.  In order to implement this option without breaking the
existing support for the expose_authtok option, I had to
reorganize the file descriptor handling to move the loop that closes all unwanted
file descriptors below all the code that sets up stdin/stdout/stderr,
and add some new code before that setup to ensure that none of the pipes
ended up on stdin/stdout/stderr where they might get closed by dup2.

Patch 2 adds a "type" option, which causes pam_exec to only execute the
command when the PAM module type matches the given type.  In particular,
this makes it possible to run only at the start or end of a session,
without having to write a separate wrapper script to check the PAM_TYPE
environment variable.  For example, adding the following to
/etc/pam.d/login right before the line for pam_motd:
session optional pam_exec.so type=open_session /bin/sleep 5
will sleep for 5 seconds at login time, but not at logout time,
demonstrating that the option works.

Together, these options make it possible to show dynamically generated
output at the start of a PAM session.  For example, the following
pam_exec invocation produces the same output as the current dynamically
generated first line of the Debian motd:
session optional pam_exec.so type=open_session stdout /bin/uname -snrvm

- Josh Triplett
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 1-pam-exec-stdout.patch
Type: text/x-diff
Size: 5509 bytes
Desc: not available
URL: <https://fedorahosted.org/pipermail/pam-developers/attachments/20120423/1ccc19b4/attachment.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 2-pam-exec-type.patch
Type: text/x-diff
Size: 1836 bytes
Desc: not available
URL: <https://fedorahosted.org/pipermail/pam-developers/attachments/20120423/1ccc19b4/attachment-0001.bin>


More information about the Pam-developers mailing list