[Pam-developers] [PATCH] Read pam_umask "usergroups" option from /etc/login.defs

Dmitry V. Levin ldv at altlinux.org
Fri Jan 17 03:10:51 UTC 2014


On Wed, Jan 15, 2014 at 08:01:29PM -0800, Steve Langasek wrote:
> Ubuntu has been carrying a patch for a while to support reading the
> USERGROUPS_ENAB setting from /etc/login.defs, so that it doesn't have to be
> passed as an argument to pam_umask.  I think this change is appropriate for
> including upstream.
> 
> Do folks agree this is correct?

If pam_umask has "usergroups" argument but at the same time has no
"umask=" argument, and /etc/login.defs has "USERGROUPS_ENAB=no" parameter,
then this patch would override "usergroups" argument, which is probably
not quite correct.

> I wonder if the USERGROUPS_ENAB setting
> should really only apply to UMASK settings in /etc/login.defs, or if it
> should be honored regardless of the source of the umask.  (The current
> behavior is the most conservative, but I'm not sure it's actually the most
> natural.)

The current behavior is that "usergroups" argument affects umask value
obtained from any less or equally prioritized source (that is, from any
source except the user's GECOS field.

I have no strong preference, any consistent and documented behavior would do.

> We should certainly fix it so the code and the documentation match; I'm not
> sure that either is currently correct, though.  I think the intended order
> is probably:
> 
>        ·   umask= entry in the user's GECOS field
>        ·   umask= argument

Certainly.

>        ·   UMASK= entry from /etc/default/login
>        ·   UMASK entry from /etc/login.defs (influenced by USERGROUPS_ENAB in
>            /etc/login.defs)

I'm not sure about that.  If we assume that the source that provides more
fine-grained control also has higher priority, than /etc/login.defs should
probably have higher priority because of USERGROUPS_ENAB parameter that
has no analog in /etc/default/login.


-- 
ldv
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 198 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/pam-developers/attachments/20140117/32cf57d6/attachment.sig>


More information about the Pam-developers mailing list