[Pam-developers] [PATCH] pam_loginuid: Always return PAM_IGNORE in userns
Steve Langasek
vorlon at debian.org
Sun Jan 19 04:24:09 UTC 2014
On Sun, Jan 19, 2014 at 03:15:15AM +0400, Dmitry V. Levin wrote:
> On Fri, Jan 17, 2014 at 06:24:16PM -0500, Stéphane Graber wrote:
> > The previous patch to support user namespaces works fine with containers
> > that are started from a desktop/terminal session but fails when dealing
> > with containers that were started from a remote session such as ssh.
> > I haven't looked at the exact reason for that in the kernel but on the
> > userspace side of things, the difference is that containers started from
> > an ssh session will happily let pam open /proc/self/loginuid read-write,
> > will let it read its content but will then fail with EPERM when trying
> > to write to it.
> > So to make the userns support bullet proof, this commit moves the userns
> > check earlier in the function (which means a small performance impact as
> > it'll now happen everytime on kernels that have userns support) and will
> > set rc = PAM_IGNORE instead of rc = PAM_ERROR.
> > The rest of the code is still executed in the event that PAM is run on a
> > future kernel where we have some kind of audit namespace that includes a
> > working loginuid.
> Looks OK.
Agreed, and committed. Thanks, Stéphane!
--
Steve Langasek Give me a lever long enough and a Free OS
Debian Developer to set it on, and I can move the world.
Ubuntu Developer http://www.debian.org/
slangasek at ubuntu.com vorlon at debian.org
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 836 bytes
Desc: Digital signature
URL: <https://lists.fedorahosted.org/pipermail/pam-developers/attachments/20140118/e2d9cc57/attachment.sig>
More information about the Pam-developers
mailing list