[Pam-developers] [PATCH] Introduce pam_modutil_sanitize_helper_fds
Tomas Mraz
tmraz at redhat.com
Mon Jan 27 17:50:12 UTC 2014
On Po, 2014-01-27 at 21:02 +0400, Dmitry V. Levin wrote:
> This change introduces pam_modutil_sanitize_helper_fds - a new function
> that redirects standard descriptors and closes all other descriptors.
>
> pam_modutil_sanitize_helper_fds supports three types of input and output
> redirection:
> - PAM_MODUTIL_IGNORE_FD: do not redirect at all.
> - PAM_MODUTIL_PIPE_FD: redirect to a pipe. For stdin, it is implemented
> by creating a pipe, closing its write end, and redirecting stdin to
> its read end. Likewise, for stdout/stderr it is implemented by
> creating a pipe, closing its read end, and redirecting to its write
> end. Unlike stdin redirection, stdout/stderr redirection to a pipe
> has a side effect that a process writing to such descriptor should be
> prepared to handle SIGPIPE appropriately.
> - PAM_MODUTIL_NULL_FD: redirect to /dev/null. For stdin, it is
> implemented via PAM_MODUTIL_PIPE_FD because there is no functional
> difference. For stdout/stderr, it is classic redirection to
> /dev/null.
>
> PAM_MODUTIL_PIPE_FD is usually more suitable due to linux kernel
> security restrictions, but when the helper process might be writing to
> the corresponding descriptor and termination of the helper process by
> SIGPIPE is not desirable, one should choose PAM_MODUTIL_NULL_FD.
OK to commit.
--
Tomas Mraz
No matter how far down the wrong road you've gone, turn back.
Turkish proverb
(You'll never know whether the road is wrong though.)
More information about the Pam-developers
mailing list