[Pam-developers] [PATCH] Introduce pam_modutil_sanitize_helper_fds

Tomas Mraz tmraz at redhat.com
Mon Jan 27 17:50:12 UTC 2014


On Po, 2014-01-27 at 21:02 +0400, Dmitry V. Levin wrote:
> This change introduces pam_modutil_sanitize_helper_fds - a new function
> that redirects standard descriptors and closes all other descriptors.
> 
> pam_modutil_sanitize_helper_fds supports three types of input and output
> redirection:
> - PAM_MODUTIL_IGNORE_FD: do not redirect at all.
> - PAM_MODUTIL_PIPE_FD: redirect to a pipe.  For stdin, it is implemented
>   by creating a pipe, closing its write end, and redirecting stdin to
>   its read end.  Likewise, for stdout/stderr it is implemented by
>   creating a pipe, closing its read end, and redirecting to its write
>   end.  Unlike stdin redirection, stdout/stderr redirection to a pipe
>   has a side effect that a process writing to such descriptor should be
>   prepared to handle SIGPIPE appropriately.
> - PAM_MODUTIL_NULL_FD: redirect to /dev/null.  For stdin, it is
>   implemented via PAM_MODUTIL_PIPE_FD because there is no functional
>   difference.  For stdout/stderr, it is classic redirection to
>   /dev/null.
> 
> PAM_MODUTIL_PIPE_FD is usually more suitable due to linux kernel
> security restrictions, but when the helper process might be writing to
> the corresponding descriptor and termination of the helper process by
> SIGPIPE is not desirable, one should choose PAM_MODUTIL_NULL_FD.

OK to commit.

-- 
Tomas Mraz
No matter how far down the wrong road you've gone, turn back.
                                              Turkish proverb
(You'll never know whether the road is wrong though.)



More information about the Pam-developers mailing list