Bug 1090638
| Summary: | remove pam_securetty.so from .pamd files | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Matthew Miller <mattdm> |
| Component: | util-linux | Assignee: | Karel Zak <kzak> |
| Status: | CLOSED RAWHIDE | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
| Severity: | unspecified | Docs Contact: | Eric Christensen <sparks> |
| Priority: | unspecified | ||
| Version: | rawhide | CC: | jonathan, kzak, mluscon, moez.roy, ovasik, sparks |
| Target Milestone: | --- | Flags: | mattdm:
fedora_requires_release_note+
|
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | util-linux-2.24.2-3.fc21 | Doc Type: | Bug Fix |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2014-05-12 08:57:22 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
Matthew Miller
2014-04-23 20:05:57 UTC
This needs to go in the release notes. Something like: Because of the dynamic nature of TTY device files on modern Linux systems, the "securetty" PAM module has been disabled by default and /etc/securetty no longer included. Since the previous file listed many possible devices so that the practical effect in most cases was to allow by default, this change will not impact most people. However, if you were using a more restrictive configuration, you will need to add pam_securetty.so to the appropriate files in /etc/pam.d, and create a new /etc/securetty file. I'll take this for the Release Notes. This is related to bug #1090639, but it's not actually a dependency either way, because: * If /etc/securetty is removed but the pam configuration unchanged, the pam module treats that as "allow anything" -- the desired state, but with extra lines in the pam file which aren't doing anything * If the pam configuration is changed but /etc/securetty is still there, it won't work anymore, which may be confusing, but doesn't block anything So is pam_securetty.so removed from util-linux-login.pamd and util-linux-remote.pamd ? Or do you need to wait for Karel Zak to remove it? Removed. |