Bug 2283963

Summary:	chpasswd enable the use of PAM
Product:	[Fedora] Fedora	Reporter:	Petr Hruska <petr.hruska>
Component:	shadow-utils	Assignee:	Iker Pedrosa <ipedrosa>
Status:	CLOSED RAWHIDE	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	medium	Docs Contact:
Priority:	unspecified
Version:	rawhide	CC:	awilliam, ipedrosa, kevin, tm
Target Milestone:	---	Keywords:	Regression, Triaged
Target Release:	---
Hardware:	x86_64
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2026-05-28 08:01:57 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Petr Hruska 2024-05-30 09:08:10 UTC

Since upgrading to F40, chpasswd stop using pam. I have trace that down to change related to https://bugzilla.redhat.com/show_bug.cgi?id=2233275. Where following PR was done https://src.fedoraproject.org/fork/ipedrosa/rpms/shadow-utils/c/91360f25a8c8b810d59bec2803a2477a2647c775. Patch shadow-4.14.0-account-tools-setuid.patch effectively deactivating PAM support if ACCT_TOOLS_SETUID is not set. In spec file, configuration is set not to use it (--disable-account-tools-setuid).
Is it possible to re-enable PAM support for shadow-utils tools?

When patch is dropped, my system started to use PAM subsystem.

Reproducible: Always

Steps to Reproduce:
1.useradd test
2.echo "test:test" | strace chpasswd &> strace_test.log 
3.grep "pam\.d" strace_test.log
Actual Results:  
No indication that /etc/pam.d configuration would be read.

Expected Results:  
PAM configuration files should be read. Grep output should show, syscall to open pam configuration.
newfstatat(AT_FDCWD, "/etc/pam.d", {st_mode=S_IFDIR|0755, st_size=4096, ...}, 0) = 0
openat(AT_FDCWD, "/etc/pam.d/chpasswd", O_RDONLY) = 3
openat(AT_FDCWD, "/etc/pam.d/other", O_RDONLY) = 3

Comment 1 Iker Pedrosa 2024-05-30 14:03:19 UTC

You are right. I'll remove that part of the patch.

Comment 2 Adam Williamson 2024-05-30 21:05:18 UTC

This seems to have broken `chpasswd -R`. See https://bodhi.fedoraproject.org/updates/FEDORA-2024-8394646791#comment-3542306

Comment 3 Adam Williamson 2024-05-30 21:05:59 UTC

That is, the attempt to turn pam support on again broke it, not the initial removal of pam support.

Comment 4 Iker Pedrosa 2024-06-03 07:31:25 UTC

Petr prior to fedora 40 shadow was packaged without libpam support, meaning that in fedora 39 and previous versions chpasswd didn't use PAM. So, in reality chpasswd didn't stop using PAM, and the problem was there even before fedora 40 was released. Are you sure that it stopped using PAM? If so, can you explain how you made it work that way?

Comment 5 Petr Hruska 2024-06-03 08:11:56 UTC

Unfortunately you are right. I notice problem in system which was previously patched with shadow-utils where libpam support was enabled. But I didn't notice that during my testing. My intention was to inform you about missing pam support, as I was able to getting working by myself. And turn outs that it was just waste of time for you, to check something what wasn't working previously. I'm sorry for that, please apologize me. Ticket can be closed.

Comment 6 Iker Pedrosa 2024-06-03 08:55:40 UTC

No, that's fine, but the priority changes a bit.

I'm keeping it open since chpasswd should use PAM, but this isn't a regression so it's not such a priority.

Comment 7 Kevin Fenzi 2024-07-24 00:19:40 UTC

This got into rawhide via the mass rebuild. ;( 

We untagged it, but it already went in a compose.

So, I have pushed a revert back... hopefully thats all ok. ;)

Comment 8 Aoife Moloney 2025-04-25 10:52:48 UTC

This message is a reminder that Fedora Linux 40 is nearing its end of life.
Fedora will stop maintaining and issuing updates for Fedora Linux 40 on 2025-05-13.
It is Fedora's policy to close all bug reports from releases that are no longer
maintained. At that time this bug will be closed as EOL if it remains open with a
'version' of '40'.

Package Maintainer: If you wish for this bug to remain open because you
plan to fix it in a currently maintained version, change the 'version' 
to a later Fedora Linux version. Note that the version field may be hidden.
Click the "Show advanced fields" button if you do not see it.

Thank you for reporting this issue and we are sorry that we were not 
able to fix it before Fedora Linux 40 is end of life. If you would still like 
to see this bug fixed and are able to reproduce it against a later version 
of Fedora Linux, you are encouraged to change the 'version' to a later version
prior to this bug being closed.