Note: This bug is displayed in read-only format because
the product is no longer active in Red Hat Bugzilla.
RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Description of problem:
When audit is disabled at the kernel level (audit=0) and pam_tty_audit.so is configured to be non-optional, all logins fail.
Version-Release number of selected component (if applicable):
Probably all releases that include pam_tty_audit.so
How reproducible:
Steps to Reproduce:
1. Add the following to PAM:
session required pam_tty_audit.so
2. Reboot and set 'audit=0' in the active kernel options
3. Attempt to login
Actual results:
All users fail to login.
Expected results:
If auditing is explicitly disabled in the kernel, I would expect logins to succeed.
Additional info:
To preserve the existing behavior, it would be ideal to have an option added that allows the administrator to choose to bypass the module in this specific case. Setting the module to 'optional' is functional but may miss real issues that should prevent a login for occurring.
Verified the bug on PAM version: pam-1.3.1-10.el8.x86_64
Steps followed during verification:
--------------------------------------------------------------------------
1) Reproduce the issue with an older pam build, so downgrade pam.
# dnf downgrade pam-1.3.0-6.el8+5.x86_64.rpm
# rpm -q pam
pam-1.3.0-6.el8+5.x86_64
2) Configure pam session stack with pam_tty_audit.so module.
# grep -r pam_tty_audit .
./system-auth:session required pam_tty_audit.so disable=* enable=testuser
./password-auth:session required pam_tty_audit.so disable=* enable=testuser
3) Reboot system and edit kernel command line to set "audit=0".
4) Try to login as root or other users. It was observed that user login fails.
# ssh -l testuser 192.168.122.96
testuser.122.96's password:
Last login: Thu May 14 02:08:17 2020 from 192.168.122.1
Connection to 192.168.122.96 closed.
5) Reboot the system again, and don't disable audit this time.
6) Upgrade pam to the latest version.
# dnf upgrade pam
# rpm -q pam
pam-1.3.1-10.el8.x86_64
7) Repeat Step-3.
8) Try to login as root or other users. It was observed that user authentication works.
# ssh -l root 192.168.122.96
root.122.96's password:
Web console: https://localhost:9090/ or https://192.168.122.96:9090/
Last login: Thu May 14 02:18:34 2020
[root@localhost ~]#
9) Check the kernel cmdline option to verify audit status.
# cat /proc/cmdline
BOOT_IMAGE=(hd0,msdos1)/vmlinuz-4.18.0-197.el8.x86_64 root=UUID=71f203ab-089f-4339-8a85-481e28afd74a ro crashkernel=auto audit=0 resume=UUID=9a76ac26-4180-4a1b-a2b6-098dbbfd05e0
Hence, marking the bug VERIFIED.
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.
For information on the advisory (pam bug fix and enhancement update), and where to find the updated
files, follow the link below.
If the solution does not work for you, open a new bug report.
https://access.redhat.com/errata/RHBA-2020:4466