Bug 442565 - pam_sepermit exclusive does not work with gnome-screensaver
Summary: pam_sepermit exclusive does not work with gnome-screensaver
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: None
Product: Fedora
Classification: Fedora
Component: pam
Version: 9
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Tomas Mraz
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2008-04-15 15:21 UTC by Daniel Walsh
Modified: 2008-05-21 07:54 UTC (History)
0 users

Fixed In Version: Fedora 9
Clone Of:
Environment:
Last Closed: 2008-05-21 07:54:45 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)
I was thinking just check for uid==0 (871 bytes, application/octet-stream)
2008-04-15 16:00 UTC, Daniel Walsh
no flags Details
Base decision on euid (581 bytes, patch)
2008-04-15 16:34 UTC, Tomas Mraz
no flags Details | Diff

Description Daniel Walsh 2008-04-15 15:21:02 UTC
Description of problem:


 sepermit should only check exclusive if it is running as root, otherwise it
sees itself and fails.

Comment 1 Tomas Mraz 2008-04-15 15:41:07 UTC
I was thinking about this and I simply think that pam_sepermit should not be
added to the gnome-screensaver pam configuration at all (and use for example
'auth sufficient pam_succeed_if.so user = xguest') or there should be an option
to ignore the exclusive flags in the configuration file which would be used with
pam_sepermit and screensaver.


Comment 2 Daniel Walsh 2008-04-15 16:00:02 UTC
Created attachment 302484 [details]
I was thinking just check for uid==0

Comment 3 Daniel Walsh 2008-04-15 16:00:51 UTC
This patch works for me.

The problem with hard coding xguest is it forces users to edit the pam stack.

Comment 4 Tomas Mraz 2008-04-15 16:34:56 UTC
Created attachment 302491 [details]
Base decision on euid

The decision should be based on effective uid rather than on real. Also I moved
the test a little bit later - there might be some more flags added in future.
The question is whether adding an explicit option to the module to ignore the
exclusive flag could be useful or not. But as I see it currently this patch
should be sufficient.

Comment 5 Daniel Walsh 2008-04-15 17:13:25 UTC
Ok, I was debating whether to put it there.  I can never remember the correct
get*uid call to call.

Can you get this out for Fedora 9?

Comment 6 Bug Zapper 2008-05-14 09:29:31 UTC
Changing version to '9' as part of upcoming Fedora 9 GA.
More information and reason for this action is here:
http://fedoraproject.org/wiki/BugZappers/HouseKeeping


Note You need to log in before you can comment on or make changes to this bug.