Description of problem: When pam_exec launches an executable, it doesn't export the environment variables (PAM_USER, PAM_HOST,...). Version-Release number of selected component (if applicable): 0.99.6.2-6.el5 How reproducible: Define a rule involving pam_exec.so Steps to Reproduce: Define a rule like (for instance in /etc/pam.d/sshd): auth optional pam_exec.so debug /bin/script Where script is executable and contains the following : #!/bin/bash env > /tmp/pam.log then perform the action corresponding to the file you wrote the rule into (for instance, create a SSH session) and go check the content of /tmp/pam.log. Actual results: BASH=/bin/bash BASH_ARGC=() BASH_ARGV=() BASH_LINENO=([0]="0") BASH_SOURCE=([0]="/bin/script") BASH_VERSINFO=([0]="3" [1]="2" [2]="25" [3]="1" [4]="release" [5]="x86_64-redhat-linux-gnu") BASH_VERSION='3.2.25(1)-release' DIRSTACK=() EUID=0 GROUPS=() HOSTNAME=server.test.ch HOSTTYPE=x86_64 IFS=$' \t\n' LANG=en_US.UTF-8 MACHTYPE=x86_64-redhat-linux-gnu OPTERR=1 OPTIND=1 OSTYPE=linux-gnu PATH=/sbin:/usr/sbin:/bin:/usr/bin PIPESTATUS=([0]="1") PPID=23723 PS4='+ ' PWD=/ SHELL=/bin/bash SHELLOPTS=braceexpand:hashall:interactive-comments SHLVL=2 TERM=xterm UID=0 _=/usr/sbin/sshd Expected results: PAM_USER and other env. variables should be defined and not empty
This request was evaluated by Red Hat Product Management for inclusion in the current release of Red Hat Enterprise Linux. Because the affected component is not scheduled to be updated in the current release, Red Hat is unfortunately unable to address this request at this time. Red Hat invites you to ask your support representative to propose this request, if appropriate and relevant, in the next release of Red Hat Enterprise Linux.
This request was erroneously denied for the current release of Red Hat Enterprise Linux. The error has been fixed and this request has been re-proposed for the current release.
Created attachment 489945 [details] proposed patch
Hello. I can confirm this patch is really fixing the issue. Can this patch be included in next RHEL version? Regards PetrR
Where can I find this patch? I need this functionality. Thanks, Jeremiah (In reply to comment #17) > Hello. > > I can confirm this patch is really fixing the issue. > > Can this patch be included in next RHEL version? > > Regards > > PetrR
(In reply to comment #22) > Where can I find this patch? I need this functionality. The patch is now publicly available and attached to this bug.
Thank you for submitting this issue for consideration in Red Hat Enterprise Linux. This request will be considered in a future release of Red Hat Enterprise Linux.
Comment on attachment 489945 [details] proposed patch The patch is missing the support for PAM_TYPE to be on parity with RHEL-6.
*** Bug 826797 has been marked as a duplicate of this bug. ***
Technical note added. If any revisions are required, please edit the "Technical Notes" field accordingly. All revisions will be proofread by the Engineering Content Services team. New Contents: This enhancement adds support for exporting environment variables from the PAM environment and in addition to that also environment variables containing common PAM item values to the script that is executed by the pam_exec module.
It seems that the quiet option does not work as expected. Scenario: session required pam_exec.so /bin/false su -l -c pwd test session required pam_exec.so quiet /bin/false su -l -c pwd test I see the same for both variants in /var/log/secure: Aug 2 08:46:30 dhcp-25-23 su: pam_unix(su-l:session): session opened for user test by (uid=0) Aug 2 08:46:30 dhcp-25-23 su: pam_exec(su-l:session): /bin/false failed: exit code 1
No, the quiet option does not affect the syslog messages, it affects the output that is echoed during the login to the user.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. http://rhn.redhat.com/errata/RHBA-2013-0032.html