Devuan bug report logs - #805
openrc: supervise-daemon: missing PAM configuration

Package: openrc; Severity: grave; Reported by: meow <[email protected]>; Keywords: patch; dated Thu, 23 Nov 2023 00:02:01 UTC; Maintainer for openrc is (unknown).

Message received at [email protected]:

Received-SPF: Pass (mailfrom) identity=mailfrom; client-ip=2a00:1450:4864:20::443; helo=mail-wr1-x443.google.com; [email protected]; receiver=<UNKNOWN> 
Date: Thu, 30 Nov 2023 09:19:51 +0000
From: meow <[email protected]>
To: Mark Hindley <[email protected]>
CC: [email protected]
Subject: Re: bug#805: openrc: supervise-daemon: missing PAM configuration
In-Reply-To: <[email protected]>
References: <[email protected]> <[email protected]> <[email protected]> <[email protected]> <[email protected]> <ZWL6ZnDmsDw/[email protected]> <[email protected]> <[email protected]>
Message-ID: <[email protected]>
MIME-Version: 1.0
Content-Type: multipart/alternative;
 boundary=----4PYC1R8B93Q5LY51VHZPXU32JC5TDA
Content-Transfer-Encoding: 7bit

------4PYC1R8B93Q5LY51VHZPXU32JC5TDA
Content-Type: text/plain;
 charset=utf-8
Content-Transfer-Encoding: quoted-printable

i reply to:

"
Hi,

On Sat, Nov 25, 2023 at 06:48:42AM +0000, meow wrote:

Yes, you=E2=80=99re right, it should be included in the configuration file=
=2E
/etc/pam=2Ed/supervise-daemon:
#%PAM-1=2E0
auth required pam_permit=2Eso
account required pam_permit=2Eso
password required pam_deny=2Eso
session optional pam_limits=2Eso
@include common-account
@include common-session-nointeractive
use 'common-*' incorrectly=2E we only need common-account and
common-session-nointetactive=2E


This is different to what I suggested=2E

I think

auth required pam_permit=2Eso
account required pam_permit=2Eso


Should be *replaced* by

@include common-auth
@include common-account

And

session optional pam_limits=2Eso


should be after

@include common-session-nointetactive

That makes the whole config

#%PAM-1=2E0
password required pam_deny=2Eso
@include common-account
@include common-account
@include common-session-nointeractive
session optional pam_limits=2Eso

Is that better?

If you have improvements, please provide the reasoning as well=2E

Thanks

Mark "



On November 29, 2023 5:39:27 PM UTC, Mark Hindley <mark@hindley=2Eorg=2Euk=
> wrote:
>On Wed, Nov 29, 2023 at 12:07:57AM +0000, meow wrote:
>>    No, there are nuances=2E for example, the PAM access module=2E
>>    if you turn it on, supervise-daemon stops working correctly=2E
>
>Please don't top post=2E
>
>I don't understand what you are answering here=2E
>
>Sorry=2E
>
>Mark
>

------4PYC1R8B93Q5LY51VHZPXU32JC5TDA
Content-Type: text/html;
 charset=utf-8
Content-Transfer-Encoding: quoted-printable

<html><head></head><body><div dir=3D"auto">i reply to:<br><br>"<br>Hi,<br><=
br>On Sat, Nov 25, 2023 at 06:48:42AM +0000, meow wrote:<br><br>Yes, you=E2=
=80=99re right, it should be included in the configuration file=2E<br>/etc/=
pam=2Ed/supervise-daemon:<br>#%PAM-1=2E0<br>auth required pam_permit=2Eso<b=
r>account required pam_permit=2Eso<br>password required pam_deny=2Eso<br>se=
ssion optional pam_limits=2Eso<br>@include common-account<br>@include commo=
n-session-nointeractive<br>use 'common-*' incorrectly=2E we only need commo=
n-account and<br>common-session-nointetactive=2E<br><br><br>This is differe=
nt to what I suggested=2E<br><br>I think<br><br>auth required pam_permit=2E=
so<br>account required pam_permit=2Eso<br><br><br>Should be *replaced* by<b=
r><br>@include common-auth<br>@include common-account<br><br>And<br><br>ses=
sion optional pam_limits=2Eso<br><br><br>should be after<br><br>@include co=
mmon-session-nointetactive<br><br>That makes the whole config<br><br>#%PAM-=
1=2E0<br>password required pam_deny=2Eso<br>@include common-account<br>@inc=
lude common-account<br>@include common-session-nointeractive<br>session opt=
ional pam_limits=2Eso<br><br>Is that better?<br><br>If you have improvement=
s, please provide the reasoning as well=2E<br><br>Thanks<br><br>Mark "<br><=
br></div><br><br><div class=3D"gmail_quote"><div dir=3D"auto">On November 2=
9, 2023 5:39:27 PM UTC, Mark Hindley &lt;mark@hindley=2Eorg=2Euk&gt; wrote:=
</div><blockquote class=3D"gmail_quote" style=3D"margin: 0pt 0pt 0pt 0=2E8e=
x; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">
<pre class=3D"k9mail"><div dir=3D"auto">On Wed, Nov 29, 2023 at 12:07:57AM=
 +0000, meow wrote:<br></div><blockquote class=3D"gmail_quote" style=3D"mar=
gin: 0pt 0pt 1ex 0=2E8ex; border-left: 1px solid #729fcf; padding-left: 1ex=
;"><div dir=3D"auto">No, there are nuances=2E for example, the PAM access m=
odule=2E<br>if you turn it on, supervise-daemon stops working correctly=2E<=
br></div></blockquote><div dir=3D"auto"><br>Please don't top post=2E<br><br=
>I don't understand what you are answering here=2E<br><br>Sorry=2E<br><br>M=
ark<br><br></div></pre></blockquote></div></body></html>
------4PYC1R8B93Q5LY51VHZPXU32JC5TDA--

Acknowledgement sent to meow <[email protected]>:
Extra info received and forwarded to list. Copy sent to [email protected]. Full text available.