tag 734671 + patch
thanks
On Tue, 10 Jan 2017 09:19:21 +0100 Laurent Bigonville <[email protected]>
wrote:
>
> What is the status of this?
>
> Could this be implemented for stretch? The number of "login" pam
> services is quite limited IMHO (xDM, login, openssh,...) so I'm not sure
> that waiting for pam-auth-update support for these (#677288) is really
> needed, for example we have added pam_selinux modules already in all
> these login services.
>
> openssh and gdm are already calling the pam_keyinit.so module for quite
> sometimes now without any visible complains.
Please see my attached patch
Cheers,
Laurent Bigonville
>From 69c24554b0448585726270ae30aa356e53ba8422 Mon Sep 17 00:00:00 2001
From: Laurent Bigonville <[email protected]>
Date: Tue, 10 Jan 2017 10:40:16 +0100
Subject: [PATCH] Add call to pam_keyinit for login pam service
This module is linux-any only, so copy what openssh has already done and
remove the call at build time for other architectures.
The call to this module is needed to have proper per-session kernel
keyring.
Closes: #734671
---
debian/{login.pam => login.pam.in} | 3 +++
debian/rules | 8 ++++++++
2 files changed, 11 insertions(+)
rename debian/{login.pam => login.pam.in} (97%)
diff --git a/debian/login.pam b/debian/login.pam.in
similarity index 97%
rename from debian/login.pam
rename to debian/login.pam.in
index b165d02..117fa96 100644
--- a/debian/login.pam
+++ b/debian/login.pam.in
@@ -98,6 +98,9 @@ session optional pam_mail.so standard
# Sets the loginuid process attribute
session required pam_loginuid.so
+@IF_KEYINIT@# Create a new session keyring.
+@IF_KEYINIT@session optional pam_keyinit.so force revoke
+
# Standard Un*x account and session
@include common-account
@include common-session
diff --git a/debian/rules b/debian/rules
index f170a74..197fa68 100755
--- a/debian/rules
+++ b/debian/rules
@@ -35,6 +35,11 @@ ifeq ($(DEB_HOST_ARCH_OS),hurd)
# /bin/login is provided by the hurd package.
rm -f debian/login/bin/login
endif
+ifeq ($(DEB_HOST_ARCH_OS),linux)
+ sed 's/^@IF_KEYINIT@//' debian/login.pam.in > debian/login.pam
+else
+ sed '/^@IF_KEYINIT@/d' debian/login.pam.in > debian/login.pam
+endif
dh_installpam -p login
dh_installpam -p login --name=su
install -c -m 444 debian/login.defs debian/login/etc/login.defs
@@ -79,3 +84,6 @@ binary-predeb/passwd::
chgrp shadow debian/passwd/usr/bin/expiry
chmod g+s debian/passwd/usr/bin/chage
chmod g+s debian/passwd/usr/bin/expiry
+
+clean::
+ rm -f debian/login.pam
--
2.11.0
