Re: Why doesn't Debian use GNU su?
>>>>> "Ben" == Ben Collins <bcollins@debian.org> writes:
Ben> Where do you get that shadow's su does not use PAM session
Ben> management? Stop spreading bogus information.
It does use some PAM session management but not all of it. You've done
a good job patching shadow's su, but it's not finished. :) I'm sorry
if I sounded antagonistic, I didn't mean that at all.
I've gone through the source code to shadow's su, and while it *DOES*
call pam_start() and pam_end(), it fails to call pam_open_session()
and pam_close_session().
In fact, within the shadow suite, only login.c seems to call
pam_open_session and pam_close_session.
Because shadow's su merely execvs its shell instead of forking it off,
pam_open_session() and pam_close_session() don't make much sense --
unless we patch it to fork instead of execv.
GNU su actually also execvs by default, but Red Hat has patched it
quite well to use fork instead, and wrap the su'd shell in
pam_open_session() and pam_close_session() calls.
If you're interested in looking at the Red Hat-patched GNU su, I've
put it up at:
http://csl.cse.ucsc.edu/~ben/sh-utils/sh-utils-2.0/src/su.c
To see the PAM patch that Red Hat used, check out:
http://csl.cse.ucsc.edu/~ben/sh-utils/PATCHES/sh-utils-2.0-pam.patch
Ben
--
Brought to you by the letters Q and O and the number 12.
"Hoosh is a kind of soup."
Debian GNU/Linux maintainer of Gimp and GTK+ -- http://www.debian.org/
Reply to: