Debian Bug report logs - #676527
auditd package shouldn't add pam_loginuid.so in common-session(-interactive)

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Laurent Bigonville <bigon@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: auditd package shouldn't add pam_loginuid.so in common-session(-interactive)

Date: Thu, 07 Jun 2012 17:20:28 +0200

Package: auditd
Version: 1:1.7.18-1.1
Severity: normal

Hi,

According to pam_loginuid manpage, the module should only be loaded in
"entry point applications", adding this to common-session and
common-session-interactive will cause the module to be also used in
no-login services (see #661745).

Auditd should rely on logins services doing their job and calling
pam_loginuid themself.

>From pam_loginuid(8):

 The pam_loginuid module sets the loginuid process attribute for the process
 that was authenticated. This is necessary for applications to be correctly
 audited. This PAM module should only be used for entry point applications
 like: login, sshd, gdm, vsftpd, crond and atd.
 There are probably other entry point applications besides these. You should not
 use it for applications like sudo or su as that defeats the purpose by changing
 the loginuid to the account they just switched to.

Cheers

Laurent Bigonville

-- System Information:
Debian Release: wheezy/sid
  APT prefers unstable
  APT policy: (500, 'unstable'), (1, 'experimental')
Architecture: amd64 (x86_64)

Kernel: Linux 3.2.0-2-amd64 (SMP w/4 CPU cores)
Locale: LANG=fr_BE.utf8, LC_CTYPE=fr_BE.utf8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash

Versions of packages auditd depends on:
ii  libaudit0         1:1.7.18-1.1
ii  libc6             2.13-33
ii  libgssapi-krb5-2  1.10.1+dfsg-1
ii  libkrb5-3         1.10.1+dfsg-1
ii  libpam-runtime    1.1.3-7.1
ii  libwrap0          7.6.q-23
ii  lsb-base          4.1+Debian6

auditd recommends no packages.

Versions of packages auditd suggests:
pn  audispd-plugins  <none>

-- no debconf information

Message #52 received at 676527-close@bugs.debian.org (full text, mbox, reply):

From: Laurent Bigonville <bigon@debian.org>

To: 676527-close@bugs.debian.org

Subject: Bug#676527: fixed in audit 1:2.2.1-2

Date: Wed, 14 Nov 2012 22:00:06 +0000

Source: audit
Source-Version: 1:2.2.1-2

We believe that the bug you reported is fixed in the latest version of
audit, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 676527@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Laurent Bigonville <bigon@debian.org> (supplier of updated audit package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Format: 1.8
Date: Mon, 12 Nov 2012 00:01:27 +0100
Source: audit
Binary: auditd libauparse0 libauparse-dev libaudit1 libaudit-common libaudit-dev python-audit audispd-plugins
Architecture: source amd64 all
Version: 1:2.2.1-2
Distribution: experimental
Urgency: low
Maintainer: Debian QA Group <packages@qa.debian.org>
Changed-By: Laurent Bigonville <bigon@debian.org>
Description: 
 audispd-plugins - Plugins for the audit event dispatcher
 auditd     - User space tools for security auditing
 libaudit-common - Dynamic library for security auditing - common files
 libaudit-dev - Header files and static library for security auditing
 libaudit1  - Dynamic library for security auditing
 libauparse-dev - Header files and static library for the libauparse0 library
 libauparse0 - Dynamic library for parsing security auditing
 python-audit - Python bindings for security auditing
Closes: 676527 682251 687121 688440
Changes: 
 audit (1:2.2.1-2) experimental; urgency=low
 .
   * QA upload.
   * Orphan audit package with maintainer approval
   * Split libauparse out of libaudit package and put /etc/libaudit.conf in its
     own package thanks to Alban Browaeys (Closes: #682251)
   * Drop useless debian/patches/rpath.diff and call to chrpath, call
     dh_autoreconf to be sure autofoo are up-to-date instead.
   * debian/auditd.install: Install auvirt executable, thanks to Guido Günther
     (Closes: #688440)
   * Convert to multiarch policy (Closes: #687121)
   * Add missing X-Python-Version header
   * Enable libcap-ng support
   * Let's dh_python2 take care of removing *.p[co] files
   * Drop pam-config stanza for loginuid, it's only intended to be called from
     entry point PAM services (Closes: #676527)
   * Drop debian/auditd.postinst: this was needed before squeeze release
   * Drop useless debian/patches/ld-no-add-needed.diff: libkrb5 is already
     properly passed at link time
   * Drop debian/patches/mode.diff: Upstream is now checking if the mode of the
     executable is either 0750 or 0755 and not only 0750
   * Drop several patches and files that were not used anymore but not dropped
     on disk
   * Refresh and reapply debian/patches/manpage-dash.diff
   * debian/control: Add Vcs-* fields
   * Add debian/gbp.conf file
   * Run wrap-and-sort script
   * Only attempt to build on linux-any architectures
Checksums-Sha1: 
 db2e6a3eededbffaf90e34379c2b1fa07eceffd7 1986 audit_2.2.1-2.dsc
 b4f5167b6455eeb81ab468a840c807946157f58c 12021 audit_2.2.1-2.debian.tar.gz
 4736b8560a2b2578b23994070b25ca9225cf2be6 271144 auditd_2.2.1-2_amd64.deb
 d49b306b5d760f57ea011e0d209de70595ac39a3 48802 libauparse0_2.2.1-2_amd64.deb
 96a4a9d688a7c3d3cec9770a1716200b48f79649 78348 libauparse-dev_2.2.1-2_amd64.deb
 9f56134f68956a5882b69f6a3f2385f2a40a60b0 54998 libaudit1_2.2.1-2_amd64.deb
 e0ac05c3f85521af4829f76269e48e1e8f879ed7 17200 libaudit-common_2.2.1-2_all.deb
 eb25036e06aae4fa3b1146511a5601f23546d44e 85966 libaudit-dev_2.2.1-2_amd64.deb
 29c0d82c45ea404509646f581f26fe989269f32b 134370 python-audit_2.2.1-2_amd64.deb
 80e979bec52dbc812748961f7d5c505e4cc6457e 80290 audispd-plugins_2.2.1-2_amd64.deb
Checksums-Sha256: 
 7907b7ab7a81bf659af4051101c916fa4b486dc48af7bbd8ddfdc66071cf4f89 1986 audit_2.2.1-2.dsc
 349b12189af09a852a40e30855093587fe74b1a40ccec5cdb799834c3a99f83f 12021 audit_2.2.1-2.debian.tar.gz
 32cf27f0bde6358e79aa43f80939c7e06807159de697b7db4b8d697c5a83caa2 271144 auditd_2.2.1-2_amd64.deb
 578ab5c89b57d87a0e9f17eb2e30a3f53f492d6a49e7b465491eec9f157fa7ed 48802 libauparse0_2.2.1-2_amd64.deb
 067dd84ef675ae1249da2f290d56e3be743e28af3188ff125e9b2f63cb83b9cc 78348 libauparse-dev_2.2.1-2_amd64.deb
 70d06f94340c6ea41265ad588cfb12e78b9b89f3507b817c42ecf66be13d1b96 54998 libaudit1_2.2.1-2_amd64.deb
 dc56d7b94e0aab7e2af26ee96bdd177c018bbc7e15c4ee59beeed5a9acdc42d8 17200 libaudit-common_2.2.1-2_all.deb
 ba395211d8c3f236aacdc63fdf810fad1cb9ba608462e4f045f86d786247a35a 85966 libaudit-dev_2.2.1-2_amd64.deb
 be2b993e1e1baf15896c1ca277bfa3d82d329a077fa38c0acc17a921568351de 134370 python-audit_2.2.1-2_amd64.deb
 7d77293c15ce4bb29004a10ba631dde3b9f213b94683461e09826299dec0a867 80290 audispd-plugins_2.2.1-2_amd64.deb
Files: 
 c39fff73041ae31b398776f6c63aeac3 1986 libs extra audit_2.2.1-2.dsc
 8f822324c2ca470d8ca6e6881dcf9222 12021 libs extra audit_2.2.1-2.debian.tar.gz
 69c7a6a753da02b5431fb4d7ea341803 271144 admin extra auditd_2.2.1-2_amd64.deb
 ede1ea5bc939210e4049ea7b71380ebc 48802 libs optional libauparse0_2.2.1-2_amd64.deb
 68c8150766d31b8b6dcdd197ca3721d3 78348 libdevel extra libauparse-dev_2.2.1-2_amd64.deb
 09f6484737757d2086ba350754b06269 54998 libs optional libaudit1_2.2.1-2_amd64.deb
 ee3436bec8a7d261a84f4e67627a6b81 17200 libs optional libaudit-common_2.2.1-2_all.deb
 ac087d475888a3661e62b580b3a67e3b 85966 libdevel extra libaudit-dev_2.2.1-2_amd64.deb
 3c1f6c6fe49384d1e357b1616900f38a 134370 python extra python-audit_2.2.1-2_amd64.deb
 bcd45b3d1935bef49bf386dda51a8370 80290 admin extra audispd-plugins_2.2.1-2_amd64.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iQEcBAEBCAAGBQJQoC8KAAoJEB/FiR66sEPVrZkH/jApjWLwf0uCxjVWWmKny8HC
5UjozIBLIYW563jjkZggVcRepIHDR88LFvDvfg/JZY4k7kymFEq50ENg+v5MzxXt
4PdyVfh3BtknpVijf0KeSEOhTOYXNKvkfov7qwi1MlOuFbiGrQ/RnQNJ5TMrblQ/
SS3YN9xwW2oZoyMH/hMmV11TOJTIG75KFqwuPr+6F5Hg4DcMxo5egS8tFinARV6x
C/b4IMmQn5T/0JhsNXyghQpia1GjtkJCYeMj1Nt5drQpDMc11ObUIal85/WxEUtf
lKG0df5HnzFLInGTr131smCrO56C9HvuXaECxHfqwY0OVMSITmPXMl2x/lkISQU=
=cCqm
-----END PGP SIGNATURE-----

Send a report that this bug log contains spam.