Debian Bug report logs - #68621
sysvinit: Add PAM support

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Topi Miettinen <Topi.Miettinen@nic.fi>

To: submit@bugs.debian.org

Subject: sysvinit: PAM support [PATCH]

Date: Sat, 05 Aug 2000 21:49:51 +0300

Package: sysvinit
Version: 2.78-4
Severity: wishlist

This patch (adapted from login) adds PAM support to init. At least Trusted
Solaris's init is probably doing similar things, according to manual page.

Unfortunately init doesn't wait for all children, so the final call to
pam_end() is missing.

-Topi

diff -ru src/Makefile.orig src/Makefile
--- src/Makefile.orig	Sat Nov 13 21:06:45 1999
+++ src/Makefile	Thu Jul 20 00:54:59 2000
@@ -34,7 +34,7 @@
 all:		$(PROGS)
 
 init:		init.o init_utmp.o
-		$(CC) $(LDFLAGS) $(STATIC) -o $@ init.o init_utmp.o
+		$(CC) $(LDFLAGS) $(STATIC) -o $@ init.o init_utmp.o -lpam
 
 halt:		halt.o ifdown.o utmp.o reboot.h
 		$(CC) $(LDFLAGS) -o $@ halt.o ifdown.o utmp.o
@@ -64,7 +64,7 @@
 		$(CC) $(LDFLAGS) -o $@ bootlogd.o
 
 init.o:		init.c init.h set.h reboot.h
-		$(CC) -c $(CFLAGS) init.c
+		$(CC) -c $(CFLAGS) init.c -DUSE_PAM
 
 utmp.o:		utmp.c init.h
 		$(CC) -c $(CFLAGS) utmp.c
diff -ru src/init.c.orig src/init.c
--- src/init.c.orig	Wed Jul 19 23:48:31 2000
+++ src/init.c	Sat Aug  5 12:36:32 2000
@@ -61,6 +61,10 @@
 #  endif
 #endif
 
+#ifdef USE_PAM
+#	include <security/pam_appl.h>
+#endif
+
 #include "init.h"
 #include "initreq.h"
 #include "paths.h"
@@ -188,6 +192,21 @@
 	{NULL,0}
 };
 
+#ifdef USE_PAM
+static pam_handle_t *pamh = NULL;
+
+static const struct pam_conv conv = {
+	NULL
+};
+
+#define PAM_FAIL_CHECK if (retcode != PAM_SUCCESS) { \
+	log(L_VB, "%s",pam_strerror(pamh, retcode)); \
+	pam_end(pamh, retcode); \
+	return -1; \
+	}
+#endif /* USE_PAM */
+
+
 /*
  *	Sleep a number of seconds.
  *
@@ -791,6 +810,9 @@
   pid_t pid, pgrp;		/* child, console process group. */
   sigset_t nmask, omask;	/* For blocking SIGCHLD */
   struct sigaction sa;
+#ifdef USE_PAM
+  int retcode;
+#endif
 
   *res = -1;
   buf[sizeof(buf) - 1] = 0;
@@ -907,6 +929,18 @@
 		putenv(i_prev);
 		putenv(i_cons);
 		putenv(E_VERSION);
+#ifdef USE_PAM
+		retcode = pam_start("init", "root" , &conv, &pamh);
+		PAM_FAIL_CHECK;
+		retcode = pam_set_item(pamh, PAM_TTY, console_dev);
+		PAM_FAIL_CHECK;
+		retcode = pam_acct_mgmt(pamh, PAM_SILENT);
+		PAM_FAIL_CHECK;
+		retcode = pam_open_session(pamh, PAM_SILENT);
+		PAM_FAIL_CHECK;
+		retcode = pam_setcred(pamh, PAM_ESTABLISH_CRED | PAM_SILENT);
+		PAM_FAIL_CHECK;
+#endif
 
 		/*
 		 *	In sysinit, boot, bootwait or single user mode:

Message #14 received at 68621@bugs.debian.org (full text, mbox, reply):

From: Petter Reinholdtsen <pere@hungry.com>

To: 68621-submitter@bugs.debian.org, 68621@bugs.debian.org

Subject: Re: sysvinit: Add PAM support

Date: Sat, 03 Sep 2005 02:00:17 +0200

[Topi Miettinen]
> This patch (adapted from login) adds PAM support to init. At least
> Trusted Solaris's init is probably doing similar things, according
> to manual page.

Can you or anyone else explain why this is useful, for those of us not
understanding this intuitively?

The patch look OK, but I do not understand what problem it is trying
to solve.

Message #24 received at 68621@bugs.debian.org (full text, mbox, reply):

From: "Vladimir Velychko" <vvelychko@gmail.com>

To: 68621@bugs.debian.org

Subject: PAM support for sulogin (was: Re: sysvinit: Add PAM support)

Date: Wed, 20 Dec 2006 02:31:04 +0200

>[Topi Miettinen]
>> This patch (adapted from login) adds PAM support to init. At least
>> Trusted Solaris's init is probably doing similar things, according
>> to manual page.
>
>Can you or anyone else explain why this is useful, for those of us not
>understanding this intuitively?
>
>The patch look OK, but I do not understand what problem it is trying
>to solve.
I don't know about init, but without PAM support no one can do /sbin/sulogin
(going to single user mode) in case (for example) pam_unix2.so enabled
(package libpam-unix2) and root password encrypted with blowfish hash.
BTW I already have this problem. :-(
-- 
VEL-[RIPE|UANIC]

Message #29 received at 68621@bugs.debian.org (full text, mbox, reply):

From: Petter Reinholdtsen <pere@hungry.com>

To: 68621@bugs.debian.org

Subject: PAM support for sulogin (was: Re: sysvinit: Add PAM support)

Date: Fri, 10 Jul 2009 13:53:33 +0200

tag 68621 - wontfix
thanks

We got a rationale, and it make sense to me.  I guess we should
implement this, after giving it a bit of testing.

Message #40 received at 68621@bugs.debian.org (full text, mbox, reply):

From: Jesse Smith <jsmith@resonatingmedia.com>

To: 68621@bugs.debian.org

Subject: Patch no longer compiles

Date: Mon, 29 Oct 2018 15:07:25 -0300

I like the idea of this patch and am on board with using this functionality.

However, I tried to apply it and, after working around some changes in
our Makefile, I found that the parts of the code that set up PAM do not
compile anymore. Specifically the calls to "PAM_FAIL_CHECK" will not
compile because they expand to call a function called "log" which
conflicts with the math.h log() function.

If someone updates the patch and re-submits I'll be happy to apply this
upstream.

Jesse (upstream dev)

Message #45 received at 68621-done@bugs.debian.org (full text, mbox, reply):

From: Dmitry Bogatov <KAction@debian.org>

To: jsmith@resonatingmedia.com

Cc: 68621-done@bugs.debian.org, 68621-submitter@bugs.debian.org

Subject: Re: Patch no longer compiles (was: add PAM to sysvinit)

Date: Tue, 14 May 2019 09:41:13 +0000

control: tags -1 -patch

[2018-10-29 15:07] Jesse Smith <jsmith@resonatingmedia.com>
> I like the idea of this patch and am on board with using this functionality.
>
> However, I tried to apply it and, after working around some changes in
> our Makefile, I found that the parts of the code that set up PAM do not
> compile anymore. Specifically the calls to "PAM_FAIL_CHECK" will not
> compile because they expand to call a function called "log" which
> conflicts with the math.h log() function.
>
> If someone updates the patch and re-submits I'll be happy to apply this
> upstream.

Closing bug on timeout -- it is 18 years old, original submitter did not
show up for half a year already. Feel free to re-open should patch
appear.

Oh, and by the way, I think PAM is bad thing, and we do not need to
bring more of it into Debian.
-- 
        Note, that I send and fetch email in batch, once every 24 hours.
                 If matter is urgent, try https://t.me/kaction
                                                                             --

Send a report that this bug log contains spam.