libpam: add system-auth in case of systemd
cover libpam: add system-auth in case of systemd
The following changes since commit 4143f3b0ce0d0c52f5b0babc1bb16ac0ac9610eb:
nativesdk-cmake: Adjust toolchain paths dynamically (2014-10-24 21:59:34 +0100)
are available in the git repository at:
git://git.openembedded.org/openembedded-core-contrib ChenQi/libpam-systemd
http://cgit.openembedded.org/cgit.cgi/openembedded-core-contrib/log/?h=ChenQi/libpam-systemd
Chen Qi (1):
libpam: add system-auth in case of systemd
meta/recipes-extended/pam/libpam/pam.d/system-auth | 12 ++++++++++++ meta/recipes-extended/pam/libpam_1.1.6.bb | 1 + 2 files changed, 13 insertions(+) create mode 100644 meta/recipes-extended/pam/libpam/pam.d/system-auth
Signature · 1 line
1.9.1
PATCH 1/1 libpam: add system-auth in case of systemd
systemd needs this file to be there because one of its configuration file in pam.d, systemd-user, requires it. Otherwise, we would have errors like below.
systemd: PAM _pam_load_conf_file: unable to open /etc/pam.d/system-auth
--- meta/recipes-extended/pam/libpam/pam.d/system-auth | 12 ++++++++++++ meta/recipes-extended/pam/libpam_1.1.6.bb | 1 + 2 files changed, 13 insertions(+) create mode 100644 meta/recipes-extended/pam/libpam/pam.d/system-auth
meta/recipes-extended/pam/libpam/pam.d/system-auth new file +12 -0
@@ -0,0 +1,12 @@ +# This file comes from systemd. + +auth sufficient pam_unix.so nullok try_first_pass + +account required pam_nologin.so +account sufficient pam_unix.so + +password sufficient pam_unix.so nullok sha512 shadow try_first_pass try_authtok + +-session optional pam_loginuid.so +-session optional pam_systemd.so +session sufficient pam_unix.so
meta/recipes-extended/pam/libpam_1.1.6.bb +1 -0
@@ -17,6 +17,7 @@ SRC_URI = "http://linux-pam.org/library/Linux-PAM-${PV}.tar.bz2 \ file://pam.d/common-session \ file://pam.d/common-session-noninteractive \ file://pam.d/other \ + ${@bb.utils.contains('DISTRO_FEATURES', 'systemd', 'file://pam.d/system-auth', '', d)} \ file://libpam-xtests.patch \ file://destdirfix.patch \ file://fixsepbuild.patch \
Signature · 1 line
1.9.1
Quoted 8 lines
Op 30 okt. 2014, om 10:08 heeft Chen Qi <[email protected]> het volgende geschreven:
systemd needs this file to be there because one of its configuration file in pam.d, systemd-user, requires it. Otherwise, we would have errors like below.
systemd: PAM
_pam_load_conf_file: unable to open/etc/pam.d/system-auth
Isn't it the same as 'common-auth'? ISTR this is due to debian vs fedora naming of PAM stuff. I think it would make more sense to check what systemd actually wants and then see if a symlink to common-auth or patching systemd to use common-auth is the right answer instead of blindly adding system-auth.
regards,
Koen
Quoted 47 lines
Signed-off-by Chen Qi <[email protected]>---
meta/recipes-extended/pam/libpam/pam.d/system-auth | 12 ++++++++++++
meta/recipes-extended/pam/libpam_1.1.6.bb | 1 +2 files changed, 13 insertions(+)create mode 100644 meta/recipes-extended/pam/libpam/pam.d/system-auth
meta/recipes-extended/pam/libpam/pam.d/system-auth new file +12
-0@@ -0,0 +1,12 @@ +# This file comes from systemd. + +auth sufficient pam_unix.so nullok try_first_pass + +account required pam_nologin.so +account sufficient pam_unix.so + +password sufficient pam_unix.so nullok sha512 shadow try_first_pass try_authtok + +-session optional pam_loginuid.so +-session optional pam_systemd.so +session sufficient pam_unix.someta/recipes-extended/pam/libpam_1.1.6.bb +1
-0@@ -17,6 +17,7 @@ SRC_URI = "http://linux-pam.org/library/Linux-PAM-${PV}.tar.bz2 \ file://pam.d/common-session \ file://pam.d/common-session-noninteractive \ file://pam.d/other \ + ${@bb.utils.contains('DISTRO_FEATURES', 'systemd', 'file://pam.d/system-auth', '', d)} \ file://libpam-xtests.patch \ file://destdirfix.patch \ file://fixsepbuild.patch \Signature · 7 lines
1.9.1 -- _______________________________________________ Openembedded-core mailing list [email protected] http://lists.openembedded.org/mailman/listinfo/openembedded-core
Quoted 6 lines · Koen Kooi
Quoted 6 lines
Op 30 okt. 2014, om 10:08 heeft Chen Qi <[email protected]> het volgende geschreven:
systemd needs this file to be there because one of its configuration file in pam.d, systemd-user, requires it. Otherwise, we would have errors like below.
Quoted 7 lines
Quoted 1 line
systemd: PAM
_pam_load_conf_file: unable to open/etc/pam.d/system-authIsn't it the same as 'common-auth'? ISTR this is due to debian vs fedora naming of PAM stuff. I think it would make more sense to check what systemd actually wants and then see if a symlink to common-auth or patching systemd to use common-auth is the right answer instead of blindly adding system-auth.
regards,
Koen
Hi Koen,
An alternative is to patch systemd's source code to change the systemd-user configuration file.
In fact, I have seen patches in OE whose purpose is merely changing 'system-auth' to 'common-auth' in the pam configuration files of the packages.
So we have two options here:
1. Provide system-auth
2. Patch packages that make use of system-auth and maintain those patches.
I think solution 1 is more reasonable but if you and other people in community think that solution 2 can bring us more benefits, I can send out a patch using solution 2.
Best Regards,
Chen Qi
Quoted 47 lines
Quoted 46 lines
Signed-off-by Chen Qi <[email protected]>---
meta/recipes-extended/pam/libpam/pam.d/system-auth | 12 ++++++++++++
meta/recipes-extended/pam/libpam_1.1.6.bb | 1 +2 files changed, 13 insertions(+)create mode 100644 meta/recipes-extended/pam/libpam/pam.d/system-auth
meta/recipes-extended/pam/libpam/pam.d/system-auth new file +12
-0@@ -0,0 +1,12 @@ +# This file comes from systemd. + +auth sufficient pam_unix.so nullok try_first_pass + +account required pam_nologin.so +account sufficient pam_unix.so + +password sufficient pam_unix.so nullok sha512 shadow try_first_pass try_authtok + +-session optional pam_loginuid.so +-session optional pam_systemd.so +session sufficient pam_unix.someta/recipes-extended/pam/libpam_1.1.6.bb +1
-0@@ -17,6 +17,7 @@ SRC_URI = "http://linux-pam.org/library/Linux-PAM-${PV}.tar.bz2 \ file://pam.d/common-session \ file://pam.d/common-session-noninteractive \ file://pam.d/other \ + ${@bb.utils.contains('DISTRO_FEATURES', 'systemd', 'file://pam.d/system-auth', '', d)} \ file://libpam-xtests.patch \ file://destdirfix.patch \ file://fixsepbuild.patch \Signature · 7 lines
1.9.1 -- _______________________________________________ Openembedded-core mailing list [email protected] http://lists.openembedded.org/mailman/listinfo/openembedded-core
Quoted 13 lines · ChenQi
Quoted 12 lines · Koen Kooi
Quoted 8 lines
Op 30 okt. 2014, om 10:08 heeft Chen Qi <[email protected]> het volgende geschreven:
systemd needs this file to be there because one of its configuration file in pam.d, systemd-user, requires it. Otherwise, we would have errors like below.
systemd: PAM
_pam_load_conf_file: unable to open/etc/pam.d/system-authIsn't it the same as 'common-auth'? ISTR this is due to debian vs fedora naming of PAM stuff. I think it would make more sense to check what systemd actually wants and then see if a symlink to common-auth or patching systemd to use common-auth is the right answer instead of blindly adding system-auth.
regards,
Quoted 8 lines
Quoted 2 lines
Koen
Hi Koen,
An alternative is to patch systemd's source code to change the systemd-user configuration file.
In fact, I have seen patches in OE whose purpose is merely changing 'system-auth' to 'common-auth' in the pam configuration files of the packages.
It might be 'common-passwd', 'common-session', not just 'common-auth'. You can see this from the contents of system-auth file.
Quoted 61 lines
So we have two options here:
1. Provide system-auth
2. Patch packages that make use of system-auth and maintain those patches.I think solution 1 is more reasonable but if you and other people in community think that solution 2 can bring us more benefits, I can send out a patch using solution 2.
Best Regards,
Chen QiQuoted 50 lines
Quoted 49 lines
Signed-off-by Chen Qi <[email protected]>---
meta/recipes-extended/pam/libpam/pam.d/system-auth | 12 ++++++++++++
meta/recipes-extended/pam/libpam_1.1.6.bb | 1 +2 files changed, 13 insertions(+)create mode 100644 meta/recipes-extended/pam/libpam/pam.d/system-auth
meta/recipes-extended/pam/libpam/pam.d/system-auth new file +8
-0@@ -0,0 +1,12 @@ +# This file comes from systemd. + +auth sufficient pam_unix.so nullok try_first_pass + +account required pam_nologin.so +account sufficient pam_unix.so + +password sufficient pam_unix.so nullok sha512 shadow try_first_pass
try_authtokmeta/recipes-extended/pam/libpam/pam.d/system-auth new file +4
-0+ +-session optional pam_loginuid.so +-session optional pam_systemd.so +session sufficient pam_unix.someta/recipes-extended/pam/libpam_1.1.6.bb +1
-0@@ -17,6 +17,7 @@ SRC_URI = "http://linux-pam.org/library/Linux-PAM-${PV}.tar.bz2 \ file://pam.d/common-session \ file://pam.d/common-session-noninteractive \ file://pam.d/other \ + ${@bb.utils.contains('DISTRO_FEATURES', 'systemd', 'file://pam.d/system-auth', '', d)} \ file://libpam-xtests.patch \file://destdirfix.patch \ file://fixsepbuild.patch \Signature · 7 lines
1.9.1 -- _______________________________________________ Openembedded-core mailing list [email protected] http://lists.openembedded.org/mailman/listinfo/openembedded-core
Quoted 22 lines
Op 31 okt. 2014, om 03:59 heeft ChenQi <[email protected]> het volgende geschreven:
Quoted 6 lines · Koen Kooi
Quoted 6 lines
Op 30 okt. 2014, om 10:08 heeft Chen Qi <[email protected]> het volgende geschreven:
systemd needs this file to be there because one of its configuration file in pam.d, systemd-user, requires it. Otherwise, we would have errors like below.
Quoted 7 lines
Quoted 1 line
systemd: PAM
_pam_load_conf_file: unable to open/etc/pam.d/system-authIsn't it the same as 'common-auth'? ISTR this is due to debian vs fedora naming of PAM stuff. I think it would make more sense to check what systemd actually wants and then see if a symlink to common-auth or patching systemd to use common-auth is the right answer instead of blindly adding system-auth.
regards,
Koen
Hi Koen,
An alternative is to patch systemd's source code to change the systemd-user configuration file.
Quoted 7 lines
In fact, I have seen patches in OE whose purpose is merely changing 'system-auth' to 'common-auth' in the pam configuration files of the packages.
So we have two options here:
1. Provide system-auth
2. Patch packages that make use of system-auth and maintain those patches.I think solution 1 is more reasonable but if you and other people in community think that solution 2 can bring us more benefits, I can send out a patch using solution 2.
Solution 1) introduces a new PAM file that seems to do the same as one of the common-<foo> files we have. So from a reuse and maintainability standpoint 2) would be better.
regards,
Koen
Quoted 53 lines
Best Regards,
Chen QiQuoted 47 lines
Quoted 46 lines
Signed-off-by Chen Qi <[email protected]>---
meta/recipes-extended/pam/libpam/pam.d/system-auth | 12 ++++++++++++
meta/recipes-extended/pam/libpam_1.1.6.bb | 1 +2 files changed, 13 insertions(+)create mode 100644 meta/recipes-extended/pam/libpam/pam.d/system-auth
meta/recipes-extended/pam/libpam/pam.d/system-auth new file +12
-0@@ -0,0 +1,12 @@ +# This file comes from systemd. + +auth sufficient pam_unix.so nullok try_first_pass + +account required pam_nologin.so +account sufficient pam_unix.so + +password sufficient pam_unix.so nullok sha512 shadow try_first_pass try_authtok + +-session optional pam_loginuid.so +-session optional pam_systemd.so +session sufficient pam_unix.someta/recipes-extended/pam/libpam_1.1.6.bb +1
-0@@ -17,6 +17,7 @@ SRC_URI = "http://linux-pam.org/library/Linux-PAM-${PV}.tar.bz2 \ file://pam.d/common-session \ file://pam.d/common-session-noninteractive \ file://pam.d/other \ + ${@bb.utils.contains('DISTRO_FEATURES', 'systemd', 'file://pam.d/system-auth', '', d)} \ file://libpam-xtests.patch \ file://destdirfix.patch \ file://fixsepbuild.patch \Signature · 7 lines
1.9.1 -- _______________________________________________ Openembedded-core mailing list [email protected] http://lists.openembedded.org/mailman/listinfo/openembedded-core
Quoted 26 lines · Koen Kooi
Quoted 26 lines
Op 31 okt. 2014, om 03:59 heeft ChenQi <[email protected]> het volgende geschreven:
Quoted 6 lines · Koen Kooi
Quoted 6 lines
Op 30 okt. 2014, om 10:08 heeft Chen Qi <[email protected]> het volgende geschreven:
systemd needs this file to be there because one of its configuration file in pam.d, systemd-user, requires it. Otherwise, we would have errors like below.
Quoted 7 lines
Quoted 1 line
systemd: PAM
_pam_load_conf_file: unable to open/etc/pam.d/system-authIsn't it the same as 'common-auth'? ISTR this is due to debian vs fedora naming of PAM stuff. I think it would make more sense to check what systemd actually wants and then see if a symlink to common-auth or patching systemd to use common-auth is the right answer instead of blindly adding system-auth.
regards,
Koen
Hi Koen,
An alternative is to patch systemd's source code to change the systemd-user configuration file.
In fact, I have seen patches in OE whose purpose is merely changing 'system-auth' to 'common-auth' in the pam configuration files of the packages.
So we have two options here:
1. Provide system-auth
2. Patch packages that make use of system-auth and maintain those patches.
Quoted 7 lines
Quoted 1 line
I think solution 1 is more reasonable but if you and other people in community think that solution 2 can bring us more benefits, I can send out a patch using solution 2.
Solution 1) introduces a new PAM file that seems to do the same as one of the common-<foo> files we have. So from a reuse and maintainability standpoint 2) would be better.
regards,
Koen
Hi Koen,
I've sent out a new patch.
[OE-core] [PATCH 0/1] systemd: avoid using system-auth
Best Regards,
Chen Qi
Quoted 52 lines
Quoted 51 lines
Best Regards,
Chen QiQuoted 46 lines
Quoted 46 lines
Signed-off-by Chen Qi <[email protected]>---
meta/recipes-extended/pam/libpam/pam.d/system-auth | 12 ++++++++++++
meta/recipes-extended/pam/libpam_1.1.6.bb | 1 +2 files changed, 13 insertions(+)create mode 100644 meta/recipes-extended/pam/libpam/pam.d/system-auth
meta/recipes-extended/pam/libpam/pam.d/system-auth new file +12
-0@@ -0,0 +1,12 @@ +# This file comes from systemd. + +auth sufficient pam_unix.so nullok try_first_pass + +account required pam_nologin.so +account sufficient pam_unix.so + +password sufficient pam_unix.so nullok sha512 shadow try_first_pass try_authtok + +-session optional pam_loginuid.so +-session optional pam_systemd.so +session sufficient pam_unix.someta/recipes-extended/pam/libpam_1.1.6.bb +1
-0@@ -17,6 +17,7 @@ SRC_URI = "http://linux-pam.org/library/Linux-PAM-${PV}.tar.bz2 \ file://pam.d/common-session \ file://pam.d/common-session-noninteractive \ file://pam.d/other \ + ${@bb.utils.contains('DISTRO_FEATURES', 'systemd', 'file://pam.d/system-auth', '', d)} \ file://libpam-xtests.patch \ file://destdirfix.patch \ file://fixsepbuild.patch \Signature · 7 lines
1.9.1 -- _______________________________________________ Openembedded-core mailing list [email protected] http://lists.openembedded.org/mailman/listinfo/openembedded-core