[gentoo-dev] PAM related: pam_console ?

[gentoo-dev] PAM related: pam_console ?

[Diego "Flameeyes" Pettenò]

[-- Attachment #1: Type: text/plain, Size: 1014 bytes --]

Seems like pam_console modules is broken. I'm not able to make it compile both 
as a standalone ebuild i'm trying to write and as the complete pam with 
+pam_console flag.

Anyway I was wondering what pam_console is used for, at the end. It's a way to 
set up permissions when someone logins at a console. I would never use 
something like that on a remote server, as anyone which could have a local 
login can do anything· It also doesn't make sense on a recent user system 
configured properly, as devfs/udev would take care of permissions, and users 
needs only to set the group correctly (simpler than using pam_console 
anyway).

Seems to me like a workaround for old old (too old!) systems, which is no more 
needed at least for us.

I know this is there also for compatibility, but this makes sys-libs/pam 
ebuild very bloated as for now, and still I don't know a reason to have it 
there.

Some comments about it?
-- 
Diego "Flameeyes" Pettenò
http://wwwstud.dsi.unive.it/~dpetteno/

[-- Attachment #2: Type: application/pgp-signature, Size: 189 bytes --]

Re: [gentoo-dev] PAM related: pam_console ?

[Mike Frysinger]

On Thursday 31 March 2005 08:17 am, Diego "Flameeyes" Pettenò wrote:
> I know this is there also for compatibility, but this makes sys-libs/pam
> ebuild very bloated as for now, and still I don't know a reason to have it
> there.

if you read pam-0.78-r2 and do a search in bugzilla, you'll see that 
pam_console is no longer on by default

some people actually do want it, so ripping it out isnt very nice ;)
-mike

--
gentoo-dev@gentoo.org mailing list

Re: [gentoo-dev] PAM related: pam_console ?

[Diego "Flameeyes" Pettenò]

[-- Attachment #1: Type: text/plain, Size: 659 bytes --]

On Thursday 31 March 2005 15:27, Mike Frysinger wrote:
> if you read pam-0.78-r2 and do a search in bugzilla, you'll see that
> pam_console is no longer on by default
I know, I'm messing around with that ebuild, so I can see it on my own.. but 
this doesn't make the ebuild cleaner... all the way around instead.

> some people actually do want it, so ripping it out isnt very nice ;)
Well, having it as an external ebuild sys-libs/pam_console (or 
sys-pam/pam_console, but that's another story), will also save the users from 
enabling pam_console not knowing what that is.

-- 
Diego "Flameeyes" Pettenò
http://wwwstud.dsi.unive.it/~dpetteno/

[-- Attachment #2: Type: application/pgp-signature, Size: 189 bytes --]

Re: [gentoo-dev] PAM related: pam_console ?

[Mike Frysinger]

On Thursday 31 March 2005 08:34 am, Diego "Flameeyes" Pettenò wrote:
> > some people actually do want it, so ripping it out isnt very nice ;)
>
> Well, having it as an external ebuild sys-libs/pam_console (or
> sys-pam/pam_console, but that's another story), will also save the users
> from enabling pam_console not knowing what that is.

that doesnt make any difference ... whether the user puts 'pam_console' into 
their USE or they `emerge pam_console`, they know what they're getting 
themselves into

if pam_console is giving you a hard time on *BSD, then just use.mask it :P
-mike

--
gentoo-dev@gentoo.org mailing list

Re: [gentoo-dev] PAM related: pam_console ?

[Diego "Flameeyes" Pettenò]

[-- Attachment #1: Type: text/plain, Size: 791 bytes --]

On Thursday 31 March 2005 15:57, Mike Frysinger wrote:
> if pam_console is giving you a hard time on *BSD, then just use.mask it :P
> -mike
As I said is not a problem of bsd in this case. Just look at pam ebuild, is a 
mess! it builds a static glib to be able to build pam_console, there's 
conditional of all kinds...
Moving out pam_console (and the rest of optional pam modules, also) into 
different ebuilds will make user ables to install what they need without 
having a bloated ebuild with conditionals for everything.

This also allow to install/remove pam_console without need to recompile the 
entire pam.

I still would like to see some problems deriving from the pam/pam_console 
splitting.

-- 
Diego "Flameeyes" Pettenò
http://wwwstud.dsi.unive.it/~dpetteno/

[-- Attachment #2: Type: application/pgp-signature, Size: 189 bytes --]

Re: [gentoo-dev] PAM related: pam_console ?

[Mike Frysinger]

On Thursday 31 March 2005 09:26 am, Diego "Flameeyes" Pettenò wrote:
> As I said is not a problem of bsd in this case. Just look at pam ebuild, is
> a mess! it builds a static glib to be able to build pam_console, there's
> conditional of all kinds...

this is so that we (1) dont have to force -fPIC onto libglib.a and (2) we dont 
have to move libglib.so into /lib

> Moving out pam_console (and the rest of optional pam modules, also) into
> different ebuilds will make user ables to install what they need without
> having a bloated ebuild with conditionals for everything.

eh, you're going to have 'bloat' regardless of using 1 ebuild or 10, it's just 
a matter of which kind of bloat you want :p ... and generally i'm against 
splitting packages
-mike

--
gentoo-dev@gentoo.org mailing list

Re: [gentoo-dev] PAM related: pam_console ?

[Diego "Flameeyes" Pettenò]

[-- Attachment #1: Type: text/plain, Size: 1184 bytes --]

On Thursday 31 March 2005 17:01, Mike Frysinger wrote:
> this is so that we (1) dont have to force -fPIC onto libglib.a and (2) we
> dont have to move libglib.so into /lib
I know why it's there.. is also stated clearly on ebuild and the changelog :)

> eh, you're going to have 'bloat' regardless of using 1 ebuild or 10, it's
> just a matter of which kind of bloat you want :p ... and generally i'm
> against splitting packages
Well.. seeing how other things are getting done with plugins, as pam modules 
are just plugins, for example xmms, bmp or gstreamer, the current trend is to 
split the ebuilds, instead of adding a lot of useflags.

Also, counting that pam_console and the other optional pam_* modules aren't 
part of original Linux-PAM makes me prefer having a different ebuild for them 
instead of a single largest one.

Well,  that's obviously IMHO. Having a virtual/pam and 
virtual/pam-base-modules is enough to make the openpam interoperability i'd 
like to have.

And just to make it clear, it's on Linux that I can't build pam_console, I 
haven't tried on fbsd, anyway.

-- 
Diego "Flameeyes" Pettenò
http://wwwstud.dsi.unive.it/~dpetteno/

[-- Attachment #2: Type: application/pgp-signature, Size: 189 bytes --]

Re: [gentoo-dev] PAM related: pam_console ?

[Robin H. Johnson]

[-- Attachment #1: Type: text/plain, Size: 2177 bytes --]

On Thu, Mar 31, 2005 at 03:17:06PM +0200, Diego Flameeyes Petten? wrote:
> Anyway I was wondering what pam_console is used for, at the end. It's a way to 
> set up permissions when someone logins at a console. I would never use 
> something like that on a remote server, as anyone which could have a local 
> login can do anything? It also doesn't make sense on a recent user system 
> configured properly, as devfs/udev would take care of permissions, and users 
> needs only to set the group correctly (simpler than using pam_console 
> anyway).
Since you asked, pam_console is extremely useful in shared computer lab
settings. Take this scenario for example:
- User A has logged into a lab workstation from home, and is working on
  his stuff.
- User B physically goes and sits at the workstation, as he wants to
  copy his research materials to a floppy disk (but this applies to any
  other hardware as well; eg modems, cd writers, et al).
- User A should never have access to the floppy disk, as he is not
  physically present. Only User B should have access, because he is
  physically present.
- Using groups in this case (eg the floppy group) is not suitable, as
  both users would have to be in it, and then they could both access
  the floppy drive.
- pam_console applies a set of permissions ONLY for users logged in at
  the local machine, for the duration of their login. So for the
  duration of User B's physical time at the machine, he has access to
  the hardware as allowed by pam_console.

That said, pam_console is a pain to deal with under a few cases:
- it only takes effect for the first concurrent login at a machine (eg
  the first virtual terminal in use, when none of the others are in
  use).
- In some cases it doesn't correctly reset the permissions after the
  user.

I'd say more than 99% of Gentoo users probably have no use for
pam_console, but it still has a place in Gentoo.

-- 
Robin Hugh Johnson
E-Mail     : robbat2@orbis-terrarum.net
Home Page  : http://www.orbis-terrarum.net/?l=people.robbat2
ICQ#       : 30269588 or 41961639
GnuPG FP   : 11AC BA4F 4778 E3F6 E4ED  F38E B27B 944E 3488 4E85

[-- Attachment #2: Type: application/pgp-signature, Size: 241 bytes --]

Re: [gentoo-dev] PAM related: pam_console ?

[Diego "Flameeyes" Pettenò]

[-- Attachment #1: Type: text/plain, Size: 520 bytes --]

On Thursday 31 March 2005 22:38, Robin H. Johnson wrote:
> I'd say more than 99% of Gentoo users probably have no use for
> pam_console, but it still has a place in Gentoo.
Ok so is not the case to remove it.

I also can understand the usecases, so now I know what this is needed for.

Now the problem is: can that be made an ebuild of its own, so to have less 
bloat on sys-libs/pam? (and maybe having that compiling also under fbsd)?

-- 
Diego "Flameeyes" Pettenò
http://wwwstud.dsi.unive.it/~dpetteno/

[-- Attachment #2: Type: application/pgp-signature, Size: 189 bytes --]

Re: [gentoo-dev] PAM related: pam_console ?

[Mike Frysinger]

On Thursday 31 March 2005 04:09 pm, Diego "Flameeyes" Pettenò wrote:
> Now the problem is: can that be made an ebuild of its own, so to have less
> bloat on sys-libs/pam? (and maybe having that compiling also under fbsd)?

as ive said already i dont like splitting packages ... but i'm not part of the 
pam herd (thank god) so it isnt my call :)

if you do split it though, i'd suggest you split every module rather than just 
certain ones that catch your fancy ... better to be consistent :p
-mike

--
gentoo-dev@gentoo.org mailing list

Re: [gentoo-dev] PAM related: pam_console ?

[Diego "Flameeyes" Pettenò]

[-- Attachment #1: Type: text/plain, Size: 573 bytes --]

On Thursday 31 March 2005 23:35, Mike Frysinger wrote:
> if you do split it though, i'd suggest you split every module rather than
> just certain ones that catch your fancy ... better to be consistent :p
That's what I wanted to do, provide only basic modules with linux-pam 
(pam_unix and other) needed for basic auth facilities.

pam_console was just the first of the list.

Anyway, pam 0.79 is out.. I just ask pam herd if they can add virtual/pam so 
that we can continue on openpam :)

-- 
Diego "Flameeyes" Pettenò
http://wwwstud.dsi.unive.it/~dpetteno/

[-- Attachment #2: Type: application/pgp-signature, Size: 189 bytes --]

Re: [gentoo-dev] PAM related: pam_console ?

[Martin Schlemmer]

[-- Attachment #1: Type: text/plain, Size: 1254 bytes --]

On Thu, 2005-03-31 at 15:17 +0200, Diego "Flameeyes" Pettenò wrote:
> Seems like pam_console modules is broken. I'm not able to make it compile both 
> as a standalone ebuild i'm trying to write and as the complete pam with 
> +pam_console flag.
> 
> Anyway I was wondering what pam_console is used for, at the end. It's a way to 
> set up permissions when someone logins at a console. I would never use 
> something like that on a remote server, as anyone which could have a local 
> login can do anything· It also doesn't make sense on a recent user system 
> configured properly, as devfs/udev would take care of permissions, and users 
> needs only to set the group correctly (simpler than using pam_console 
> anyway).
> 
> Seems to me like a workaround for old old (too old!) systems, which is no more 
> needed at least for us.
> 
> I know this is there also for compatibility, but this makes sys-libs/pam 
> ebuild very bloated as for now, and still I don't know a reason to have it 
> there.
> 
> Some comments about it?

/care

We anyhow move to not using it by default in 0.78 - axe it while we
still can.


-- 
Martin Schlemmer
Gentoo Linux Developer, Desktop/System Team Developer
Cape Town, South Africa


[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 189 bytes --]

Re: [gentoo-dev] PAM related: pam_console ?

[Martin Schlemmer]

[-- Attachment #1: Type: text/plain, Size: 754 bytes --]

On Thu, 2005-03-31 at 08:27 -0500, Mike Frysinger wrote:
> On Thursday 31 March 2005 08:17 am, Diego "Flameeyes" Pettenò wrote:
> > I know this is there also for compatibility, but this makes sys-libs/pam
> > ebuild very bloated as for now, and still I don't know a reason to have it
> > there.
> 
> if you read pam-0.78-r2 and do a search in bugzilla, you'll see that 
> pam_console is no longer on by default
> 
> some people actually do want it, so ripping it out isnt very nice ;)

Well, as its with OpenPAM, and on bsd, I do not see an issue.  I am for
one not going to support OpenPAM on linux, and dont think we should ....


-- 
Martin Schlemmer
Gentoo Linux Developer, Desktop/System Team Developer
Cape Town, South Africa


[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 189 bytes --]

Re: [gentoo-dev] PAM related: pam_console ?

[Martin Schlemmer]

[-- Attachment #1: Type: text/plain, Size: 1431 bytes --]

On Thu, 2005-03-31 at 16:26 +0200, Diego "Flameeyes" Pettenò wrote:
> On Thursday 31 March 2005 15:57, Mike Frysinger wrote:
> > if pam_console is giving you a hard time on *BSD, then just use.mask it :P
> > -mike
> As I said is not a problem of bsd in this case. Just look at pam ebuild, is a 
> mess!

Speak for youself - I think the ebuild is quite decent condition
thinking about what it does.

>  it builds a static glib to be able to build pam_console, there's 
> conditional of all kinds...
> Moving out pam_console (and the rest of optional pam modules, also) into 
> different ebuilds will make user ables to install what they need without 
> having a bloated ebuild with conditionals for everything.
> 

Yeah sure, now its just another ebuild to test and update with each
version bump - if I wanted to be in the KDE herd, I would have joined
it.

> This also allow to install/remove pam_console without need to recompile the 
> entire pam.
> 

 # rm -f /lib/security/pam_console.so

You need to rebuild gcc to have gcj - I do not see the issue.

> I still would like to see some problems deriving from the pam/pam_console 
> splitting.

My fist down your yap.  Seriously, it needs to die (like
pam_console_devfs*), and any user still wanting it, should get what he
asked for.


-- 
Martin Schlemmer
Gentoo Linux Developer, Desktop/System Team Developer
Cape Town, South Africa


[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 189 bytes --]

Re: [gentoo-dev] PAM related: pam_console ?

[Martin Schlemmer]

[-- Attachment #1: Type: text/plain, Size: 1312 bytes --]

On Fri, 2005-04-01 at 00:19 +0200, Diego "Flameeyes" Pettenò wrote:
> On Thursday 31 March 2005 23:35, Mike Frysinger wrote:
> > if you do split it though, i'd suggest you split every module rather than
> > just certain ones that catch your fancy ... better to be consistent :p
> That's what I wanted to do, provide only basic modules with linux-pam 
> (pam_unix and other) needed for basic auth facilities.
> 

And every time there is a version update also update the slew of other
ebuilds?  Like I said, if I wanted to be in the KDE/gstreamer herds, I
would have been.

> pam_console was just the first of the list.
> 

You want it that bad, you can do it, but then you are its daddy, and do
all the updating, bug fixing (I'm sure the devfs crap do will give
issues, as its compile tested to 0.78 api) etc (and thank god if you
do).

> Anyway, pam 0.79 is out.. I just ask pam herd if they can add virtual/pam so 
> that we can continue on openpam :)
> 

Yes, I know will get to it somewhere - its usually a pita to get some
patches updated (pam_console-* for example :/) ... I'll get to it
eventually (want to first see what fedora do, as many pam guys are from
redhat).


-- 
Martin Schlemmer
Gentoo Linux Developer, Desktop/System Team Developer
Cape Town, South Africa


[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 189 bytes --]

[gentoo-dev] bootstrap.sh and /var/lib/portage/world

[mathias]

Hi all,

I finished this night succefully compilation of bootstrap.sh with stage 
1 2005.0.
The problem is my /var/lib/portage/world contain only 4 packages, glibc, 
linux-headers, nano and gettext but no gcc ... I've read something for 
several months about this problem on bugs.gentoo.org or on forums, I 
don't remember exactly, but the question is why bootstrap.sh don't print 
all installed packages in world file since the problem is know for 
several months ?

I've meet a second problem, attr package for compiling search crtn.o in 
/usr/lib/gcc-lib/i386-pc-linux-gnu/3.3.5/../../../ but only 
/usr/lib/i686-pc-linux-gnu exist ... I made symbolic link this morning, 
but why bootstrap (or anything else) don't make this link alone ?

This is not my first installation of this fantastic system, but if it 
was, these problems should have make me to become crazy :/

Perhaps there is lot of reasons to leave it in this state, but I don't 
understand this reasons :)

Thanks a lot for your responses, have a nice day,
mathias
--
gentoo-dev@gentoo.org mailing list

Re: [gentoo-dev] bootstrap.sh and /var/lib/portage/world

[Chris Gianelloni]

[-- Attachment #1: Type: text/plain, Size: 1767 bytes --]

On Thu, 2005-04-07 at 07:34 +0000, mathias wrote:
> Hi all,
> 
> I finished this night succefully compilation of bootstrap.sh with stage 
> 1 2005.0.
> The problem is my /var/lib/portage/world contain only 4 packages, glibc, 
> linux-headers, nano and gettext but no gcc ... I've read something for 
> several months about this problem on bugs.gentoo.org or on forums, I 
> don't remember exactly, but the question is why bootstrap.sh don't print 
> all installed packages in world file since the problem is know for 
> several months ?

The world file will only show packages that are implicitly called by
emerge.  It does not list dependencies.  It does this for a very good
reason, as dependencies can change over time and it keeps you from
having tons of orphaned packages.

> I've meet a second problem, attr package for compiling search crtn.o in 
> /usr/lib/gcc-lib/i386-pc-linux-gnu/3.3.5/../../../ but only 
> /usr/lib/i686-pc-linux-gnu exist ... I made symbolic link this morning, 
> but why bootstrap (or anything else) don't make this link alone ?

Did you change CHOST in your make.conf?  If you did, it won't work.

> This is not my first installation of this fantastic system, but if it 
> was, these problems should have make me to become crazy :/
> 
> Perhaps there is lot of reasons to leave it in this state, but I don't 
> understand this reasons :)
> 
> Thanks a lot for your responses, have a nice day,

Well, this list is not a support list.  It is a development list.  You
would probably be better off asking these questions on gentoo-user, the
forums, or vai a bug on http://bugs.gentoo.org instead.

-- 
Chris Gianelloni
Release Engineering - Strategic Lead/QA Manager
Games - Developer
Gentoo Linux

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 189 bytes --]