mirror of
https://github.com/freebsd/freebsd-src.git
synced 2026-10-28 11:25:21 +01:00
Xin LI
12444a4da5
Extend PAM integration beyond account checks to include credential establishment and session management, allowing PAM modules to configure the execution environment for user cron jobs. Previously, cron only called pam_acct_mgmt() to verify account validity but immediately terminated the PAM handle before job execution. This prevented PAM modules from establishing sessions, setting credentials (e.g., Kerberos tickets), or exporting environment variables needed by jobs. The PAM handle now persists in the intermediate process throughout the job execution, enabling proper session open/close pairing. Credentials are established and sessions opened while still running as root, before dropping privileges in the grandchild. PAM environment variables are exported in the job process with user crontab variables taking precedence. A session rule (pam_permit.so) is added to /etc/pam.d/cron to enable session support without changing default behavior. Administrators can replace this with other modules as needed. System crontab entries continue to bypass all PAM operations. PR: bin/244844 Reviewed by: des MFC after: 2 weeks Differential Revision: https://reviews.freebsd.org/D54415
This directory contains configuration files for the Pluggable
Authentication Modules (PAM) library.
Each file details the module chain for a single service, and must be
named after that service. If no configuration file is found for a
particular service, the /etc/pam.d/other is used instead. If that
file does not exist, /etc/pam.conf is searched for entries matching
the specified service or, failing that, the "other" service.
See the pam(3) manual page for an explanation of the workings of the
PAM library and descriptions of the various files and modules. Below
is a summary of the format for the pam.conf and /etc/pam.d/* files.
Configuration lines take the following form:
module-type control-flag module-path arguments
Comments are introduced with a hash mark ('#'). Blank lines and lines
consisting entirely of comments are ignored.
The meanings of the different fields are as follows:
module-type:
auth: prompt for a password to authenticate that the user is
who they say they are, and set any credentials.
account: non-authentication based authorization, based on time,
resources, etc.
session: housekeeping before and/or after login.
password: update authentication tokens.
control-flag: How libpam handles success or failure of the module.
required: success is required; on failure all remaining
modules are run, but the request will be denied.
requisite: success is required, and on failure no remaining
modules are run.
sufficient: success is sufficient, and if no previous required
module failed, no remaining modules are run.
binding: success is sufficient; on failure all remaining
modules are run, but the request will be denied.
optional: ignored unless the other modules return PAM_IGNORE.
arguments: Module-specific options, plus some generic ones:
debug: syslog debug info.
no_warn: return no warning messages to the application.
Remove this to feed back to the user the
reason(s) they are being rejected.
use_first_pass: try authentication using password from the
preceding auth module.
try_first_pass: first try authentication using password from
the preceding auth module, and if that fails
prompt for a new password.
use_mapped_pass: convert cleartext password to a crypto key.
expose_account: allow printing more info about the user when
prompting.
Note that having a "sufficient" module as the last entry for a
particular service and module type may result in surprising behaviour.
To get the intended semantics, add a "required" entry listing the
pam_deny module at the end of the chain.