bugGKSu - Bugs: bug #19132, modifying PAM configuration could...

 
 

bug #19132: modifying PAM configuration could break gksu

Submitter:  Lionel Dricot <ploum>
Submitted:  Fri 23 Feb 2007 11:11:07 PM UTC
   
 
Category:  None Severity:  3 - Normal
Item Group:  None Status:  None
Privacy:  Public Assigned to:  None
Open/Closed:  Open
* Mandatory Fields

Add a New Comment Rich Markup
   

Fri 25 Jan 2008 10:36:05 PM UTC, comment #2: 

Upstream has just added a new passprompt_override sudoers option for forcing use of custom prompts:

http://www.sudo.ws/bugs/show_bug.cgi?id=180

Alex Tarkovsky <atarkovsky>
Sun 25 Feb 2007 12:44:25 PM UTC, comment #1: 

Yeah, this is the biggest problem in gksu in my opinion. The problem lies in the way gksu is designed: it uses su and sudo to do the dirty work. This, per se, is not bad: this allows the amount of code that is run as root written by me to be minimal, delegating the security implications to two very well tested packages.

The problem is su and sudo were not thought to be frontended. My idea to fix this is to write a 'GUI communication' interface for both, so intead of waiting for sudo to display the password prompt gksu tells it to display (GNOME_SUDO_PASS) it will see something like this:

sudo -> stderr: authentication started
sudo -> stderr: options:
sudo -> stderr:  using_password=false
sudo -> stderr:  prompt=Put your eye in the device
sudo -> stderr: go

I haven't discuessed this idea with people yet. I would like to have the su and sudo maintainers (upstream) to understand if they think this is feasible, and if they would accept a patch to do something like that.

Thanks!

Gustavo Noronha Silva <kov>
Group administrator
Fri 23 Feb 2007 11:11:07 PM UTC, original submission:  

If you modify PAM configuration to act differently, gksu could become unusable.

For example, see https://wiki.ubuntu.com/ThinkFinger that modify PAM to take care of a fingerprint reader.

(in /etc/pam.d/auth-common)
auth sufficient pam_thinkfinger.so
auth required pam_unix.so try_first_pass nullok_secure

With this configuration, Login in console, GDM and su will work perfectly and ask you either for your password or your fingerprint.

Unfortunatly, gksu will become "invisible". In fact, the sentence "enter your password or swipe your finger" will appear in the console from which you are launching gksu. As, most of the time, you are not launching gksu from a console but from an icon, you will see nothing and your application will not start. Anyway, it is still working because if you know it and swipe your finger, your application will eventually appear. So gksu is still listenning. It is just "invisible".


The original Launchpad bug is : https://bugs.launchpad.net/ubuntu/+source/gksu/+bug/86843

Lionel Dricot <ploum>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

Attached Files
file #20732:  prompt.patch added by None (338B - text/x-patch - Patch received on Ubuntu bug tracker)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by atarkovsky (Posted a comment)
  • -email is unavailable- added by chiron80
  • -email is unavailable- added by kov (Posted a comment)
  • -email is unavailable- added by ploum (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 2 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2010-06-11 None Attached File- Added prompt.patch, #20732
    2007-10-24 chiron80 Carbon-Copy- Added chiron80

    Back to the top

    Powered by Savane 3.13-cf05.
    Corresponding source code