bugGKSu - Bugs: bug #19132, modifying PAM configuration could...

 
 

bug #19132: modifying PAM configuration could break gksu

Submitted by:  Lionel Dricot <ploum>
Submitted on:  Fri 23 Feb 2007 11:11:07 PM UTC  
 
Category: NoneSeverity: 3 - Normal
Item Group: NoneStatus: None
Privacy: PublicAssigned to: None
Open/Closed: Open

Add a New Comment (Rich MarkupRich Markup):
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Fri 25 Jan 2008 10:36:05 PM UTC, comment #2:

Upstream has just added a new passprompt_override sudoers option for forcing use of custom prompts:

http://www.sudo.ws/bugs/show_bug.cgi?id=180

Alex Tarkovsky <atarkovsky>
Sun 25 Feb 2007 12:44:25 PM UTC, comment #1:

Yeah, this is the biggest problem in gksu in my opinion. The problem lies in the way gksu is designed: it uses su and sudo to do the dirty work. This, per se, is not bad: this allows the amount of code that is run as root written by me to be minimal, delegating the security implications to two very well tested packages.

The problem is su and sudo were not thought to be frontended. My idea to fix this is to write a 'GUI communication' interface for both, so intead of waiting for sudo to display the password prompt gksu tells it to display (GNOME_SUDO_PASS) it will see something like this:

sudo -> stderr: authentication started
sudo -> stderr: options:
sudo -> stderr: using_password=false
sudo -> stderr: prompt=Put your eye in the device
sudo -> stderr: go

I haven't discuessed this idea with people yet. I would like to have the su and sudo maintainers (upstream) to understand if they think this is feasible, and if they would accept a patch to do something like that.

Thanks!

Gustavo Noronha Silva <kov>
Project Administrator
Fri 23 Feb 2007 11:11:07 PM UTC, original submission:

If you modify PAM configuration to act differently, gksu could become unusable.

For example, see https://wiki.ubuntu.com/ThinkFinger that modify PAM to take care of a fingerprint reader.

(in /etc/pam.d/auth-common)
auth sufficient pam_thinkfinger.so
auth required pam_unix.so try_first_pass nullok_secure

With this configuration, Login in console, GDM and su will work perfectly and ask you either for your password or your fingerprint.

Unfortunatly, gksu will become "invisible". In fact, the sentence "enter your password or swipe your finger" will appear in the console from which you are launching gksu. As, most of the time, you are not launching gksu from a console but from an icon, you will see nothing and your application will not start. Anyway, it is still working because if you know it and swipe your finger, your application will eventually appear. So gksu is still listenning. It is just "invisible".

The original Launchpad bug is : https://bugs.launchpad.net/ubuntu/+source/gksu/+bug/86843

Lionel Dricot <ploum>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

Attached Files
file #20732:  prompt.patch added by None (338B - text/x-patch - Patch received on Ubuntu bug tracker)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by atarkovsky (Posted a comment)
  • -unavailable- added by chiron80
  • -unavailable- added by kov (Posted a comment)
  • -unavailable- added by ploum (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 2 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Fri 11 Jun 2010 10:03:17 AM UTCNoneAttached File-=>Added prompt.patch, #20732
    Wed 24 Oct 2007 01:24:07 AM UTCchiron80Carbon-Copy-=>Added chiron80

    Back to the top


    Powered by Savane 3.1-cleanup