Date: Sat, 14 Jul 2007 19:33:35 +0100 (BST) From: Robert Watson <rwatson@FreeBSD.org> To: Garrett Wollman <wollman@bimajority.org> Cc: freebsd-security@freebsd.org Subject: Re: OpenBSM questions Message-ID: <20070714193149.N91807@fledge.watson.org> In-Reply-To: <18073.3478.284631.986914@hergotha.csail.mit.edu> References: <46985815.3060308@os2.kiev.ua> <20070714164146.Q80803@fledge.watson.org> <18073.3478.284631.986914@hergotha.csail.mit.edu>
next in thread | previous in thread | raw e-mail | index | archive | help
On Sat, 14 Jul 2007, Garrett Wollman wrote: > <<On Sat, 14 Jul 2007 16:45:14 +0100 (BST), Robert Watson > <rwatson@freebsd.org> said: > >> This is correct -- login services must be modified to properly set up user >> audit state at login. I am not familiar with work relating to this with >> xdm, kdm, gdm, etc, but it would be very good to see this happen. > > Surely this is something that belongs in a PAM module...? The whole point > of the PAM framework is that you should *not* have to modify every program > that does a login when new mechanisms are introduced or policy changes. Setting login state is not the only thing that audit does. Audit requirements also exist to audit failures in the login process that may be entirely unrelated to authentication. That said, I'm not 100% sure that the audit state, leaving aside the auditing of login events, couldn't be done in a PAM module. An interesting question is why the rest of the UNIX credential is also not set up using PAM -- see calls to setlogin(2), setusercontext(3), etc, in login.c and other things involved in login. Robert N M Watson Computer Laboratory University of Cambridge
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20070714193149.N91807>