Bugzilla – Full Text Bug Listing
|Summary:||Please add "pam_keyinit.so" to the /etc/pam.d/ppp configuration file|
|Product:||[openSUSE] openSUSE Tumbleweed||Reporter:||Josef Möllers <josef.moellers>|
|Component:||Basesystem||Assignee:||Reinhard Max <max>|
|Status:||RESOLVED INVALID||QA Contact:||E-mail List <qa-bugs>|
|Priority:||P5 - None||CC:||alynx.zhou, security-team|
|Found By:||---||Services Priority:|
|Marketing QA Status:||---||IT Deployment:||---|
Description Josef Möllers 2019-08-02 15:08:58 UTC
Comment 1 Josef Möllers 2019-08-15 07:49:12 UTC
Changed codestream to TW where it belongs.
Comment 2 Josef Möllers 2019-10-08 06:32:21 UTC
ping! Any progress?
Comment 3 Reinhard Max 2019-10-08 13:42:26 UTC
Not sure if including pam_keyinit is actually needed or desirable for ppp. Maybe the security team can help us to clarify this.
Comment 4 Marcus Meissner 2019-10-14 15:47:28 UTC
I currently have a hard time thinking if kernel keyrings are needed by PAM.
Comment 5 Josef Möllers 2019-10-14 15:53:24 UTC
(In reply to Marcus Meissner from comment #4) > I currently have a hard time thinking if kernel keyrings are needed by PAM. I agree that I haven't seen them in free wilderness yet, but I think it's one of the Next Great Things! Somebody has to make sure that when you "log in", one way or the other, and may need access to the key in the new user's keyring, the keyring is properly set up. It's not PAM who needs the keyring (more important, the keys attached) but the processes that run under the new user's UID. Just my 2€ct!
Comment 6 Reinhard Max 2019-10-15 12:10:28 UTC
AFAIU pam_keyinit is (also) needed to keep user processes from inheriting access to keyrings from the systemd process running under root even if neither PAM nor the user process are using kernel keyrings themselves. But I am not sure whether or not this is relevant for the pppd case compared to programs that fall into the login category.
Comment 7 Josef Möllers 2019-12-05 14:05:07 UTC
Comment 9 Josef Möllers 2020-01-08 12:45:18 UTC
ping! Any progress?
Comment 10 Josef Möllers 2020-04-07 14:11:23 UTC
After some more research: ppp doesn't need pam_keyinit, so closing this bug as INVALID.