Bug 1144055

Summary:	Please add "pam_keyinit.so" to the /etc/pam.d/ppp configuration file
Product:	[openSUSE] openSUSE Tumbleweed	Reporter:	Josef Möllers <josef.moellers>
Component:	Basesystem	Assignee:	Reinhard Max <max>
Status:	RESOLVED INVALID	QA Contact:	E-mail List <qa-bugs>
Severity:	Normal
Priority:	P5 - None	CC:	alynx.zhou, security-team
Version:	Current
Target Milestone:	Current
Hardware:	All
OS:	openSUSE Factory
Whiteboard:
Found By:	---	Services Priority:
Business Priority:		Blocker:	---
Marketing QA Status:	---	IT Deployment:	---

Description Josef Möllers 2019-08-02 15:08:58 UTC

In the near future, the use of kernel keyrings will be enabled by systemd.
To fully support this feature, the ppp package must include the pam_keyinit.so
module in its /etc/pam.d/ppp configuration file.
Please add this module to the /etc/pam.d/ppp configuration file with the
appropriate parameters:
session optional pam_keyinit.so revoke [force]
Thanks.

Comment 1 Josef Möllers 2019-08-15 07:49:12 UTC

Changed codestream to TW where it belongs.

Comment 2 Josef Möllers 2019-10-08 06:32:21 UTC

ping!
Any progress?

Comment 3 Reinhard Max 2019-10-08 13:42:26 UTC

Not sure if including pam_keyinit is actually needed or desirable for ppp.
Maybe the security team can help us to clarify this.

Comment 4 Marcus Meissner 2019-10-14 15:47:28 UTC

I currently have a hard time thinking if kernel keyrings are needed by PAM.

Comment 5 Josef Möllers 2019-10-14 15:53:24 UTC

(In reply to Marcus Meissner from comment #4)
> I currently have a hard time thinking if kernel keyrings are needed by PAM.

I agree that I haven't seen them in free wilderness yet, but I think it's one of the Next Great Things!

Somebody has to make sure that when you "log in", one way or the other, and may need access to the key in the new user's keyring, the keyring is properly set up.
It's not PAM who needs the keyring (more important, the keys attached) but the processes that run under the new user's UID.

Just my 2€ct!

Comment 6 Reinhard Max 2019-10-15 12:10:28 UTC

AFAIU pam_keyinit is (also) needed to keep user processes from inheriting access to keyrings from the systemd process running under root even if neither PAM nor the user process are using kernel keyrings themselves. But I am not sure whether or not this is relevant for the pppd case compared to programs that fall into the login category.

Comment 7 Josef Möllers 2019-12-05 14:05:07 UTC

Any progress?

Comment 9 Josef Möllers 2020-01-08 12:45:18 UTC

ping!
Any progress?

Comment 10 Josef Möllers 2020-04-07 14:11:23 UTC

After some more research: ppp doesn't need pam_keyinit, so closing this bug as INVALID.