Bugzilla – Bug 1144055
Please add "pam_keyinit.so" to the /etc/pam.d/ppp configuration file
Last modified: 2020-04-07 14:11:23 UTC
In the near future, the use of kernel keyrings will be enabled by systemd.
To fully support this feature, the ppp package must include the pam_keyinit.so
module in its /etc/pam.d/ppp configuration file.
Please add this module to the /etc/pam.d/ppp configuration file with the
session optional pam_keyinit.so revoke [force]
Changed codestream to TW where it belongs.
Not sure if including pam_keyinit is actually needed or desirable for ppp.
Maybe the security team can help us to clarify this.
I currently have a hard time thinking if kernel keyrings are needed by PAM.
(In reply to Marcus Meissner from comment #4)
> I currently have a hard time thinking if kernel keyrings are needed by PAM.
I agree that I haven't seen them in free wilderness yet, but I think it's one of the Next Great Things!
Somebody has to make sure that when you "log in", one way or the other, and may need access to the key in the new user's keyring, the keyring is properly set up.
It's not PAM who needs the keyring (more important, the keys attached) but the processes that run under the new user's UID.
Just my 2€ct!
AFAIU pam_keyinit is (also) needed to keep user processes from inheriting access to keyrings from the systemd process running under root even if neither PAM nor the user process are using kernel keyrings themselves. But I am not sure whether or not this is relevant for the pppd case compared to programs that fall into the login category.
After some more research: ppp doesn't need pam_keyinit, so closing this bug as INVALID.