Note: This is a beta release of Red Hat Bugzilla 5.0. The data contained within is a snapshot of the live data so any changes you make will not be reflected in the production Bugzilla. Also email is disabled so feel free to test any aspect of the site that you want. File any problems you find or give feedback here.
Bug 154498 - util-linux login & pam session
Summary: util-linux login & pam session
Alias: None
Product: Red Hat Enterprise Linux 4
Classification: Red Hat
Component: util-linux
Version: 4.0
Hardware: All
OS: Linux
Target Milestone: ---
: ---
Assignee: Karel Zak
QA Contact: Ben Levenson
Depends On:
Blocks: 156322
TreeView+ depends on / blocked
Reported: 2005-04-12 08:30 UTC by Karel Zak
Modified: 2007-11-30 22:07 UTC (History)
2 users (show)

Fixed In Version: RHBA-2005-669
Doc Type: Bug Fix
Doc Text:
Clone Of:
Last Closed: 2005-10-05 16:52:14 UTC
Target Upstream Version:

Attachments (Terms of Use)
bug fix patch (by Steve Grubb) (deleted)
2005-04-12 08:32 UTC, Karel Zak
no flags Details | Diff

System ID Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2005:669 qe-ready SHIPPED_LIVE util-linux bug fix update 2005-10-05 04:00:00 UTC

Description Karel Zak 2005-04-12 08:30:17 UTC
From: 	Steve Grubb
Date: 	Fri, 8 Apr 2005 16:24:11 -0400  (22:24 CEST)

I found a problem in login's handling of the 
pam session. If for some reason the pam set credential call fails, it does 
not close the pam session. pam open can mount drives, so calling pam close is 
important. Attached is a patch that fixes this. I believe all versions of 
util-linux are similarly affected.

Comment 1 Karel Zak 2005-04-12 08:32:09 UTC
Created attachment 113015 [details]
bug fix patch (by Steve Grubb)

Comment 12 Karel Zak 2005-09-05 08:14:07 UTC
Test case:

Add at begin of /etc/pam.d/system-auth:
   auth        required auth=success cred=perm_denied

(this setting disable login to system!). Now try log in for example by "telnel
localhost". You have to found in /var/log/messages:

Sep  5 10:04:48 petra pam_tally[9480]: pam_tally: option deny=5 allowed in auth
phase only
Sep  5 10:04:48 petra remote(pam_unix)[9480]: session opened for user zakkr by
Sep  5 10:04:48 petra remote(pam_unix)[9480]: session closed for user zakkr
Sep  5 10:04:48 petra login[9480]: Permission denied

The important line is "session closed" that missing in old version without bug fix.

Comment 15 Red Hat Bugzilla 2005-10-05 16:52:14 UTC
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on the solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.

Note You need to log in before you can comment on or make changes to this bug.