macros: stop pam-auth-update reporting a conflict it resolves itself - #14985
macros: stop pam-auth-update reporting a conflict it resolves itself#149850intro wants to merge 1 commit into
Conversation
bash_pam_unix_enable copies the packaged unix pam-config to cac_unix, adds a Conflicts line naming unix, and runs pam-auth-update. The configuration that comes out is the right one, but getting there looks like a failure. pam-auth-update finds both profiles selected, drops unix to settle the conflict, and then reports what it just did as a debconf error. Nothing else in the copy changes, so both profiles still answer to the name "Unix authentication" and the error names the same profile twice. What a reader sees is a complaint about a conflict the remediation created and pam-auth-update already dealt with, with no hint that it exited 0 having written exactly what was asked of it. So we do it explicitly. Enable cac_unix and disable unix in the same pam-auth-update call, leaving no conflict for pam-auth-update to report, and give the copy a name of its own so it can be told apart from the profile it replaces. The disable option arrived in libpam-runtime 1.5, so Ubuntu 22.04 prints the message either way. There the rename is the whole of the improvement, which is not much, but it beats naming one profile twice. The six no_empty_passwords and no_empty_passwords_unix scenarios that stand up a competing profile of their own hit the same message, so they disable unix too.
|
Hi @0intro. Thanks for your PR. I'm waiting for a ComplianceAsCode member to verify that this patch is reasonable to test. If it is, they should reply with Tip We noticed you've done this a few times! Consider joining the org to skip this step and gain Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
Mab879
left a comment
Mab879
left a comment
There was a problem hiding this comment.
@ComplianceAsCode/ubuntu-maintainers can you please take a look as well.
2 participants
Description:
bash_pam_unix_enable copies the packaged unix pam-config to cac_unix, adds a Conflicts line naming unix, and runs pam-auth-update. The configuration that comes out is the right one, but getting there looks like a failure. pam-auth-update finds both profiles selected, drops unix to settle the conflict, and then reports what it just did as a debconf error. Nothing else in the copy changes, so both profiles still answer to the name "Unix authentication" and the error names the same profile twice. What a reader sees is a complaint about a conflict the remediation created and pam-auth-update already dealt with, with no hint that it exited 0 having written exactly what was asked of it.
So we do it explicitly. Enable cac_unix and disable unix in the same pam-auth-update call, leaving no conflict for pam-auth-update to report, and give the copy a name of its own so it can be told apart from the profile it replaces.
The disable option arrived in libpam-runtime 1.5, so Ubuntu 22.04 prints the message either way. There the rename is the whole of the improvement, which is not much, but it beats naming one profile twice.
The six no_empty_passwords and no_empty_passwords_unix scenarios that stand up a competing profile of their own hit the same message, so they disable unix too.