diff options
author | Ricardo Wurmus <rekado@elephly.net> | 2017-05-24 12:05:47 +0200 |
---|---|---|
committer | Ricardo Wurmus <rekado@elephly.net> | 2017-05-24 12:05:47 +0200 |
commit | d1a914082b7e53636f9801769ef96218b2125c4b (patch) | |
tree | 998805fc59fe0b1bb105b24a6a79fff646257d96 /gnu/system/pam.scm | |
parent | 657fb6c947d94cf946f29cd24e88bd080c01ff0a (diff) | |
parent | ae548434337cddf9677a4cd52b9370810b2cc9b6 (diff) | |
download | guix-d1a914082b7e53636f9801769ef96218b2125c4b.tar.gz |
Merge branch 'master' into core-updates
Diffstat (limited to 'gnu/system/pam.scm')
-rw-r--r-- | gnu/system/pam.scm | 31 |
1 files changed, 21 insertions, 10 deletions
diff --git a/gnu/system/pam.scm b/gnu/system/pam.scm index 4546c1a73a..eedf933946 100644 --- a/gnu/system/pam.scm +++ b/gnu/system/pam.scm @@ -204,21 +204,27 @@ dumped in /etc/pam.d/NAME, where NAME is the name of SERVICE." (env (pam-entry ; to honor /etc/environment. (control "required") (module "pam_env.so")))) - (lambda* (name #:key allow-empty-passwords? motd) + (lambda* (name #:key allow-empty-passwords? (allow-root? #f) motd) "Return a standard Unix-style PAM service for NAME. When -ALLOW-EMPTY-PASSWORDS? is true, allow empty passwords. When MOTD is true, it -should be a file-like object used as the message-of-the-day." +ALLOW-EMPTY-PASSWORDS? is true, allow empty passwords. When ALLOW-ROOT? is +true, allow root to run the command without authentication. When MOTD is +true, it should be a file-like object used as the message-of-the-day." ;; See <http://www.linux-pam.org/Linux-PAM-html/sag-configuration-example.html>. (let ((name* name)) (pam-service (name name*) (account (list unix)) - (auth (list (if allow-empty-passwords? - (pam-entry - (control "required") - (module "pam_unix.so") - (arguments '("nullok"))) - unix))) + (auth (append (if allow-root? + (list (pam-entry + (control "sufficient") + (module "pam_rootok.so"))) + '()) + (list (if allow-empty-passwords? + (pam-entry + (control "required") + (module "pam_unix.so") + (arguments '("nullok"))) + unix)))) (password (list (pam-entry (control "required") (module "pam_unix.so") @@ -256,7 +262,12 @@ authenticate to run COMMAND." ;; These programs are setuid-root. (map (cut unix-pam-service <> #:allow-empty-passwords? allow-empty-passwords?) - '("su" "passwd" "sudo")) + '("passwd" "sudo")) + ;; This is setuid-root, as well. Allow root to run "su" without + ;; authenticating. + (list (unix-pam-service "su" + #:allow-empty-passwords? allow-empty-passwords? + #:allow-root? #t)) ;; These programs are not setuid-root, and we want root to be able ;; to run them without having to authenticate (notably because |