Hacker News Reader

Comment by dmitrygr | Hacker News Reader

> how do you debug PAM?

> It ain’t easy.

VMWare workstation has a built-in gdb stub that can debug guest kernel, or any Linux guest userspace process quite easily. There is also support for windows guests, and even a visual studio plugin for that. I am surprised this did not come up as a very simple option to do this.

View on HN

I go into more detail about this in my followup talk: https://xeiaso.net/talks/rustconf-2022-sheer-terror-pam#:~:t....

It is not easy in the slightest. PAM has aged like bottled milk in a desert.

Can confirm from being the maintainer of a PAM module in a past job. The only thing that was stable was debug builds that enabled awful fprintfs to a file in /tmp. It felt like how a freshman in college debugs their code.

So what's a proper way to solve the problem that PAM solves? Instead of an in-process library, have it be a daemon that responds to DBUS requests?

Aside from the config language, this sounds mostly like "it's a pre-login modular C library, and that's alien territory".

It would probably need kernel support for this to happen, but I'd like to see a daemon in the system that runs authentication logic and then arbitrarily curses the requesting process with the UID/GID/whatever it needs to get the job done.

How would that work with, for example a single deamon supporting multiple (different) remote users - for example ftpd, or sshd?

(I imagine you could say that sshd forks for each user, but some of the legacy systems like ftpd/ircd wouldn't have that as an option..)

I think Android has a more saner system, but I’m a layperson when it comes to these — android runs every user process under a different user that has very restricted access (restricted with SELinux as well), and they do extensive IPC. There is a daemon that handles elevated requests through IPC, so that’s where dynamic access control happens.

forget debugging, just configuring PAM is a freaking nightmare. oh and make a mistake? can't log in to fix it lmao. i got really good about keeping a root shell open after i made that mistake a few times.

Reply on news.ycombinator.com