Skip to content

WIP: main/linux-pam: pam.d files cleanup

donoban requested to merge donoban/aports:improve-pam into master

Hi,

I tried to do a little reorganization of '/etc/pam.d' in the aim of get a simpler and safer pam configuration by default.

The 'base-X' files now include only lines related to their scope (e.g. https://gitlab.alpinelinux.org/donoban/aports/-/blob/911edcf2b11e92587386fdb5967f24044666410c/main/linux-pam/base-auth.pamd) so it is more flexible for custom configuration.

The "other" file now logs and denies access by default so any program that was not explicit authorized can't gain access. This could break something that I didn't test, at this time I'm running plasma without problems.

'system-login' and 'system-local-login' are fully removed because they are absolutely unused. Maybe did they come from debian/archlinux? The way for using them should be something like: 'login > system-local-login > system-login', but I feel that which the base-X scheme it is more easy to understand and modify.

su.pamd is moved to community/shadow, since it installs the pam-aware su binary.

Edited by Rasmus Thomsen

Merge request reports