4 ms·
So what's a proper way to solve the problem that PAM solves? Instead of an in-process library, have it be a daemon that responds to DBUS requests? Aside from t
by tbrownaw 4y ago
So what's a proper way to solve the problem that PAM solves? Instead of an in-process library, have it be a daemon that responds to DBUS requests?
Aside from the config language, this sounds mostly like "it's a pre-login modular C library, and that's alien territory".
- xena 4y agoIt would probably need kernel support for this to happen, but I'd like to see a daemon in the system that runs authentication logic and then arbitrarily curses the requesting process with the UID/GID/whatever it needs to get the job done.
- stevekemp 4y agoHow would that work with, for example a single deamon supporting multiple (different) remote users - for example ftpd, or sshd? (I imagine you could say that sshd forks for each user, but some of the legacy systems like ftpd/ircd wouldn't have that as an option..)
- kaba0 4y agoI think Android has a more saner system, but I’m a layperson when it comes to these — android runs every user process under a different user that has very restricted access (restricted with SELinux as well), and they do extensive IPC. There is a daemon that handles elevated requests through IPC, so that’s where dynamic access control happens.