4 ms·
Requiring pam_close_session is just bad design - if it needs special cleanup, pam_open_session should grab process pidfd and spawn separate monitor process (or
by garaetjjte 3y ago
Requiring pam_close_session is just bad design - if it needs special cleanup, pam_open_session should grab process pidfd and spawn separate monitor process (or pass pidfd to existing daemon).
- Spivak 3y agosudo is that monitor process, it's the same with how containerd and podman work, it's much much easier to babysit a process when you're its parent.
- formerly_proven 3y agoPAM predates pidfd by about 25 years or so, though it's really weird how steadfastly unix heritage systems avoided handles for important things, resulting in race conditions and security issues all over the place.
- fragmede 3y agoWhich is definitely what you want in your authentication subsystem.