11126 2017-03-06 13:01:22 +0000 "su --login" fails when using pam + util-linux 2017-08-01 09:39:19 +0000 1 1 7 Build System, Metadata & Runtime OE-Core core unspecified x86 Multiple RESOLVED FIXED Backport to 2.3.1 Medium+ normal 2.4 M2 1 patrick.ohly patrick.ohly meta.mr.watcher meta.watcher --- --- No (bug/feature does not impact docs) oldest_to_newest 71083 0 patrick.ohly 2017-03-06 13:01:22 +0000 To reproduce, build current poky with this in local.conf: DISTRO_FEATURES_append = " pam systemd" VIRTUAL-RUNTIME_init_manager = "systemd" VIRTUAL-RUNTIME_initscripts = "" DISTRO_FEATURES_BACKFILL_CONSIDERED = "sysvinit" IMAGE_INSTALL_append = " util-linux" The relevant part is enabling pam and installing util-linux. Using systemd probably doesn't matter. Build core-image-minimal, boot into qemu. Then: qemux86 login: root root@qemux86:~# useradd test root@qemux86:~# /bin/su.util-linux - test su.util-linux: Authentication failure This only occurs: * when using - (aka --login) * for su from util-linux * when using pam The default priorities are: /bin/busybox.suid 50 /bin/su.shadow 200 /bin/su.util-linux 80 So normally this should occur. The root cause of the problem is that su.util-linux looks for a pam "su-l" config file instead of the normal "su" config file. When not found, it uses "other", which has "auth pam_deny.so" and thus prevents the operation. This fixes the problem: ln -s su /etc/pam.d/su-l How useful is it to have su.util-linux? Instead of adding su-l I'm leaning towards simply disabling the utility entirely. It's currently in: PACKAGECONFIG[pam] = "--enable-su --enable-runuser,--disable-su --disable-runuser, libpam," 71084 1 patrick.ohly 2017-03-06 13:01:57 +0000 (In reply to comment #0) > The default priorities are: > > /bin/busybox.suid 50 > /bin/su.shadow 200 > /bin/su.util-linux 80 > > So normally this should occur. Should *not* occur. 73737 2 ross.burton 2017-06-06 11:26:39 +0000 Patrick, would you be able to handle this? Your resolution seems sensible to me. 73978 3 patrick.ohly 2017-06-12 11:13:18 +0000 (In reply to comment #2) > Patrick, would you be able to handle this? Your resolution seems sensible > to me. Which solution? Symlinking /etc/pam.d/su-l or removing su from util-linux? 74947 4 patrick.ohly 2017-07-12 09:03:10 +0000 (In reply to comment #3) > (In reply to comment #2) > > Patrick, would you be able to handle this? Your resolution seems sensible > > to me. > > Which solution? Symlinking /etc/pam.d/su-l or removing su from util-linux? symlink fix set to the list: "util-linux: fix "su -" and package su separately" 75550 5 patrick.ohly 2017-08-01 09:39:19 +0000 Fixed in "util-linux: fix "su -" and package su separately".