Bug 11126 - "su --login" fails when using pam + util-linux
Summary: "su --login" fails when using pam + util-linux
Status: RESOLVED FIXED
Alias: None
Product: OE-Core
Classification: Build System, Metadata & Runtime
Component: core (show other bugs)
Version: unspecified
Hardware: x86 Multiple
: Medium+ normal
Target Milestone: 2.4 M2
Assignee: Patrick Ohly
QA Contact:
URL:
Whiteboard: Backport to 2.3.1
Depends on:
Blocks:
 
Reported: 2017-03-06 13:01 UTC by Patrick Ohly
Modified: 2017-08-01 09:39 UTC (History)
2 users (show)

See Also:
OS type for building Yocto: ---
Type of Regression: ---
Verified:
Documentation change: No (bug/feature does not impact docs)

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Patrick Ohly 2017-03-06 13:01:22 UTC 
To reproduce, build current poky with this in local.conf:

DISTRO_FEATURES_append = " pam systemd"
VIRTUAL-RUNTIME_init_manager = "systemd"
VIRTUAL-RUNTIME_initscripts = ""
DISTRO_FEATURES_BACKFILL_CONSIDERED = "sysvinit"
IMAGE_INSTALL_append = " util-linux"

The relevant part is enabling pam and installing util-linux. Using systemd probably doesn't matter.

Build core-image-minimal, boot into qemu. Then:

qemux86 login: root
root@qemux86:~# useradd test
root@qemux86:~# /bin/su.util-linux - test
su.util-linux: Authentication failure

This only occurs:
* when using - (aka --login)
* for su from util-linux
* when using pam

The default priorities are:

/bin/busybox.suid 50
/bin/su.shadow 200
/bin/su.util-linux 80

So normally this should occur.

The root cause of the problem is that su.util-linux looks for a pam "su-l" config file instead of the normal "su" config file. When not found, it uses "other", which has "auth pam_deny.so" and thus prevents the operation.

This fixes the problem:
ln -s su /etc/pam.d/su-l

How useful is it to have su.util-linux? Instead of adding su-l I'm leaning towards simply disabling the utility entirely. It's currently in:

PACKAGECONFIG[pam] = "--enable-su --enable-runuser,--disable-su --disable-runuser, libpam,"
Comment 1 Patrick Ohly 2017-03-06 13:01:57 UTC 
(In reply to comment #0)
> The default priorities are:
> 
> /bin/busybox.suid 50
> /bin/su.shadow 200
> /bin/su.util-linux 80
> 
> So normally this should occur.

Should *not* occur.
Comment 2 Ross Burton 2017-06-06 11:26:39 UTC 
Patrick, would you be able to handle this?  Your resolution seems sensible to me.
Comment 3 Patrick Ohly 2017-06-12 11:13:18 UTC 
(In reply to comment #2)
> Patrick, would you be able to handle this?  Your resolution seems sensible
> to me.

Which solution? Symlinking /etc/pam.d/su-l or removing su from util-linux?
Comment 4 Patrick Ohly 2017-07-12 09:03:10 UTC 
(In reply to comment #3)
> (In reply to comment #2)
> > Patrick, would you be able to handle this?  Your resolution seems sensible
> > to me.
> 
> Which solution? Symlinking /etc/pam.d/su-l or removing su from util-linux?

symlink fix set to the list: "util-linux: fix "su -" and package su separately"
Comment 5 Patrick Ohly 2017-08-01 09:39:19 UTC 
Fixed in "util-linux: fix "su -" and package su separately".