484754 – sys-apps/util-linux[pam]: should install /etc/pam.d/runuser and /etc/pam.d/runuser-l

Bug 484754 - sys-apps/util-linux[pam]: should install /etc/pam.d/runuser and /etc/pam.d/runuser-l

Summary: sys-apps/util-linux[pam]: should install /etc/pam.d/runuser and /etc/pam.d/ru...

Status:	RESOLVED FIXED

Alias:	None

Product:	Gentoo Linux
Classification:	Unclassified
Component:	[OLD] Core system (show other bugs)
Hardware:	All Linux

Importance:	Normal normal with 1 vote (vote)
Assignee:	Gentoo's Team for Core System packages

URL:
Whiteboard:
Keywords:

Duplicates (2):	553122 570380 (view as bug list)
Depends on:
Blocks:

Reported:	2013-09-13 12:47 UTC by Eric Benoit
Modified:	2017-02-26 00:20 UTC (History)
CC List:	6 users (show)

See Also:
Package list:
Runtime testing required:	---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Eric Benoit 2013-09-13 12:47:54 UTC

I'm not sure if this is a bug or a security conscious decision. It seems that I'm missing /etc/pam.d/runuser and /etc/pam.d/runuser-l which prevents runuser(1) from working. I imagine these should be included with sys-auth/pambase.

Borrowing copies from a Fedora system seems to have runuser working as expected.

Reproducible: Always

Comment 1 SpanKY gentoo-dev

2015-02-14 04:11:05 UTC

at a glance, it looks like we want "runuser" to be the same as "su", and "runuser-l" to be the same as "login"

since these are only used by the runuser program from util-linux, it looks like it should be part of util-linux rather than pambase

Comment 2 SpanKY gentoo-dev

2016-01-02 06:06:58 UTC

*** Bug 570380 has been marked as a duplicate of this bug. ***

Comment 3 SpanKY gentoo-dev

2016-01-02 06:07:09 UTC

*** Bug 553122 has been marked as a duplicate of this bug. ***

Comment 4 samurai.no.dojo 2016-01-17 12:20:57 UTC

Same here.
When I try tu use puppetserver. Service fails right a way and when I try tu run "#puppetserver foreground --debug" it fails with "runuser: Failure setting user credentials"

Comment 5 Brandon Holbrook 2016-02-08 22:07:42 UTC

Add me to the list of affected users.  Trying to install Atlassian Jira on a gentoo system, their startup scripts fail quickly every time.  After a bunch of digging and strace()ing, found that their startup scripts require a functioning "runuser", which Gentoo doesn't have due to this pam misconfiguration.  If /etc/pam.d/runuser* is missing, PAM falls back to "other", which is pam_deny everything.

I can confirm that copying /etc/pam.d/su to /etc/pam.d/runuser resolves the issue.

Comment 6 Matthew Thode ( prometheanfire ) archtester

2017-02-24 22:21:17 UTC

@spanky I'd agree that it should be part of util-linux.  Also now affected.

https://review.openstack.org/#/c/414347/25/tests/elements/dibdevel-minimal/post-install.d/80-fix-runuser

Comment 7 Matthew Thode ( prometheanfire ) archtester

2017-02-26 00:20:31 UTC

fixed in 2.29.2-r1