pam_open_session returns PAM_SUCCESS but no pam session?

[Dan Yefimov]

On 05.12.2010 22:52, Henk te Sligte wrote:
> Hi guys,
>
> I have been puzzling with this all day, and I can't figure out why
> this doesn't work.
> I compiled "xsh.c" from the examples, and created the appropriate
> config file. However, I do get a shell, but from the same user that is
> logged in.
> I even tried to modify the system call to just a simple "touch
> test.txt", but this command is executed as the same user.
> So I guess my problem is somewhere in the config file, but I don't
> know what to modify. I used the "login" and "passwd", and I even tried
> my own, where I just call pam_permit.so for every action, and even
> though I am authenticated without a problem, the xsh script still
> creates the file with the same user.
>
> So instead of the regular source, I did (line 142 from examples/xsh.c):
>            /* this is always a really bad thing for security! */
>            retcode = system("touch /home/henk/test.txt");
>            if(retcode != PAM_SUCCESS) {
>                  printf("Error code: %d\n", retcode);
>            }
>
> After calling "./a.out henk" as root, this is the response:
> ==>  called pam_start()
>    got: `Success'
> ==>  called pam_set_item(PAM_RUSER)()
>    got: `Success'
> ==>  called pam_set_item(PAM_RHOST)()
>    got: `Success'
> ==>  called pam_set_item(PAM_RHOST)()
>    got: `Success'
> Password:
> ==>  called pam_authenticate()
>    got: `Success'
> ==>  called pam_acct_mgmt()
>    got: `Success'
> ==>  called pam_setcred()
>    got: `Success'
> ==>  called pam_open_session()
>    got: `Success'
> The user [henk] has been authenticated and `logged in'
> ==>  called pam_close_session()
>    got: `Success'
> ==>  called pam_setcred()
>    got: `Success'
> ==>  called pam_end()
>    got: `Success'
>
> However, the file is created as root.
> This is my config script (from /etc/pam.d/passwd):
>
> #%PAM-1.0
> auth    required        pam_env.so
> auth    required        pam_unix2.so
> account required        pam_unix2.so
> password        requisite       pam_pwcheck.so  cracklib
> password        optional        pam_gnome_keyring.so    use_authtok
> password        required        pam_unix2.so    use_authtok
> session required        pam_limits.so
> session required        pam_unix2.so
> session optional        pam_apparmor.so
> session optional        pam_umask.so
> session optional        pam_gnome_keyring.so    auto_start only_if=gdm,lxdm
>
> Can anyone help me out? What am I doing wrong?
>
You should carefully read all documentation about PAM. The first parameter of 
pam_start() is in fact the name of PAM config file. If you specified "login" 
there, PAM will parse /etc/pam.d/login, if you specified something else, you 
must create the corresponding config file in /etc/pam.d. In addition, switching 
UID/GID to those of logging in user and initializing his supplementary group 
list is the job of your application, not PAM.

-- 

Sincerely Yours, Dan.